Merge ~paelzer/ubuntu/+source/libvirt:lp-1927519-profile-recreate-bionic into ubuntu/+source/libvirt:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4717

99b5598... by Christian Ehrhardt  on 2021-11-18

changelog: avoid issues with backported dwarves 1.21 (LP: #1951438)

Signed-off-by: Christian Ehrhardt <email address hidden>

6303b66... by Christian Ehrhardt  on 2021-11-18

d/p/u/skip-new-pdwtags.patch: avoid issues with backported dwarves 1.21 (LP: #1951438)

Signed-off-by: Christian Ehrhardt <email address hidden>

[Sergio Durigan Junior (sergiodj)]

Thanks, Christian.

I'm OK with the change (it's exactly the same as the one proposed in the other MPs), but I'm seeing two build failures on the PPA: amd64 and i386. I don't think they're related, and I took the liberty to retrigger them, but I will wait until we know for sure before I approve this. Also, as with the other MPs, autopkgtest hasn't run for this one yet.

review: Needs Information

[Sergio Durigan Junior (sergiodj)]

Both builds failed again, so I will wait for your assessment here before proceeding :-).

[Christian Ehrhardt  (paelzer)]

Yeah I've seen these as well and worked on them.
It was a present by a backport and a perfect example of a backport meant well but regressing in release.
For some nice details see https://bugs.launchpad.net/ubuntu/+source/dwarves-dfsg/+bug/1951438

I have added a patch that turns this behavior back for libvirt "as it was before" which I have uploaded to the PPA and now pushed to this branch.

[Christian Ehrhardt  (paelzer)]

FYI - libvirt - 4.0.0-1ubuntu8.20~bionicppa4 built fine now

[Sergio Durigan Junior (sergiodj)]

Thanks, Christian. Two small nits in the new patch, but otherwise LGTM. +1

review: Approve

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading libvirt_4.0.0-1ubuntu8.20.dsc: done.
  Uploading libvirt_4.0.0-1ubuntu8.20.debian.tar.xz: done.
  Uploading libvirt_4.0.0-1ubuntu8.20_source.buildinfo: done.
  Uploading libvirt_4.0.0-1ubuntu8.20_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index d84d6e5..9ba6453 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+libvirt (4.0.0-1ubuntu8.20) bionic; urgency=medium
+
+  * d/p/u/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch:
+    avoid issues due to corrupted apparmor profiles (LP: #1927519)
+  * d/p/u/skip-new-pdwtags.patch: avoid issues with backported
+    dwarves 1.21 (LP: #1951438)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 18 Nov 2021 10:24:01 +0100
+
 libvirt (4.0.0-1ubuntu8.19) bionic; urgency=medium
 
   * d/p/lp1915811-fix-numa-topology.patch: Fix NUMA topology population for
diff --git a/debian/patches/series b/debian/patches/series
index 1c61459..c369509 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -140,3 +140,5 @@ ubuntu/lp-1844455-node_device_conf-Don-t-leak-physical_function.patch
 ubuntu-aa/lp-1847361-load-versioned-module.patch
 ubuntu/CVE-2020-10703.patch
 ubuntu/lp1915811-fix-numa-topology.patch
+ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
+ubuntu/skip-new-pdwtags.patch
diff --git a/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch b/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
new file mode 100644
index 0000000..1960a78
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1927519-virt-aa-helper-Purge-profile-if-corrupted.patch
@@ -0,0 +1,71 @@
+From 4ab33415db31d0e77015bb852cab4a08dd0efd40 Mon Sep 17 00:00:00 2001
+From: Ioanna Alifieraki <[e-mail]>
+Date: Tue, 2 Nov 2021 16:04:45 +0200
+Subject: [PATCH] virt-aa-helper: Purge profile if corrupted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit aims to address the bug reported in [1] and [2].
+If the profile is corrupted (0-size) the VM cannot be launched.
+To overcome this, check if the profile exists and if it has 0 size
+remove it.
+
+[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890084
+[2] https://bugs.launchpad.net/bugs/1927519
+
+Signed-off-by: Ioanna Alifieraki <[e-mail]>
+Reviewed-by: Christian Ehrhardt <[e-mail]>
+Reviewed-by: Ján Tomko <[e-mail]>
+
+Origin: backport, https://libvirt.org/git/?p=libvirt.git;a=commit;h=4ab33415db
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1927519
+Last-Update: 2021-11-18
+
+---
+ src/security/virt-aa-helper.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/src/security/virt-aa-helper.c
++++ b/src/security/virt-aa-helper.c
+@@ -1348,6 +1348,8 @@ main(int argc, char **argv)
+     int rc = -1;
+     char *profile = NULL;
+     char *include_file = NULL;
++    off_t size;
++    bool purged = 0;
+ 
+     if (virGettextInitialize() < 0 ||
+         virThreadInitialize() < 0 ||
+@@ -1402,6 +1404,22 @@ main(int argc, char **argv)
+         if (ctl->cmd == 'c' && virFileExists(profile))
+             vah_error(ctl, 1, _("profile exists"));
+ 
++        /*
++         * Rare cases can leave corrupted empty files behind breaking
++         * the guest. An empty file is never correct as virt-aa-helper
++         * would at least add the basic rules, therefore clean this up
++         * for a proper refresh.
++         */
++        if (virFileExists(profile)) {
++                size = virFileLength(profile, -1);
++                if (size == 0) {
++                        vah_warning(_("Profile of 0 size detected, will attempt to remove it"));
++                        if ((rc = parserRemove(ctl->uuid) != 0))
++                                vah_error(ctl, 1, _("could not remove profile"));
++                        unlink(profile);
++                        purged = true;
++                }
++        }
+         if (ctl->append && ctl->newfile) {
+             if (vah_add_file(&buf, ctl->newfile, "rwk") != 0)
+                 goto cleanup;
+@@ -1450,7 +1468,7 @@ main(int argc, char **argv)
+ 
+ 
+         /* create the profile from TEMPLATE */
+-        if (ctl->cmd == 'c') {
++        if (ctl->cmd == 'c' || purged) {
+             char *tmp = NULL;
+             if (virAsprintfQuiet(&tmp, "  #include <libvirt/%s.files>\n",
+                                  ctl->uuid) == -1) {
diff --git a/debian/patches/ubuntu/skip-new-pdwtags.patch b/debian/patches/ubuntu/skip-new-pdwtags.patch
new file mode 100644
index 0000000..4152871
--- /dev/null
+++ b/debian/patches/ubuntu/skip-new-pdwtags.patch
@@ -0,0 +1,66 @@
+Description: Skip pdwtags check to avoid FTBFS
+ This was always skipped in bionic for the original pdwtags being
+ insufficient. But since the backport of 1.21 it works but the compared
+ expected output mismatches all over the place.
+ This might be resolved using other dwaves or reverting it, for now
+ we let it skip the test as it always had avoiding to re-adapt after
+ changes to dwarves are done.
+ .
+ If we know it will stay as-is we might update the expected output to match
+ the now aligned content.
+Forwarded: not-needed
+X-Not-Forwarded-Reason: Ubuntu specific due to the dwarves backport
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1951438
+Last-Update: 2021-11-18
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -587,47 +587,7 @@ struct_prefix = ($(libs_prefix)|$(other_
+ # the newest of the two, in case configure options changed and a stale
+ # file is left around from an earlier build.
+ PDWTAGS = \
+-	$(AM_V_GEN)if (pdwtags --help) > /dev/null 2>&1; then \
+-	  o=`ls -t $(<:.lo=.$(OBJEXT)) \
+-	     $(subst /,/.libs/,$(<:.lo=.$(OBJEXT))) \
+-	    2>/dev/null | sed -n 1p`; \
+-	  test -f "$$o" || { echo ".o for $< not found" >&2; exit 1; }; \
+-	  pdwtags --verbose $$o > $(@F)-t1 2> $(@F)-t2; \
+-	  if test ! -s $(@F)-t1 && test -s $(@F)-t2; then \
+-	    rm -rf $(@F)-t?; \
+-	    echo 'WARNING: pdwtags appears broken; skipping the $@ test' >&2;\
+-	  else \
+-	    $(PERL) -0777 -n \
+-		-e 'foreach my $$p (split m!\n*(?:$(r1)|$(r2))\n!) {' \
+-		-e '  if ($$p =~ /^(struct|enum) $(struct_prefix)/ ||' \
+-		-e '      $$p =~ /^enum \{/) {' \
+-		-e '    $$p =~ s!\t*/\*.*?\*/!!sg;' \
+-		-e '    $$p =~ s!\s+\n!\n!sg;' \
+-		-e '    $$p =~ s!\s+$$!!;' \
+-		-e '    $$p =~ s!\t!        !g;' \
+-		-e '    print "$$p\n";' \
+-		-e '    $$n++;' \
+-		-e '  }' \
+-		-e '}' \
+-		-e 'BEGIN {' \
+-		-e '  print "/* -*- c -*- */\n";' \
+-		-e '}' \
+-		-e 'END {' \
+-		-e '  if ($$n < 1) {' \
+-		-e '    warn "WARNING: your pdwtags program is too old\n";' \
+-		-e '    warn "WARNING: skipping the $@ test\n";' \
+-		-e '    warn "WARNING: install dwarves-1.3 or newer\n";' \
+-		-e '    exit 8;' \
+-		-e '  }' \
+-		-e '}' \
+-		< $(@F)-t1 > $(@F)-t3; \
+-	    case $$? in 8) rm -f $(@F)-t?; exit 0;; 0) ;; *) exit 1;; esac;\
+-	    diff -u $(@)s $(@F)-t3; st=$$?; rm -f $(@F)-t?; exit $$st; \
+-	  fi; \
+-	else \
+-	  echo 'WARNING: you lack pdwtags; skipping the $@ test' >&2; \
+-	  echo 'WARNING: install the dwarves package to get pdwtags' >&2; \
+-	fi
++	$(AM_V_GEN)	echo 'WARNING: pdwtags 1.12 known to be broken; skipping the $@ test' >&2;
+ 
+ # .libs/libvirt.so is built by libtool as a side-effect of the Makefile
+ # rule for libvirt.la.  However, checking symbols relies on Linux ELF layout