Merge lp:~alextu/lxc-android-config/lp1575564_include_rules_in_device_tarball into lp:lxc-android-config

[Alex Tu]

apparmor:change apparmor-easyprof-ubuntu_android to include rules in /system/usr/share/apparmor/hardware/*

apparmor:change apparmor-easyprof-ubuntu_android to include rules in /system/usr/share/apparmor/hardware/*

instead of let device tarball to override apparmor-easyprof-ubuntu_android,
because the way of override will cause another issue lp#1425704.

Bug: https://bugs.launchpad.net/zhongshan/+bug/1575564

[Alex Tu (alextu)]

for turbo, the related mp is https://code.launchpad.net/~alextu/zhongshan/+git/device_meizu_m86/+merge/293722

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

LGTM

review: Approve

[Jamie Strandboge (jdstrand)]

This is fine so long as this package provides /system/usr/share/apparmor/hardware/audio.d, /system/usr/share/apparmor/hardware/graphics.d and /system/usr/share/apparmor/hardware/video.d. If these directories are not guaranteed to exist and they don't for some reason, the apparmor policy will fail to load for all applications and they will fail to start (since the launcher won't be able to transition to the app's profile, because it isn't loaded in the kernel).

I would prefer that this merge add a debian/...dirs file to make this happen (this assumes that what this package ships isn't bind mounted over).

review: Needs Fixing

[Alex Tu (alextu)]

I tried add the paths to debian/dirs, But it gets error becasue installation process try to remove something under /system which is a loop mount with system.img.

debian/dirs:
$ cat debian/dirs
system/ubuntu/usr/share/apparmor/hardware/audio.d
system/ubuntu/usr/share/apparmor/hardware/video.d
system/ubuntu/usr/share/apparmor/hardware/graphics.d

error:
$ sudo dpkg -i lxc-android-config_0.2
(Reading database ... 51069 files and directories currently installed.)
Preparing to unpack lxc-android-config_0.230+15.04.20160425-0ubuntu1_all.deb ...
Unpacking lxc-android-config (0.230+15.04.20160425-0ubuntu1) over (0.230+15.04.20160425-0ubuntu1) ...
dpkg: error processing archive lxc-android-config_0.230+15.04.20160425-0ubuntu1_all.deb (--install):
 unable to securely remove '/system/ubuntu.dpkg-tmp': Read-only file system
Processing triggers for ureadahead (0.100.0-19) ...
Processing triggers for dbus (1.8.12-1ubuntu5) ...
Errors were encountered while processing:
 lxc-android-config_0.230+15.04.20160425-0ubuntu1_all.deb

[Alex Tu (alextu)]

btw, there are also 2 files which bind mount by device tarbal should be removed, otherwise lxc-android-config package installation caused a failure:

./lib/udev/rules.d/70-android.rules
./lib/udev/rules.d/99-android.rules

$ sudo dpkg -i lxc-android-config_0.2
(Reading database ... 51060 files and directories currently installed.)
Preparing to unpack lxc-android-config_0.230+15.04.20160425-0ubuntu1_all.deb ...
Unpacking lxc-android-config (0.230+15.04.20160425-0ubuntu1) over (0.230+15.04.20160425-0ubuntu1) ...
dpkg: error processing archive lxc-android-config_0.230+15.04.20160425-0ubuntu1_all.deb (--install):
 unable to make backup link of `./lib/udev/rules.d/99-android.rules' before installing new version: Invalid cross-device link
dpkg-deb (subprocess): decompressing archive member: lzma write error: Broken pipe
dpkg-deb: error: subprocess <decompress> returned error exit status 2

[lp:~alextu/lxc-android-config/lp1575564_include_rules_in_device_tarball]

17. By Alex Tu on 2016-05-08

apparmor:change apparmor-easyprof-ubuntu_android to include rules in /system/usr/share/apparmor/hardware/*

instead of let device tarball to override apparmor-easyprof-ubuntu_android,
because the way of override will cause another issue lp#1425704.

Bug: https://bugs.launchpad.net/zhongshan/+bug/1575564

[You-Sheng Yang (vicamo)]

@Jamie, /system is the mount path for loopback image /var/lib/lxc/android/system.img, so everything inside the folder will be hidden by the image itself unless somehow it gets re-configured after system.img being mounted. That sounds we're going to introduce another timing dependency or something even ugly/worse. Is there any other way to ignore non-existent folder for apparmor itself? Documentation says these config files are preprocessed by cpp, and there doesn't seem to have a known switch to turning off such error reporting.

[Jamie Strandboge (jdstrand)]

Regarding ignoring directories-- no (I mean, obviously the code could be patched to do that but then the timing race would result in different policy depending on who won the race so it doesn't really solve anything).

I don't think 'dpkg -i' of lxc-android-config is what you want. I'm not familiar with /system or that it was a loopback mount. Since this is a loopback mount, simply adjust the loopback file to include these directories and make sure /system is mounted at the time the profiles are run so that they are always there. If the system loopback file is per device, adjust the scripts so that the directories are always there; if the system loopback files is generated from debs, pick a deb common to all the devices that creates those directories.

[Jamie Strandboge (jdstrand)]

s/at the time the profiles are run/before the time the profiles are compiled/

[Oliver Grawert (ogra)]

you can only use dpkg -i from a chrooted boot in recovery for such packages. there are plenty of them and usually the bind mount means that there is a file that is either needed inside *and* outside of the container or it is a file we can only ship in the device tarball but need it available in the ubuntu rootfs (the udev rules above fall into that category).

if you would remove these cross device bind mounts you would break the independence of device tarballs from the rootfs ones and have to create one rootfs per device.

this is sadly the nature of using a bind-mount-farm instead of an overlayfs ... dpkg tries to do an atomic unpack of the file which does not work across filesystems (i.e. with bind-mounted files) there is no way to solve this except by changing the system setup altogether (i.e. patch all kernels to support overlayfs (making porting for community people really hard due to requiring giant kernel patches)).
the QA team has several HOWTOs how to deal with these special packages when manually replacing them in the system.

Unmerged revisions

17. By Alex Tu on 2016-05-08

apparmor:change apparmor-easyprof-ubuntu_android to include rules in /system/usr/share/apparmor/hardware/*

instead of let device tarball to override apparmor-easyprof-ubuntu_android,
because the way of override will cause another issue lp#1425704.

Bug: https://bugs.launchpad.net/zhongshan/+bug/1575564

=== added file 'debian/dirs'
--- debian/dirs	1970-01-01 00:00:00 +0000
+++ debian/dirs	2016-05-08 17:08:02 +0000
@@ -0,0 +1,3 @@
+system/ubuntu/usr/share/apparmor/hardware/graphics.d
+system/ubuntu/usr/share/apparmor/hardware/audio.d
+system/ubuntu/usr/share/apparmor/hardware/video.d

=== modified file 'usr/share/apparmor/hardware/audio.d/apparmor-easyprof-ubuntu_android'
--- usr/share/apparmor/hardware/audio.d/apparmor-easyprof-ubuntu_android	2015-09-02 07:50:44 +0000
+++ usr/share/apparmor/hardware/audio.d/apparmor-easyprof-ubuntu_android	2016-05-08 17:08:02 +0000
@@ -1,1 +1,2 @@
-# Placeholder to be bind mounted over from the Android device tarball
+# this file only be used to include the rule which shipped by device tarball.
+#include "/system/usr/share/apparmor/hardware/audio.d"

=== modified file 'usr/share/apparmor/hardware/graphics.d/apparmor-easyprof-ubuntu_android'
--- usr/share/apparmor/hardware/graphics.d/apparmor-easyprof-ubuntu_android	2015-09-02 07:50:44 +0000
+++ usr/share/apparmor/hardware/graphics.d/apparmor-easyprof-ubuntu_android	2016-05-08 17:08:02 +0000
@@ -1,1 +1,2 @@
-# Placeholder to be bind mounted over from the Android device tarball
+# this file only be used to include the rules which shipped by device tarball
+#include "/system/usr/share/apparmor/hardware/graphics.d"

=== modified file 'usr/share/apparmor/hardware/video.d/apparmor-easyprof-ubuntu_android'
--- usr/share/apparmor/hardware/video.d/apparmor-easyprof-ubuntu_android	2015-09-02 07:50:44 +0000
+++ usr/share/apparmor/hardware/video.d/apparmor-easyprof-ubuntu_android	2016-05-08 17:08:02 +0000
@@ -1,1 +1,2 @@
-# Placeholder to be bind mounted over from the Android device tarball
+# this file only be used to include the rule which shipped by device tarball.
+#include "/system/usr/share/apparmor/hardware/video.d"