Merge ~alexsander-souza/maas:lp2016908_enable_apparmor into maas:master

[Alexsander de Souza]

enable apparmor for Jammy and newer releases

the kernel bug that motivated MAAS to disable apparmor was fixed a while ago,
so we don't need to do this for newer releases

fixes LP#2016908

c26c0a1... by Alexsander de Souza on 2023-05-19

remove leftover debug

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lp2016908_enable_apparmor lp:~alexsander-souza/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 8f0170a882b213470a311d7a6d106160b07526ed

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lp2016908_enable_apparmor lp:~alexsander-souza/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: c26c0a18ff8d4970aa977acca32a5b2178f8720d

review: Approve

[Dimitri John Ledkov (xnox)]

review: Approve (lgtm)

627ac5b... by Alexsander de Souza on 2023-05-22

more robust checking

[Adam Collard (adam-collard)]

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lp2016908_enable_apparmor lp:~alexsander-souza/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 627ac5bbe9d9f9a918a9dec223baa6f7c7c2ba6b

review: Approve

diff --git a/src/provisioningserver/kernel_opts.py b/src/provisioningserver/kernel_opts.py
index 7ecbcf7..b0da4a0 100644
--- a/src/provisioningserver/kernel_opts.py
+++ b/src/provisioningserver/kernel_opts.py
@@ -8,6 +8,7 @@ from collections import namedtuple
 import os
 
 import curtin
+from distro_info import UbuntuDistroInfo
 from netaddr import IPAddress
 
 from provisioningserver.drivers import ArchitectureRegistry
@@ -111,13 +112,23 @@ def compose_purpose_opts(params):
         "cc:{'datasource_list': ['MAAS']}end_cc",
         # Read by cloud-init.
         "cloud-config-url=%s" % params.preseed_url,
-        # Disable apparmor in the ephemeral environment. This addresses
-        # MAAS bug LP: #1677336 due to LP: #1408106
-        "apparmor=0",
     ]
     return kernel_params
 
 
+def compose_apparmor_opts(params):
+    if params.osystem == "ubuntu":
+        di = UbuntuDistroInfo()
+        codenames = di.get_all()
+        if params.release in codenames and (
+            codenames.index(params.release) < codenames.index("jammy")
+        ):
+            # Disable apparmor in the ephemeral environment. This addresses
+            # MAAS bug LP: #1677336 due to LP: #1408106
+            return ["apparmor=0"]
+    return []
+
+
 def compose_arch_opts(params):
     """Return any architecture-specific options required"""
     arch_subarch = f"{params.arch}/{params.subarch}"
@@ -145,6 +156,7 @@ def compose_kernel_command_line(params):
     # nomodeset prevents video mode switching.
     options += ["nomodeset"]
     options += compose_purpose_opts(params)
+    options += compose_apparmor_opts(params)
     # Note: logging opts are not respected by ephemeral images, so
     #       these are actually "purpose_opts" but were left generic
     #       as it would be nice to have.
diff --git a/src/provisioningserver/tests/test_kernel_opts.py b/src/provisioningserver/tests/test_kernel_opts.py
index 1892a4f..396aa4e 100644
--- a/src/provisioningserver/tests/test_kernel_opts.py
+++ b/src/provisioningserver/tests/test_kernel_opts.py
@@ -310,19 +310,47 @@ class TestKernelOpts(MAASTestCase):
         # The result of compose_kernel_command_line includes the
         # options for apparmor. See LP: #1677336 and LP: #1408106
         params = self.make_kernel_parameters(
-            purpose="enlist", fs_host=factory.make_ipv4_address()
+            osystem="ubuntu",
+            release="focal",
+            purpose="enlist",
+            fs_host=factory.make_ipv4_address(),
         )
         cmdline = compose_kernel_command_line(params)
-        self.assertThat(cmdline, ContainsAll(["apparmor=0"]))
+        self.assertIn("apparmor=0", cmdline)
 
     def test_commissioning_compose_kernel_command_line_apparmor_disabled(self):
         # The result of compose_kernel_command_line includes the
         # options for apparmor. See LP: #1677336 and LP: #1408106
         params = self.make_kernel_parameters(
-            purpose="commissioning", fs_host=factory.make_ipv4_address()
+            osystem="ubuntu",
+            release="focal",
+            purpose="commissioning",
+            fs_host=factory.make_ipv4_address(),
+        )
+        cmdline = compose_kernel_command_line(params)
+        self.assertIn("apparmor=0", cmdline)
+
+    def test_enlist_compose_kernel_command_line_apparmor_default(self):
+        # For Jammy onwards, we should use the kernel default for apparmor
+        params = self.make_kernel_parameters(
+            osystem="ubuntu",
+            release="jammy",
+            purpose="enlist",
+            fs_host=factory.make_ipv4_address(),
+        )
+        cmdline = compose_kernel_command_line(params)
+        self.assertNotIn("apparmor=0", cmdline)
+
+    def test_commissioning_compose_kernel_command_line_apparmor_default(self):
+        # For Jammy onwards, we should use the kernel default for apparmor
+        params = self.make_kernel_parameters(
+            osystem="ubuntu",
+            release="jammy",
+            purpose="commissioning",
+            fs_host=factory.make_ipv4_address(),
         )
         cmdline = compose_kernel_command_line(params)
-        self.assertThat(cmdline, ContainsAll(["apparmor=0"]))
+        self.assertNotIn("apparmor=0", cmdline)
 
     def test_commissioning_compose_kernel_command_line_inc_extra_opts(self):
         mock_get_curtin_sep = self.patch(