Merge ~lvoytek/ubuntu/+source/swtpm:aa-allow-libvirt-pid-access into ubuntu/+source/swtpm:ubuntu/devel

[Lena Voytek]

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-fix-apparmor-libvirt

Testing

# sudo apt update && sudo apt dist-upgrade -y
# sudo apt install virt-manager swtpm

Add PPA here to fix -> sudo add-apt-repository ppa:lvoytek/swtpm-fix-apparmor-libvirt && sudo apt update && sudo apt upgrade

Create a vm in virt-manager and on the last page

> Select "Customize configuration before install"
> Click Finish

> Click Add Hardware
> Select TPM with Model "TIS" and version 2.0

> Click "Begin Installation"

[Andreas Hasenack (ahasenack)]

We don't need a windows vm to reproduce the problem, any linux vm with tpm 2.0 added will work. Without the apparmor change, the same DENIED will appear in the logs and virt-manager will fail to start the VM, so I think the test case can be simplified to something like "launch ubuntu vm, add tpm 2.0 device".

While checking this, I noticed that it looks like swtpm (or libvirt) is leaking pid files in /run/libvirt/qemu/swtpm:
# ls -la /run/libvirt/qemu/swtpm/
total 24
drwxrwx--- 2 libvirt-qemu swtpm 160 Oct 24 19:20 .
drwxr-xr-x 5 root root 180 Oct 24 19:28 ..
-rw-r--r-- 1 root root 7 Oct 24 18:45 2-win11_22H2-swtpm.pid
-rw-r--r-- 1 root root 7 Oct 24 18:56 3-win11_22H2-swtpm.pid
-rw-r--r-- 1 root root 7 Oct 24 18:59 4-win11_22H2-swtpm.pid
-rw-r--r-- 1 root root 7 Oct 24 19:01 5-win11_22H2-swtpm.pid
-rw-r--r-- 1 root root 7 Oct 24 19:18 6-win11_22H2-swtpm.pid
-rw-r--r-- 1 root root 7 Oct 24 19:20 7-win11_22H2-swtpm.pid

Everytime I stop and start a VM with a tpm 2.0 device, I new pid file gets created, and when that vm is stopped, the pid file is not removed. I'm ready to file a separate bug for this, but maybe we could take a quick look to see why this is happening. I wanted to try some strace/opensnoop to see if someone is even trying to remove those pid files (and perhaps failing due to "reasons").

Note that the directory permissions libvirt-qemu:swtpm 775 would allow the swtpm user to remove the pid file, even though it's owned by root.

[Lena Voytek (lvoytek)]

I figured out the duplicating pid file issue, mp here: https://code.launchpad.net/~lvoytek/ubuntu/+source/libvirt/+git/libvirt/+merge/433390

Still having trouble figuring out why the pid files belong to root though. It may be best to go ahead with this apparmor change since its affecting a decent amount of people

[Andreas Hasenack (ahasenack)]

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, lvoytek
Uploaders: ahasenack
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

I'll change the ubuntu release to lunar before upload

[Andreas Hasenack (ahasenack)]

Uploaded to lunar:
Uploading swtpm_0.6.3-0ubuntu5.dsc
Uploading swtpm_0.6.3-0ubuntu5.debian.tar.xz
Uploading swtpm_0.6.3-0ubuntu5_source.buildinfo
Uploading swtpm_0.6.3-0ubuntu5_source.changes

diff --git a/debian/changelog b/debian/changelog
index 8091a44..67b3d4f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+swtpm (0.6.3-0ubuntu5) kinetic; urgency=medium
+
+  * d/usr.bin.swtpm: Allow swtpm to also access /run/libvirt/qemu/swtpm/*.pid
+    files that it does not own (LP: #1989100)
+
+ -- Lena Voytek <[e-mail]>  Mon, 24 Oct 2022 10:52:06 -0700
+
 swtpm (0.6.3-0ubuntu4) kinetic; urgency=medium
 
   * d/usr.bin.swtpm: Update apparmor profile to match swtpm upstream
diff --git a/debian/usr.bin.swtpm b/debian/usr.bin.swtpm
index 56702ad..bb29217 100644
--- a/debian/usr.bin.swtpm
+++ b/debian/usr.bin.swtpm
@@ -32,7 +32,7 @@ profile swtpm /usr/bin/swtpm {
   owner /var/lib/libvirt/swtpm/** rwk,
   /run/libvirt/qemu/swtpm/*.sock rwk,
   owner /var/log/swtpm/libvirt/qemu/*.log rwk,
-  owner /run/libvirt/qemu/swtpm/*.pid rwk,
+  /run/libvirt/qemu/swtpm/*.pid rwk,
   owner /dev/vtpmx rw,
   owner /etc/nsswitch.conf r,
   owner /var/lib/swtpm/** rwk,