Merge ~lvoytek/ubuntu/+source/swtpm:update-apparmor-to-upstream-kinetic into ubuntu/+source/swtpm:ubuntu/devel

[Lena Voytek]

Updating swtpm apparmor profile to match upstream's configuration to fix some broken common usecases.

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-apparmor-match-upstream

Original conversation about additional rules to add was in the upstream merge request here:
https://github.com/stefanberger/swtpm/pull/691

[Christian Ehrhardt  (paelzer)]

Bug LGTM, changes LGTM, Overall +1

And with the next version we will be able to just use the one from upstream then.

We are kind of last minute, so I'll sponsor it right away before final freeze (tomorrow)

review: Approve

[Christian Ehrhardt  (paelzer)]

changelog explains well what is needed for what - that will be helpful if you plan to SRU it as well

[Christian Ehrhardt  (paelzer)]

Double checked - $ git diff upstream/master -- debian/usr.bin.swtpm
 just shows the Author difference which is fine.

[Christian Ehrhardt  (paelzer)]

Uploading swtpm_0.6.3-0ubuntu4.dsc
Uploading swtpm_0.6.3-0ubuntu4.debian.tar.xz
Uploading swtpm_0.6.3-0ubuntu4_source.buildinfo
Uploading swtpm_0.6.3-0ubuntu4_source.changes

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: paelzer, lvoytek
Uploaders: paelzer
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 6ccf485..8091a44 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+swtpm (0.6.3-0ubuntu4) kinetic; urgency=medium
+
+  * d/usr.bin.swtpm: Update apparmor profile to match swtpm upstream
+    In between adding the apparmor profile to Ubuntu and merging upstream
+    additional rules were used to cover more common use cases. (LP: #1992377)
+    - The six capability lines fix the broken upstream unit test cases:
+      test_ctrlchannel, test_vtpm_proxy, test_tpm2_file_permissions,
+      test_tpm2_save_load_state_2_block, and test_tpm2_ctrlchannel2
+    - owner @{HOME}/** rwk was added as using a folder in one's home directory
+      is common for managing tpm states
+    - Access in the tmp directory is further generalized as this is where swtpm
+      interacts with qemu and libvirt
+    - The ability to read from /etc/nsswitch.conf was added for vtpm proxy to
+      work
+
+ -- Lena Voytek <[e-mail]>  Tue, 11 Oct 2022 10:54:21 -0700
+
 swtpm (0.6.3-0ubuntu3) jammy; urgency=medium
 
   * d/usr.bin.swtpm: Add additional apparmor rules
diff --git a/debian/usr.bin.swtpm b/debian/usr.bin.swtpm
index 386137b..56702ad 100644
--- a/debian/usr.bin.swtpm
+++ b/debian/usr.bin.swtpm
@@ -1,7 +1,7 @@
 # vim:syntax=apparmor
 # AppArmor policy for swtpm
 # Author: Lena Voytek <[e-mail]>
-# Last Modified: Fri Feb 18 10:23:53 2022
+# Last Modified: Tue Oct 11 10:53:05 2022
 
 #include <tunables/global>
 
@@ -12,7 +12,13 @@ profile swtpm /usr/bin/swtpm {
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.bin.swtpm>
 
+  capability chown,
   capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
+  capability setgid,
+  capability setuid,
 
   network inet stream,
   network inet6 stream,
@@ -21,12 +27,14 @@ profile swtpm /usr/bin/swtpm {
 
   /usr/bin/swtpm rm,
 
-  owner /tmp/** rwk,
+  /tmp/** rwk,
+  owner @{HOME}/** rwk,
   owner /var/lib/libvirt/swtpm/** rwk,
   /run/libvirt/qemu/swtpm/*.sock rwk,
   owner /var/log/swtpm/libvirt/qemu/*.log rwk,
   owner /run/libvirt/qemu/swtpm/*.pid rwk,
   owner /dev/vtpmx rw,
+  owner /etc/nsswitch.conf r,
   owner /var/lib/swtpm/** rwk,
   owner /run/swtpm/sock rw,
 }