Merge ~ahasenack/ubuntu/+source/ubuntu-advantage-tools:focal-ignore-apparmor-errors-when-starting-apt-news-2057937 into ubuntu/+source/ubuntu-advantage-tools:ubuntu/focal-devel

[Andreas Hasenack]

Same as https://code.launchpad.net/~ahasenack/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/462716, but for focal.

[Bryce Harrington (bryce)]

See discussion at the noble MP:
https://code.launchpad.net/~ahasenack/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/462716

review: Approve

[Andreas Hasenack (ahasenack)]

Rejected from unapproved, due to missing version update in uaclient/version.py

2554538... by Andreas Hasenack on 2024-03-25

version.py: bump to 31.2.2

bfc82fa... by Andreas Hasenack on 2024-03-25

changelog

Unmerged commits

bfc82fa... by Andreas Hasenack on 2024-03-25

changelog

2554538... by Andreas Hasenack on 2024-03-25

version.py: bump to 31.2.2

be5a82c... by Andreas Hasenack on 2024-03-20

changelog

ffe1e24... by Andreas Hasenack on 2024-03-19

apt-news.service: ignore apparmor errors when starting

It's possible to have a system where apparmor is enabled, but no profile
is loaded. This happens when the user removed the apparmor debian
package. In that situation, the ubuntu_pro_apt_news profile will not be
loaded into the kernel at startup, and systemd will fail to apply it to
the service when starting.

Systemd already ignores the apparmor setting when apparmor is disabled,
but in this situation it is still enabled. The fix is to configure the
service to also ignore errors when apparmor is enabled.

The drawback is that the service might run unconfined now if there are
problems applying the selected apparmor profile on startup.

Fixes: #3002
LP: #2057937

diff --git a/debian/changelog b/debian/changelog
index 6f6cf69..0f80881 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+ubuntu-advantage-tools (31.2.2~20.04) focal; urgency=medium
+
+  * version.py: match version from d/changelog (LP: #2058934)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 25 Mar 2024 11:49:51 -0300
+
+ubuntu-advantage-tools (31.2.1~20.04) focal; urgency=medium
+
+  * apt-news.service: ignore apparmor errors when starting (LP: #2057937)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 20 Mar 2024 09:25:41 -0300
+
 ubuntu-advantage-tools (31.2~20.04) focal; urgency=medium
 
   * Backport new upstream release (LP: #2048921)
diff --git a/systemd/apt-news.service b/systemd/apt-news.service
index 2bab966..5e1e0a7 100644
--- a/systemd/apt-news.service
+++ b/systemd/apt-news.service
@@ -14,7 +14,7 @@ Description=Update APT News
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/python3 /usr/lib/ubuntu-advantage/apt_news.py
-AppArmorProfile=ubuntu_pro_apt_news
+AppArmorProfile=-ubuntu_pro_apt_news
 CapabilityBoundingSet=~CAP_SYS_ADMIN
 CapabilityBoundingSet=~CAP_NET_ADMIN
 CapabilityBoundingSet=~CAP_NET_BIND_SERVICE
diff --git a/uaclient/version.py b/uaclient/version.py
index a1f69da..a20dae6 100644
--- a/uaclient/version.py
+++ b/uaclient/version.py
@@ -14,7 +14,7 @@ from uaclient.defaults import CANDIDATE_CACHE_PATH, UAC_RUN_PATH
 from uaclient.exceptions import ProcessExecutionError
 from uaclient.system import subp
 
-__VERSION__ = "31.2"
+__VERSION__ = "31.2.2"
 PACKAGED_VERSION = "@@PACKAGED_VERSION@@"