Merge lp:~mvo/ubuntu/vivid/ubuntu-core-config/lp1460152-workaround into lp:ubuntu/wily/ubuntu-core-config

[Michael Vogt]

[Sergio Schvezov (sergiusens)]

ok, I'll manually stage this by:
- installing 15.04 stable
- changing channels.ini to edge
- snappy update'ing
- remount 'other' and insert this
- reboot
- profit

The code looks good, very clever of putting it here instead of the snappy code base itself :-)

I guess
+After=etc-writable.mount
just means after we can write to partitions (the systemd unit names still confuse me a bit).

[Michael Vogt (mvo)]

Yeah, there is one more gotach here, there needs to be a "Before=ubuntu-snappy.frameworks-pre.target" to ensure the apparmor re-generation is all done before systemd starts our frameworks/app services.

[lp:~mvo/ubuntu/vivid/ubuntu-core-config/lp1460152-workaround]

30. By Michael Vogt on 2015-06-05

lib/systemd/system/snappy-workaround-apparmor.service: add ubuntu-snappy.frameworks-pre.target

[Michael Vogt (mvo)]

I added the Before= in r30 but did not test it (sorry! time is short here).

@sergio The testplan looks great, you may need to change both channels.ini to edge, thats the only thing I can thing of. Many many thanks for testing this and lets hope we can land a fix inside apparmor sooon(ish) as I feel that will be much cleaner :)

[Michael Vogt (mvo)]

@After> yeah, it means that the writable mounts should all be in place. And yes, its confusing! I'm not even sure this is needed but I added it to be on the safe side.

[Sergio Schvezov (sergiusens)]

manual steps worked.

review: Approve

[Jamie Strandboge (jdstrand)]

From the bug:
"FYI, the hash approach is slow for the normal case since we always have to perform an sum. Furthermore it doesn't take into account #include'd files that might also change (eg, apparmor is updated and has a different base abstraction). For the workaround, I guess it is ok since the slowdown will only be for a couple of profiles but I would have rather seen us unconditionally invalidating the cache when switching from a to b or vice versa."

=== modified file 'debian/changelog'
--- debian/changelog	2015-05-27 07:42:14 +0000
+++ debian/changelog	2015-06-05 11:51:12 +0000
@@ -1,3 +1,22 @@
+ubuntu-core-config (0.6.18) UNRELEASED; urgency=low
+
+  * revert 'use "transition" for /etc/apparmor.d/cache' change
+    as we can not pre-create the apparmor cache on livecd-rootfs build
+  * usr/bin/snappy-apparmor-lp1460152,
+    lib/systemd/system/snappy-workaround-apparmor.service:
+    - add workaround for apparmor cache out of sync issue (LP: #1460152)
+
+ -- Michael Vogt <[e-mail]>  Thu, 04 Jun 2015 22:56:29 +0200
+
+ubuntu-core-config (0.6.17) wily; urgency=low
+
+  * use "transition" for /etc/apparmor.d/cache
+    (LP: #1460152)
+  * etc/system-image/config.d/20_snappy.ini:
+    - fix config file name
+
+ -- Michael Vogt <[e-mail]>  Wed, 03 Jun 2015 09:43:09 +0200
+
 ubuntu-core-config (0.6.16) wily; urgency=medium
 
   * Add /frameworks to writable-paths

=== modified file 'debian/install'
--- debian/install	2015-02-27 16:40:14 +0000
+++ debian/install	2015-06-05 11:51:12 +0000
@@ -1,3 +1,4 @@
 etc
 lib
+usr
 snappy-extrausers /usr/share/pam-configs/

=== modified file 'debian/links'
--- debian/links	2015-02-27 16:40:14 +0000
+++ debian/links	2015-06-05 11:51:12 +0000
@@ -1,1 +1,2 @@
 /lib/systemd/system/snappy-set-hostname.service /lib/systemd/system/sysinit.target.requires/snappy-set-hostname.service
+/lib/systemd/system/snappy-workaround-apparmor.service /lib/systemd/system/multi-user.target.requires/snappy-workaround-apparmor.service
\ No newline at end of file

=== renamed file 'etc/system-image/config.d/20_snappy.conf' => 'etc/system-image/config.d/20_snappy.ini'
=== added file 'lib/systemd/system/snappy-workaround-apparmor.service'
--- lib/systemd/system/snappy-workaround-apparmor.service	1970-01-01 00:00:00 +0000
+++ lib/systemd/system/snappy-workaround-apparmor.service	2015-06-05 11:51:12 +0000
@@ -0,0 +1,11 @@
+# workaround LP: #1460152
+# 
+[Unit]
+Description=Workaround apparmor cacheing
+WantedBy=multi-user.target
+After=etc-writable.mount
+Before=ubuntu-snappy.frameworks-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/snappy-apparmor-lp1460152

=== added directory 'usr'
=== added directory 'usr/bin'
=== added file 'usr/bin/snappy-apparmor-lp1460152'
--- usr/bin/snappy-apparmor-lp1460152	1970-01-01 00:00:00 +0000
+++ usr/bin/snappy-apparmor-lp1460152	2015-06-05 11:51:12 +0000
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# workaroudn for LP: #1460152
+#
+
+set -e
+
+. /lib/apparmor/functions
+
+# check each profile if the cache is out of sync (we can not use
+# the mtime here because the apparmor seems to be doing the
+# strictly great check on the mtime)
+for p in $(find "$PROFILES" -maxdepth 1 -type f); do
+    profile_md5=$(md5sum "$p")
+    cached_p="$(echo $p | sed "s#$PROFILES#$PROFILES_CACHE#")"
+    if [ ! -f "$cached_p" ]; then
+        continue
+    fi
+    profile_md5_marker="$cached_p.profile-md5sum"
+    cached_md5="$(cat "$profile_md5_marker" || true)"
+    if [ "$profile_md5" != "$cached_md5" ]; then
+        # remove, re-generate, update-md5 of cache
+        rm -f "$cached_p"
+        "$PARSER" --write-cache --replace "$p"
+        echo "$profile_md5" > "$profile_md5_marker"
+    fi
+done