Merge ~jj/ubuntu/+source/nss-pam-ldapd:lp2130351-autopkgtest-apparmor into ubuntu/+source/nss-pam-ldapd:ubuntu/devel

[Jonas Jelten]

fix for bug #2130351
ppa: https://launchpad.net/~jj/+archive/ubuntu/lp2119884-openldap-fix-apparmor/

  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [amd64]
    + ✅ nss-pam-ldapd on resolute for amd64 @ 17.11.25 11:54:41 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [arm64]
    + ✅ nss-pam-ldapd on resolute for arm64 @ 17.11.25 11:56:45 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [armhf]
    + ❌ nss-pam-ldapd on resolute for armhf @ 17.11.25 11:57:55 Log️ 🗒️
      • testsuite FAIL 🟥
      • testsuite FLAKY 🟫
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [i386]
    + ❌ nss-pam-ldapd on resolute for i386 @ 17.11.25 11:54:00 Log️ 🗒️
      • testsuite FAIL 🟥
      • testsuite FAIL 🟥
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [ppc64el]
    + ✅ nss-pam-ldapd on resolute for ppc64el @ 17.11.25 11:56:40 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [riscv64]
    + ⛔ nss-pam-ldapd on resolute for riscv64 @ 17.11.25 12:11:46 Log️ 🗒️
      • testbed BAD ⛔
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu1~ppa5 [s390x]
    + ✅ nss-pam-ldapd on resolute for s390x @ 17.11.25 11:55:37 Log️ 🗒️

armhf fails because apparmor can't be accessed, i386 has always failed.

[Andreas Hasenack (ahasenack)]

What happens if you just ignore the apparmor_parser exit status, like we do already in other cases, like d/t/slapd[1] from src:openldap? Does the test pass?

Incidentally, we should probably standardize on this, as other tests even in openldap use different code to skip apparmor failures on armhf (like d/t/smbk5pwd). But that's for another time.

1. https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/tests/slapd#n23

review: Needs Information

[Jonas Jelten (jj)]

I've uploaded ubuntu2~ppa1 with isolation-machine restriction, let's see how this goes (likely the test is just skipped).

I agree we should standartize to this - the bug to resolve this in properly is #2008393 I'd say.

[Andreas Hasenack (ahasenack)]

There is no support for isolation-machine on armhf, the test will just be skipped then.

[Andreas Hasenack (ahasenack)]

As discussed in standup, the suggestion is to take the same approach as the openldap package[1] and just ignore the apparmor error (with a warning) if running on ubuntu-armhf. Then please remove the isolation-machine test restriction.

1. https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/tests/slapd#n23

[Jonas Jelten (jj)]

added a function for allowing apparmor commands to fail if on Ubuntu+armhf

[Andreas Hasenack (ahasenack)]

Please make sure the ppa has the latest update from the branch, and that autopkgtests have run.

[Jonas Jelten (jj)]

now all incl armhf pass :)

  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [amd64]
    + ✅ nss-pam-ldapd on resolute for amd64 @ 08.12.25 14:09:49 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [arm64]
    + ✅ nss-pam-ldapd on resolute for arm64 @ 08.12.25 14:11:34 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [armhf]
    + ✅ nss-pam-ldapd on resolute for armhf @ 08.12.25 14:13:03 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [i386]
    + ❌ nss-pam-ldapd on resolute for i386 @ 08.12.25 14:09:19 Log️ 🗒️
      • testsuite FAIL 🟥
      • testsuite FAIL 🟥
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [ppc64el]
    + ✅ nss-pam-ldapd on resolute for ppc64el @ 08.12.25 14:12:28 Log️ 🗒️
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa2 [riscv64]
    + ⛔ nss-pam-ldapd on resolute for riscv64 @ 04.12.25 00:44:27 Log️ 🗒️
      • testbed BAD ⛔
  - nss-pam-ldapd: resolute/nss-pam-ldapd/0.9.13-2ubuntu2~ppa3 [s390x]
    + ✅ nss-pam-ldapd on resolute for s390x @ 08.12.25 14:13:30 Log️ 🗒️

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[Andreas Hasenack (ahasenack)]

Sponsored:

Uploading nss-pam-ldapd_0.9.13-2ubuntu2.dsc
Uploading nss-pam-ldapd_0.9.13-2ubuntu2.debian.tar.xz
Uploading nss-pam-ldapd_0.9.13-2ubuntu2_source.buildinfo
Uploading nss-pam-ldapd_0.9.13-2ubuntu2_source.changes

diff --git a/debian/changelog b/debian/changelog
index 3084fe8..2fa2b4f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+nss-pam-ldapd (0.9.13-2ubuntu2) resolute; urgency=medium
+
+  * d/t/testsuite: fix slapd apparmor access to test directory (LP: #2130351)
+    - d/t/apparmor.sh: ignore apparmor control failures on Ubuntu+armhf
+      (LP: #2008393)
+
+ -- Jonas Jelten <[e-mail]>  Wed, 12 Nov 2025 16:42:10 +0100
+
 nss-pam-ldapd (0.9.13-2ubuntu1) resolute; urgency=medium
 
   * d/control: Recommends: networkd-dispatcher (LP: #2132159)
diff --git a/debian/tests/testsuite b/debian/tests/testsuite
index 0e070a0..1370943 100755
--- a/debian/tests/testsuite
+++ b/debian/tests/testsuite
@@ -38,11 +38,40 @@ service unscd stop || true
 # temporary file to keep nslcd debug output
 nslcd_debug_log=`mktemp -t nslcd.debug.log.XXXXXX`
 
+if [ "$(aa-enabled 2> /dev/null)" = "Yes" ]; then
+  apparmor_enabled="true"
+else
+  apparmor_enabled="false"
+fi
+
+_apparmor_check() {
+	# allow command to fail if running on Ubuntu-armhf (due to LP: #2008393)
+	"$@" && return 0
+	_ret=$?
+
+	if [ "$(dpkg-vendor --query Vendor)-$(dpkg --print-architecture)" = "Ubuntu-armhf" ]; then
+		echo "WARNING: failed to perform apparmor command: $*" >&2
+		echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error." >&2
+		echo "See LP: #2008393 for details." >&2
+		return 0
+	fi
+
+	echo "apparmor command failed: $*" >&2
+	exit $_ret
+}
+
+
 # Clean up on exit
 cleanup() {
   echo "$script: cleaning up..."
   service nslcd stop || true
   service pynslcd stop || true
+  if [ "$apparmor_enabled" = true ]; then
+    echo "$script: restoring apparmor config for slapd..."
+    rm /etc/apparmor.d/local/usr.sbin.slapd
+    [ -f $tmpslapd/apparmor.bak ] && mv $tmpslapd/apparmor.bak /etc/apparmor.d/local/usr.sbin.slapd
+    _apparmor_check apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd
+  fi
   [ -n "$tmpslapd" ] && tests/setup_slapd.sh "$tmpslapd" clean
   echo "$script: restoring configuration..."
   if [ -n "$bkdir" ]
@@ -71,10 +100,19 @@ tests/testenv.sh nss_enable \
 
 # configure PAM?
 
-# configure and start slapd
+# set up test environment
 echo "$script: setting up test slapd..."
 tmpslapd=`mktemp -d -t slapd.XXXXXX`
 tests/setup_slapd.sh "$tmpslapd" setup
+# if apparmor is used, allow access to test directory
+if [ "$apparmor_enabled" = true ]; then
+  # this directory is like /etc/slapd
+  echo "$script: backing up and replacing apparmor config for slapd..."
+  [ -f /etc/apparmor.d/local/usr.sbin.slapd ] && mv /etc/apparmor.d/local/usr.sbin.slapd $tmpslapd/apparmor.bak
+  echo "$tmpslapd/** kwr," >> /etc/apparmor.d/local/usr.sbin.slapd
+  _apparmor_check apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd
+fi
+# configure and start slapd
 tests/setup_slapd.sh "$tmpslapd" start
 
 # set up nslcd.conf