Merge ~lvoytek/ubuntu/+source/swtpm:update-apparmor-to-upstream-jammy into ubuntu/+source/swtpm:ubuntu/jammy-devel

[Lena Voytek]

Updating swtpm apparmor profile to match upstream's configuration to fix some broken common usecases.

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-apparmor-match-upstream

Original conversation about additional rules to add was in the upstream merge request here:
https://github.com/stefanberger/swtpm/pull/691

Kinetic Merge: https://code.launchpad.net/~lvoytek/ubuntu/+source/swtpm/+git/swtpm/+merge/431370

[Lena Voytek (lvoytek)]

@vorlon feel free to review this change if you would like / have the time

[Steve Langasek (vorlon)]

> @vorlon feel free to review this change if you would like / have the time

Pass

review: Abstain

[Christian Ehrhardt  (paelzer)]

+1
- This matches the upstream discussion
- this is only getting less strict (which means much less chance to regress in place)
- all changes have a defined reasonable use case backing up why it is added

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: paelzer, lvoytek
Uploaders: paelzer
MP auto-approved

review: Approve

[Lena Voytek (lvoytek)]

Looks like the Jammy upload got rejected a while back. @Christian would you be willing to re-upload this change?

I got a notification from Stefan about this today here:
https://github.com/stefanberger/swtpm/issues/797#issuecomment-1512099570

Testing against the PPA, this change still fixes the issue brought up, although I need to dig into @DATAROOTDIR@ afterward too:

$ multipass launch 22.04 --name test-swtpm
$ multipass shell test-swtpm

$ sudo apt update && sudo apt dist-upgrade -y
$ sudo apt install swtpm swtpm-tools software-properties-common -y

$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Mon 17 Apr 2023 10:28:01 PM UTC
swtpm process terminated unexpectedly.
Could not start the TPM 2.
An error occurred. Authoring the TPM state failed.
Ending vTPM manufacturing @ Mon 17 Apr 2023 10:28:01 PM UTC

$ sudo add-apt-repository ppa:lvoytek/swtpm-apparmor-match-upstream
$ sudo apt update && sudo apt upgrade -y

$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Mon 17 Apr 2023 10:29:49 PM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
Could not find @DATAROOTDIR@/swtpm/swtpm-localca in PATH.
An error occurred. Authoring the TPM state failed.
Ending vTPM manufacturing @ Mon 17 Apr 2023 10:29:49 PM UTC

[Christian Ehrhardt  (paelzer)]

Re-checked and indeed not there.
Re-uploaded (I must admit I'm not entirely sure I did before, but surely now).

Uploading swtpm_0.6.3-0ubuntu3.1.dsc
Uploading swtpm_0.6.3-0ubuntu3.1.debian.tar.xz
Uploading swtpm_0.6.3-0ubuntu3.1_source.buildinfo
Uploading swtpm_0.6.3-0ubuntu3.1_source.changes

diff --git a/debian/changelog b/debian/changelog
index 6ccf485..fd88eee 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+swtpm (0.6.3-0ubuntu3.1) jammy; urgency=medium
+
+  * d/usr.bin.swtpm: Update apparmor profile to match swtpm upstream
+    In between adding the apparmor profile to Ubuntu and merging upstream
+    additional rules were used to cover more common use cases. (LP: #1992377)
+    - The six capability lines fix the broken upstream unit test cases:
+      test_ctrlchannel, test_vtpm_proxy, test_tpm2_file_permissions,
+      test_tpm2_save_load_state_2_block, and test_tpm2_ctrlchannel2
+    - owner @{HOME}/** rwk was added as using a folder in one's home directory
+      is common for managing tpm states
+    - Access in the tmp directory is further generalized as this is where swtpm
+      interacts with qemu and libvirt
+    - The ability to read from /etc/nsswitch.conf was added for vtpm proxy to
+      work
+
+ -- Lena Voytek <[e-mail]>  Wed, 16 Nov 2022 13:54:54 -0700
+
 swtpm (0.6.3-0ubuntu3) jammy; urgency=medium
 
   * d/usr.bin.swtpm: Add additional apparmor rules
diff --git a/debian/usr.bin.swtpm b/debian/usr.bin.swtpm
index 386137b..56702ad 100644
--- a/debian/usr.bin.swtpm
+++ b/debian/usr.bin.swtpm
@@ -1,7 +1,7 @@
 # vim:syntax=apparmor
 # AppArmor policy for swtpm
 # Author: Lena Voytek <[e-mail]>
-# Last Modified: Fri Feb 18 10:23:53 2022
+# Last Modified: Tue Oct 11 10:53:05 2022
 
 #include <tunables/global>
 
@@ -12,7 +12,13 @@ profile swtpm /usr/bin/swtpm {
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.bin.swtpm>
 
+  capability chown,
   capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability fsetid,
+  capability setgid,
+  capability setuid,
 
   network inet stream,
   network inet6 stream,
@@ -21,12 +27,14 @@ profile swtpm /usr/bin/swtpm {
 
   /usr/bin/swtpm rm,
 
-  owner /tmp/** rwk,
+  /tmp/** rwk,
+  owner @{HOME}/** rwk,
   owner /var/lib/libvirt/swtpm/** rwk,
   /run/libvirt/qemu/swtpm/*.sock rwk,
   owner /var/log/swtpm/libvirt/qemu/*.log rwk,
   owner /run/libvirt/qemu/swtpm/*.pid rwk,
   owner /dev/vtpmx rw,
+  owner /etc/nsswitch.conf r,
   owner /var/lib/swtpm/** rwk,
   owner /run/swtpm/sock rw,
 }