Merge ~lvoytek/ubuntu/+source/swtpm:aa-sysadmin-lockfile-jammy into ubuntu/+source/swtpm:ubuntu/jammy-devel

[Lena Voytek]

Add some additional apparmor permissions to fix lockfile and tpm_vtpm_proxy module access

The change for jammy is the same as oracular and noble, the original mp is here: https://code.launchpad.net/~lvoytek/ubuntu/+source/swtpm/+git/swtpm/+merge/468957

noble mp is here: https://code.launchpad.net/~lvoytek/ubuntu/+source/swtpm/+git/swtpm/+merge/470383

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-add-sys-admin

Testing:

sys_admin test steps

$ sudo apt update && sudo apt dist-upgrade -y
$ sudo apt install swtpm apparmor -y

$ mkdir /tmp/myvtpm

# Before fix
$ sudo modprobe tpm_vtpm_proxy
$ sudo swtpm chardev --vtpm-proxy --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322
swtpm: Ioctl to create vtpm proxy failed: Operation not permitted

$ sudo add-apt-repository ppa:lvoytek/swtpm-add-sys-admin
$ sudo apt update && sudo apt upgrade -y

# After fix
$ sudo modprobe tpm_vtpm_proxy
$ sudo swtpm chardev --vtpm-proxy --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322
New TPM device: /dev/tpm1 (major/minor = 253/1)

lockfile test steps

$ sudo apt update && sudo apt dist-upgrade -y
$ sudo apt install swtpm virt-manager apparmor -y

# Create a vm with virt-manager that uses a TPM2 device and start it
# A directory will show up in /var/lib/libvirt/swtpm/ using the vm's ID, such as:
# /var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5

$ sudo swtpm socket --print-states --tpmstate dir=/var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5/tpm2,mode=0600
swtpm: SWTPM_NVRAM_Lock_Dir: Could not open lockfile: Permission denied

# Stop vm and update
$ sudo add-apt-repository ppa:lvoytek/swtpm-add-sys-admin
$ sudo apt update && sudo apt upgrade -y
$ sudo killall swtpm

# Start vm again

$ sudo swtpm socket --print-states --tpmstate dir=/var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5/tpm2,mode=0600
{ "type": "swtpm", "states": [] }

[Bryce Harrington (bryce)]

Same review as on mp:lvoytek/swtpm/470383

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: lvoytek, bryce
Uploaders: lvoytek, bryce
MP auto-approved

review: Approve

[Lena Voytek (lvoytek)]

Uploaded:

dput ubuntu ../swtpm_0.6.3-0ubuntu3.3_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: ../swtpm_0.6.3-0ubuntu3.3_source.changes: Valid signature from 34B8AD7D9529E793
Checking signature on .dsc
gpg: ../swtpm_0.6.3-0ubuntu3.3.dsc: Valid signature from 34B8AD7D9529E793
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading swtpm_0.6.3-0ubuntu3.3.dsc: done.
  Uploading swtpm_0.6.3-0ubuntu3.3.debian.tar.xz: done.
  Uploading swtpm_0.6.3-0ubuntu3.3_source.buildinfo: done.
  Uploading swtpm_0.6.3-0ubuntu3.3_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 91f618e..9196b1a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+swtpm (0.6.3-0ubuntu3.3) jammy; urgency=medium
+
+  * d/usr.bin.swtpm:
+    - Add sys_admin capability to apparmor profile to allow access to kernel
+      modules such as tpm_vtpm_proxy (LP: #2071478)
+    - Allow non-owned lockfile write access in /var/lib/libvirt/swtpm/ to fix
+      apparmor denials when working with TPM2 locks (LP: #2072524)
+
+ -- Lena Voytek <[e-mail]>  Tue, 30 Jul 2024 15:22:09 -0700
+
 swtpm (0.6.3-0ubuntu3.2) jammy; urgency=medium
 
   * d/p/create-user-config-files-use-correct-swtpm-localca.patch: Fix the path
diff --git a/debian/usr.bin.swtpm b/debian/usr.bin.swtpm
index 56702ad..bc76928 100644
--- a/debian/usr.bin.swtpm
+++ b/debian/usr.bin.swtpm
@@ -19,6 +19,7 @@ profile swtpm /usr/bin/swtpm {
   capability fsetid,
   capability setgid,
   capability setuid,
+  capability sys_admin,
 
   network inet stream,
   network inet6 stream,
@@ -30,6 +31,7 @@ profile swtpm /usr/bin/swtpm {
   /tmp/** rwk,
   owner @{HOME}/** rwk,
   owner /var/lib/libvirt/swtpm/** rwk,
+  /var/lib/libvirt/swtpm/** wk,
   /run/libvirt/qemu/swtpm/*.sock rwk,
   owner /var/log/swtpm/libvirt/qemu/*.log rwk,
   owner /run/libvirt/qemu/swtpm/*.pid rwk,