Merge ~holmanb/ubuntu/+source/isc-dhcp:ubuntu/devel into ubuntu/+source/isc-dhcp:ubuntu/devel

[Brett Holman]

Allow disabling hook scripts.

Motivation:

When executing dhclient, cloud-init does not want OS-induced variation in behavior caused by the contents of /sbin/dhclient-script, and therefore overrides this script with a noop, /bin/true.

Formerly cloud-init used "dhclient sandboxing" to work around apparmor rules in dhclient. With recent changes[1], cloud-init has removed sandboxing and changed file locations to work with dedicated PID and lease file apparmor locations. Unfortunately under this scheme, when the script call fails (due to apparmor blocking execution of /bin/true), dhclient falls back to using the default script, /sbin/dhclient-script, which is undesirable.

[1] https://github.com/canonical/cloud-init/commit/de7851b93c5a2d4658d8a0a336e9d014adb15189

The change:

Dhclient doesn't provide a mechanism for disabling hook scripts, which may provide undesirable system side effects. It does, however, allow the caller to define custom scripts. Therefore, one way to effectively disable hook scripts is to provide a no-op script, such as /bin/true. This MP allows dhclient to execute /bin/true such that default hook scripts may effectively be disabled.

Before this change, note the "Permission denied" in the output:

$ sudo dhclient -1 -v -lf /run/dhclient.lease -pf /run/dhclient.pid enp24s0 -sf /bin/true
Internet Systems Consortium DHCP Client 4.4.3-P1
Copyright 2004-2022 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

execve (/bin/true, ...): Permission denied
Listening on LPF/enp24s0/30:9c:23:e6:be:f0
Sending on LPF/enp24s0/30:9c:23:e6:be:f0
Sending on Socket/fallback
DHCPREQUEST for 192.168.1.145 on enp24s0 to 255.255.255.255 port 67
DHCPACK of 192.168.1.145 from 192.168.1.1
execve (/bin/true, ...): Permission denied
bound to 192.168.1.145 -- renewal in 39752 seconds.

After this change, note the "Permission denied" is gone.

$ sudo dhclient -1 -v -lf /run/dhclient.lease -pf /run/dhclient.pid enp24s0 -sf /bin/true
Internet Systems Consortium DHCP Client 4.4.3-P1
Copyright 2004-2022 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/enp24s0/30:9c:23:e6:be:f0
Sending on LPF/enp24s0/30:9c:23:e6:be:f0
Sending on Socket/fallback
xid: warning: no netdev with useable HWADDR found for seed's uniqueness enforcement
xid: rand init seed (0x646bc97f) built using gethostid
DHCPREQUEST for 192.168.1.145 on enp24s0 to 255.255.255.255 port 67 (xid=0x46eceb7d)
DHCPACK of 192.168.1.145 from 192.168.1.1 (xid=0x7debec46)
bound to 192.168.1.145 -- renewal in 39745 seconds.

[Robie Basak (racb)]

This looks fine and we can upload this now if required. One comment inline to adjust the profile relaxation to be just a bit tighter, assuming it works (please test).

However we should send this to Debian, and if they end up implementing the change differently, we'd end up have to test two different ways of doing it. So, if we have time, could you please send this to Debian for review first? This depends on what you need this for, which I don't know :-)

If however you need it quickly, then +1 to upload this to Ubuntu with just my inline comment addressed. Please let me know if so, and I'll sponsor.

review: Needs Fixing

[Brett Holman (holmanb)]

> This looks fine and we can upload this now if required. One comment inline to
> adjust the profile relaxation to be just a bit tighter, assuming it works
> (please test).

Nice suggestion. I tested and it works. I just updated this MR.

> However we should send this to Debian, and if they end up implementing the
> change differently, we'd end up have to test two different ways of doing it.
> So, if we have time, could you please send this to Debian for review first?

I submitted it in March 2023, but still no activity on the bug report (which included this fix).

> If however you need it quickly, then +1 to upload this to Ubuntu with just my
> inline comment addressed. Please let me know if so, and I'll sponsor.

Since Debian hasn't taken action on this yet would mind sponsoring?

[Robie Basak (racb)]

Sponsored ba63f11e. Thanks!

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: racb, holmanb
Uploaders: racb
MP auto-approved

review: Approve

diff --git a/debian/apparmor/sbin.dhclient b/debian/apparmor/sbin.dhclient
index 1acc6b9..b6890d8 100644
--- a/debian/apparmor/sbin.dhclient
+++ b/debian/apparmor/sbin.dhclient
@@ -62,6 +62,10 @@
   # only being able to run the hooks scripts.
   /{,usr/}sbin/dhclient-script                           Uxr,
 
+  # Since dhclient doesn't provide the option to disable hooks, which is
+  # desireable in some cases, executing /bin/true as the script file suffices
+  /{,usr/}bin/true                                       ixr,
+
   # Run the ELF executables under their own unrestricted profiles
   /usr/lib/NetworkManager/nm-dhcp-client.action   Pxrm,
   /usr/lib/connman/scripts/dhclient-script        Pxrm,
diff --git a/debian/changelog b/debian/changelog
index 364ed49..8029c9a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+isc-dhcp (4.4.3-P1-1ubuntu2) mantic; urgency=medium
+
+  * debian/apparmor/sbin.dhclient: Allow disabling dhclient hooks. LP: #2011628
+
+ -- Brett Holman <[e-mail]>  Fri, 17 Mar 2023 15:38:35 -0600
+
 isc-dhcp (4.4.3-P1-1ubuntu1) lunar; urgency=medium
 
   * Merge from Debian unstable, remaining changes: