Merge ~ahasenack/ubuntu/+source/rsyslog:lunar-rsyslog-apparmor-armhf into ubuntu/+source/rsyslog:ubuntu/devel

[Andreas Hasenack]

Quick fix for the linked bug, where apparmor cannot be enforced/changed/loaded in our armhf DEP8 infrastructure.

PPA with amd64, arm64, and armhf: https://launchpad.net/~ahasenack/+archive/ubuntu/lunar-rsyslog-apparmor-armhf/+packages

Tests passed:
Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-lunar-ahasenack-lunar-rsyslog-apparmor-armhf/?format=plain)
  rsyslog @ amd64:
    24.02.23 01:44:24 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa2
  rsyslog @ arm64:
    24.02.23 00:31:32 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa2
  rsyslog @ armhf:
    24.02.23 00:23:26 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa2

Notice how in the amrhf case enforcing the apparmor profile fails, but we continue:
(...)
autopkgtest [00:14:14]: test simple-logger: [-----------------------
Enforcing the /etc/apparmor.d/usr.sbin.rsyslogd apparmor profile
Setting /etc/apparmor.d/usr.sbin.rsyslogd to enforce mode.

ERROR: /sbin/apparmor_parser: Unable to replace "rsyslogd". Permission denied; attempted to load a profile while confined?

Error, ignoring and continuing
Logging message: logger-test-value=0e667633-5126-49b8-9116-ece55acc870b
(...)

[Bryce Harrington (bryce)]

Solution LGTM, although I'd suggest a few wording changes to help future troubleshooters. See inline comments.

With those changes applied, +1, no need for 2nd round of review.
If you disagree, feel free to bounce back to me for more chat.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, bryce
Uploaders: ahasenack, bryce
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

I made some changes to make it fail if the apparmor profile cannot be enforced, if:
a) it's ubuntu
b) it's armhf

New run is green:
Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-lunar-ahasenack-lunar-rsyslog-apparmor-armhf/?format=plain)
  rsyslog @ amd64:
    28.02.23 18:43:26 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa4
  rsyslog @ arm64:
    28.02.23 18:28:03 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa4
  rsyslog @ armhf:
    28.02.23 18:16:18 Log 🗒️ ✅ Triggers: rsyslog/8.2302.0-1ubuntu2~ppa4

non-armhf logs this:
...
autopkgtest [18:31:57]: test simple-mysql: [-----------------------
Enforcing the /etc/apparmor.d/usr.sbin.rsyslogd apparmor profile
Setting /etc/apparmor.d/usr.sbin.rsyslogd to enforce mode.
...

armhf logs this:
...
autopkgtest [18:12:54]: test simple-mysql: [-----------------------
Enforcing the /etc/apparmor.d/usr.sbin.rsyslogd apparmor profile

ERROR: /sbin/apparmor_parser: Unable to replace "rsyslogd". Permission denied; attempted to load a profile while confined?

Setting /etc/apparmor.d/usr.sbin.rsyslogd to enforce mode.
Warning, failed to enforce apparmor profile.
On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error.
See #2008393 for details.
...

Please take another look

[Andreas Hasenack (ahasenack)]

I also updated the bug with a link to at least some of the setup that is done for armhf lxd containers in the autopkgtest infrastructure, but even with those settings, I couldn't reproduce the apparmor blockage in my pi4 arm64 host with armhf lxd.

[Bryce Harrington (bryce)]

Ooh, I like this a lot, it nicely limits the handling to armhf specifically, and gives much better feedback to the tester.

Couple formatting notes below but otherwise LGTM, +1.

review: Approve

[Andreas Hasenack (ahasenack)]

Funny those tab/spaces changes, that was a copy/paste with the mouse from one file to d/t/utils. Somehow that "created" some tabs, heh. Fixed.

I also moved the return to the end, and reset rc to zero if it's ubuntu + armhf, so we don't fail in that case.

[Andreas Hasenack (ahasenack)]

Retested and uploaded:

Uploading rsyslog_8.2302.0-1ubuntu2.dsc
Uploading rsyslog_8.2302.0-1ubuntu2.debian.tar.xz
Uploading rsyslog_8.2302.0-1ubuntu2_source.buildinfo
Uploading rsyslog_8.2302.0-1ubuntu2_source.changes

diff --git a/debian/changelog b/debian/changelog
index dfcec4e..bf142e1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+rsyslog (8.2302.0-1ubuntu2) lunar; urgency=medium
+
+  * d/t/simple-*, d/t/control: ignore aa-enforce error, which can happen
+    on armhf in the Ubuntu DEP8 infrastructure, and allow-stderr for
+    these tests (LP: #2008393)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 23 Feb 2023 18:56:07 -0300
+
 rsyslog (8.2302.0-1ubuntu1) lunar; urgency=medium
 
   * Merge with Debian unstable. Remaining changes:
diff --git a/debian/tests/control b/debian/tests/control
index 89703c0..0593972 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -4,16 +4,16 @@ Restrictions: needs-root allow-stderr
 
 Tests: simple-logger
 Depends: rsyslog, bsdutils, apparmor-utils, uuid-runtime
-Restrictions: needs-root
+Restrictions: needs-root allow-stderr
 
 Tests: simple-mysql
 # rsyslog-mysql has to be installed by the test script, because it pulls in dbconfig-common
 # which will be setup *before* mysql-server is configured and running, which fails.
 Depends: bsdutils, apparmor-utils, mysql-server, uuid-runtime
-Restrictions: needs-root
+Restrictions: needs-root allow-stderr
 
 Tests: simple-pgsql
 # rsyslog-pgsql has to be installed by the test script, because it pulls in dbconfig-common
 # which will be setup *before* postgresql is configured and running, which fails.
 Depends: bsdutils, apparmor-utils, postgresql, postgresql-client, uuid-runtime
-Restrictions: needs-root
+Restrictions: needs-root allow-stderr
diff --git a/debian/tests/simple-logger b/debian/tests/simple-logger
index 1c38834..b625712 100755
--- a/debian/tests/simple-logger
+++ b/debian/tests/simple-logger
@@ -3,21 +3,10 @@
 set -e
 set -o pipefail
 
-# make sure we are confined and in enforce mode for this test, if supported
-apparmor_profile="/etc/apparmor.d/usr.sbin.rsyslogd"
-if [ ! -d /etc/apparmor.d/rsyslog.d ]; then
-    echo "No /etc/apparmor.d/rsyslog directory, not touching apparmor status"
-
-elif [ ! -f "${apparmor_profile}" ]; then
-    echo "No ${apparmor_profile} file, not touching apparmor status"
-
-elif ! aa-status --enabled 2>/dev/null; then
-    echo "Apparmor disabled (aa-status)"
+source debian/tests/utils
 
-else
-    echo "Enforcing the ${apparmor_profile} apparmor profile"
-    aa-enforce "${apparmor_profile}"
-fi
+# make sure we are confined and in enforce mode for this test, if supported
+try_enforce_apparmor
 
 message="logger-test-value=$(uuidgen)"
 
diff --git a/debian/tests/simple-mysql b/debian/tests/simple-mysql
index 036f1af..c0d0c9e 100755
--- a/debian/tests/simple-mysql
+++ b/debian/tests/simple-mysql
@@ -6,20 +6,7 @@ set -o pipefail
 source debian/tests/utils
 
 # make sure we are confined and in enforce mode for this test, if supported
-apparmor_profile="/etc/apparmor.d/usr.sbin.rsyslogd"
-if [ ! -d /etc/apparmor.d/rsyslog.d ]; then
-    echo "No /etc/apparmor.d/rsyslog directory, not touching apparmor status"
-
-elif [ ! -f "${apparmor_profile}" ]; then
-    echo "No ${apparmor_profile} file, not touching apparmor status"
-
-elif ! aa-status --enabled 2>/dev/null; then
-    echo "Apparmor disabled (aa-status)"
-
-else
-    echo "Enforcing the ${apparmor_profile} apparmor profile"
-    aa-enforce "${apparmor_profile}"
-fi
+try_enforce_apparmor
 
 # Installing rsyslog-mysql without having a mysql DB already configured on
 # localhost fails, because the dbconfig-common postinst runs before the mysql
diff --git a/debian/tests/simple-pgsql b/debian/tests/simple-pgsql
index 9f4c163..a09f3a8 100755
--- a/debian/tests/simple-pgsql
+++ b/debian/tests/simple-pgsql
@@ -6,20 +6,7 @@ set -o pipefail
 source debian/tests/utils
 
 # make sure we are confined and in enforce mode for this test, if supported
-apparmor_profile="/etc/apparmor.d/usr.sbin.rsyslogd"
-if [ ! -d /etc/apparmor.d/rsyslog.d ]; then
-    echo "No /etc/apparmor.d/rsyslog directory, not touching apparmor status"
-
-elif [ ! -f "${apparmor_profile}" ]; then
-    echo "No ${apparmor_profile} file, not touching apparmor status"
-
-elif ! aa-status --enabled 2>/dev/null; then
-    echo "Apparmor disabled (aa-status)"
-
-else
-    echo "Enforcing the ${apparmor_profile} apparmor profile"
-    aa-enforce "${apparmor_profile}"
-fi
+try_enforce_apparmor
 
 # Installing rsyslog-pgsql without having a postgresq DB already configured on
 # localhost fails, because the dbconfig-common postinst runs before the
diff --git a/debian/tests/utils b/debian/tests/utils
index 5d503ef..ecc942b 100644
--- a/debian/tests/utils
+++ b/debian/tests/utils
@@ -39,3 +39,38 @@ check_db_for_message() {
         return 1
     fi
 }
+
+try_enforce_apparmor() {
+    local apparmor_profile="/etc/apparmor.d/usr.sbin.rsyslogd"
+    local -i rc=0
+
+    if [ ! -d /etc/apparmor.d/rsyslog.d ]; then
+        echo "No /etc/apparmor.d/rsyslog directory, not touching apparmor status"
+
+    elif [ ! -f "${apparmor_profile}" ]; then
+        echo "No ${apparmor_profile} file, not touching apparmor status"
+
+    elif ! aa-status --enabled 2>/dev/null; then
+        echo "Apparmor disabled (aa-status)"
+
+    else
+        echo "Enforcing the ${apparmor_profile} apparmor profile"
+        aa-enforce "${apparmor_profile}" || rc=$?
+        if [ ${rc} -ne 0 ]; then
+            # This can fail on armhf in the Ubuntu DEP8 infrastructure
+            # because that environment restricts changing apparmor profiles.
+            # (See LP: #2008393)
+            arch=$(dpkg --print-architecture)
+            vendor=$(dpkg-vendor --query Vendor)
+            if [ "${arch}" = "armhf" ] && [ "${vendor}" = "Ubuntu" ]; then
+                echo "WARNING: failed to enforce apparmor profile."
+                echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error."
+                echo "See #2008393 for details."
+                rc=0
+            else
+                echo "ERROR: failed to enforce apparmor profile"
+            fi
+        fi
+    fi
+    return ${rc}
+}