Merge ~ahasenack/ubuntu/+source/php-net-ldap2:lunar-php-net-ldap2-apparmor-dep8 into ubuntu/+source/php-net-ldap2:ubuntu/devel

[Andreas Hasenack]

Adjust the slapd apparmor profile to allow slapd to read/write/lock files in the autopkgtest temporary directory.

There is the usual "apparmor on armhf in the ubuntu dep8 infrastructure" issue. I copied the approach I used in the rsyslog package[2].

While I was writing up this MP, I wondered about another way to fix this problem. Instead of adjusting the apparmor profile, we could also just make the test use a directory under /var/tmp, because that is allowed by the existing apparmor profile. Well, almost: it misses[1] the lock (k) permission I'm afraid :/ :

  /var/tmp/ rw,
  /var/tmp/** rw,

And in my testing, "k" was needed.

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/php-net-ldap2-dep8-apparmor-fix/+packages

DEP8 is green:
Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-lunar-ahasenack-php-net-ldap2-dep8-apparmor-fix/?format=plain)
  php-net-ldap2 @ amd64:
    01.03.23 20:16:36 Log 🗒️ ✅ Triggers: php-net-ldap2/2.2.1-1ubuntu1~ppa2

https://autopkgtest.ubuntu.com/results/autopkgtest-lunar-ahasenack-php-net-ldap2-dep8-apparmor-fix/lunar/amd64/p/php-net-ldap2/20230301_201636_84b7a@/log.gz

PHPUnit 9.6.3 by Sebastian Bergmann and contributors.

.........IIII............I.III.IIIIIIIIIII...................IIII 65 / 99 ( 65%)
IIIIIIIIIIIIIIIIIIIIII............ 99 / 99 (100%)

Time: 00:01.429, Memory: 14.00 MB

OK, but incomplete, skipped, or risky tests!
Tests: 99, Assertions: 1117, Incomplete: 45.
autopkgtest [20:16:12]: test upstream-testsuite: -----------------------]
upstream-testsuite PASS
autopkgtest [20:16:13]: test upstream-testsuite: - - - - - - - - - - results - - - - - - - - - -
autopkgtest [20:16:14]: @@@@@@@@@@@@@@@@@@@@ summary
upstream-testsuite PASS

Note: when running the DEP8 tests in a local lunar container, or even vm, with the autopkgtest runner, they fail, but in the DEP8 infrastructure (as above), they pass. ¯\_(ツ)_/¯

1. https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/apparmor-profile#n38
2. https://git.launchpad.net/ubuntu/+source/rsyslog/tree/debian/tests/utils#n59

[Sergio Durigan Junior (sergiodj)]

LGTM. Unfortunately I don't see Debian accepting such a change easily, but it's worth trying submitting it to them, I guess.

I built the package and ran autopkgtest locally, and it actually passed.

autopkgtest [16:25:00]: @@@@@@@@@@@@@@@@@@@@ summary
upstream-testsuite PASS

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, sergiodj
Uploaders: ahasenack, sergiodj
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks, uploaded:

Uploading php-net-ldap2_2.2.1-1ubuntu1.dsc
Uploading php-net-ldap2_2.2.1-1ubuntu1.debian.tar.xz
Uploading php-net-ldap2_2.2.1-1ubuntu1_source.buildinfo
Uploading php-net-ldap2_2.2.1-1ubuntu1_source.changes

I'll probe the waters and try to send this to debian, let's see...

[Andreas Hasenack (ahasenack)]

I sent this to debian and it was merged.

https://salsa.debian.org/php-team/pear/php-net-ldap2/-/merge_requests/1

diff --git a/debian/changelog b/debian/changelog
index b3f6a3e..25590dc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+php-net-ldap2 (2.2.1-1ubuntu1) lunar; urgency=medium
+
+  * d/t/upstream-testsuite: if apparmor is enabled, adjust the slapd
+    profile to allow access to the $AUTOPKGTEST_TMP directory
+    (LP: #2008825)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 28 Feb 2023 18:03:21 -0300
+
 php-net-ldap2 (2.2.1-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index 5f693e5..d5b1112 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: php-net-ldap2
 Section: php
 Priority: optional
-Maintainer: Debian PHP PEAR Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian PHP PEAR Maintainers <[e-mail]>
 Uploaders: Benoit Mortier <[e-mail]>,
            Prach Pongpanich <[e-mail]>,
            Guilhem Moulin <[e-mail]>
diff --git a/debian/tests/upstream-testsuite b/debian/tests/upstream-testsuite
index 161feb7..f12ba8e 100755
--- a/debian/tests/upstream-testsuite
+++ b/debian/tests/upstream-testsuite
@@ -4,6 +4,31 @@ set -ue
 PATH="/usr/sbin:/sbin:/usr/bin:/bin"
 export PATH
 
+try_reload_apparmor_profile() {
+    local apparmor_profile="${1}"
+    local -i rc=0
+    local arch
+    local vendor
+
+    apparmor_parser -r -W -T "${apparmor_profile}" || rc=$?
+    if [ ${rc} -ne 0 ]; then
+        # This can fail on armhf in the Ubuntu DEP8 infrastructure
+        # because that environment restricts changing apparmor profiles.
+        # (See LP: #2008393)
+        arch=$(dpkg --print-architecture)
+        vendor=$(dpkg-vendor --query Vendor)
+        if [ "${arch}" = "armhf" ] && [ "${vendor}" = "Ubuntu" ]; then
+            echo "WARNING: failed to enforce apparmor profile."
+            echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error."
+            echo "See #2008393 for details."
+            rc=0
+        else
+            echo "ERROR: failed to adjust the slapd apparmor profile for this test."
+        fi
+    fi
+    return ${rc}
+}
+
 for ((i = 0; i < 10; i++)); do
     if [ -S "/run/ldapi" ]; then
         break
@@ -12,6 +37,15 @@ for ((i = 0; i < 10; i++)); do
     sleep 1
 done
 
+apparmor_profile="/etc/apparmor.d/usr.sbin.slapd"
+if [ -f "${apparmor_profile}" ]; then
+    if aa-status --enabled 2>/dev/null; then
+        # Adjust apparmor so slapd can read the heimdal master key
+        echo " ${AUTOPKGTEST_TMP}/** rwk, " >> /etc/apparmor.d/local/usr.sbin.slapd
+        try_reload_apparmor_profile "${apparmor_profile}"
+    fi
+fi
+
 # see tests/HOWTO_SETUP_OPENLDAP_TESTCASE.txt and tests/ldapconfig.ini.dist
 SLAPD_ADDRESS="127.0.0.1"
 SLAPD_PORT=389