Merge ~paelzer/ubuntu/+source/libvirt:lp-1989078-AAVMF-locking-FOCAL into ubuntu/+source/libvirt:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA build: https://launchpad.net/~paelzer/+archive/ubuntu/lp-1989078-aavmf-locking

[Sergio Durigan Junior (sergiodj)]

Thanks, Christian.

PPA build succeeded. I couldn't find autopkgtest results against the PPA so I took the liberty to schedule them. Please take a look.

Aside from a minor nit in the DEP-3 headers for the second patch, everything LGTM.

+1 assuming that the dep8 tests are OK.

review: Approve

[Christian Ehrhardt  (paelzer)]

Oh, the non-tests were intentional - the change has no coverage whatsoever in the tests that are defined. But anyway, it doesn't hurt either ... :-)

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-focal-paelzer-lp-1989078-aavmf-locking/?format=plain)
  libvirt @ amd64:
    10.01.23 23:26:09 Log 🗒️ ✅ Triggers: libvirt/6.0.0-0ubuntu8.17~focalppa1
  libvirt @ arm64:
    10.01.23 23:05:40 Log 🗒️ ✅ Triggers: libvirt/6.0.0-0ubuntu8.17~focalppa1
  libvirt @ armhf:
    10.01.23 22:04:42 Log 🗒️ ✅ Triggers: libvirt/6.0.0-0ubuntu8.17~focalppa1
  libvirt @ ppc64el:
    10.01.23 23:03:26 Log 🗒️ ✅ Triggers: libvirt/6.0.0-0ubuntu8.17~focalppa1
  libvirt @ s390x:
    10.01.23 23:31:16 Log 🗒️ ✅ Triggers: libvirt/6.0.0-0ubuntu8.17~focalppa1

[Christian Ehrhardt  (paelzer)]

Added the dep-3 tag, I didn't think of it as it wasn't the trigger for this fix.
But you are right, why not be complete.

[Christian Ehrhardt  (paelzer)]

Uploading libvirt_6.0.0-0ubuntu8.17.dsc
Uploading libvirt_6.0.0-0ubuntu8.17.debian.tar.xz
Uploading libvirt_6.0.0-0ubuntu8.17_source.buildinfo
Uploading libvirt_6.0.0-0ubuntu8.17_source.changes

Waiting for SRU team now ...

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: paelzer, sergiodj
Uploaders: paelzer, sergiodj
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index babf99f..9b54d06 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (6.0.0-0ubuntu8.17) focal; urgency=medium
+
+  * d/p/u/lp-1989078-*.patch: allow arm64 to lock its OVMF/AAVMF resources
+    (LP: #1989078)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 09 Jan 2023 08:48:16 +0100
+
 libvirt (6.0.0-0ubuntu8.16) focal-security; urgency=medium
 
   * SECURITY UPDATE: crash via double-free memory issue
diff --git a/debian/patches/series b/debian/patches/series
index 2f69f69..c88916d 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -186,3 +186,5 @@ CVE-2021-4147-5.patch
 CVE-2021-4147-6pre1.patch
 CVE-2021-4147-6.patch
 CVE-2022-0897.patch
+ubuntu/lp-1989078-apparmor-Fix-QEMU-access-for-UEFI-variable-files.patch
+ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
diff --git a/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch b/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
new file mode 100644
index 0000000..8ee7a65
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1989078-apparmor-Allow-locking-AAVMF-firmware.patch
@@ -0,0 +1,32 @@
+From 2b98d5d91d95087d8a96d6450fa96414ed05ba5c Mon Sep 17 00:00:00 2001
+From: Andrea Bolognani <[e-mail]>
+Date: Mon, 23 May 2022 10:31:02 +0200
+Subject: [PATCH] apparmor: Allow locking AAVMF firmware
+
+We already allow this for OVMF.
+
+Closes: https://gitlab.com/libvirt/libvirt/-/issues/312
+Signed-off-by: Andrea Bolognani <[e-mail]>
+Reviewed-by: Martin Kletzander <[e-mail]>
+
+X-Backport-Note: 07af71ad has not landed yet and since it sorted all entries
+                 there is some non-functional noise
+Origin: backport, https://gitlab.com/libvirt/libvirt/-/commit/2b98d5d91
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1989078
+Last-Update: 2023-01-09
+
+---
+ src/security/apparmor/libvirt-qemu | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -91,7 +91,7 @@
+   /usr/share/misc/sgabios.bin r,
+   /usr/share/ovmf/** rk,
+   /usr/share/OVMF/** rk,
+-  /usr/share/AAVMF/** r,
++  /usr/share/AAVMF/** rk,
+   /usr/share/qemu-efi/** r,
+   /usr/share/slof/** r,
+ 
diff --git a/debian/patches/ubuntu/lp-1989078-apparmor-Fix-QEMU-access-for-UEFI-variable-files.patch b/debian/patches/ubuntu/lp-1989078-apparmor-Fix-QEMU-access-for-UEFI-variable-files.patch
new file mode 100644
index 0000000..a6009c9
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1989078-apparmor-Fix-QEMU-access-for-UEFI-variable-files.patch
@@ -0,0 +1,48 @@
+From 7aec69b7fb9d0cfe8b7203473764c205b28d2905 Mon Sep 17 00:00:00 2001
+From: Martin Pitt <[e-mail]>
+Date: Fri, 25 Feb 2022 14:07:30 +0000
+Subject: [PATCH] apparmor: Fix QEMU access for UEFI variable files
+
+QEMU needs to read, write, and lock the NVRAM *.fd files with UEFI
+firmware.
+
+Fixes: https://bugs.debian.org/1006324
+Fixes: https://launchpad.net/bugs/1962035
+
+Signed-off-by: Martin Pitt <[e-mail]>
+Reviewed-by: Christian Ehrhardt <[e-mail]>
+
+X-Backport-Note: 07af71ad has not landed yet and since it sorted all entries
+                 there is some non-functional noise
+Origin: backport, https://gitlab.com/libvirt/libvirt/-/commit/7aec69b7f
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1989078
+Bug-Debian: https://bugs.debian.org/1006324
+Last-Update: 2023-01-09
+
+---
+ src/security/apparmor/libvirt-qemu | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/src/security/apparmor/libvirt-qemu
++++ b/src/security/apparmor/libvirt-qemu
+@@ -89,8 +89,8 @@
+   /usr/share/vgabios/** r,
+   /usr/share/seabios/** r,
+   /usr/share/misc/sgabios.bin r,
+-  /usr/share/ovmf/** r,
+-  /usr/share/OVMF/** r,
++  /usr/share/ovmf/** rk,
++  /usr/share/OVMF/** rk,
+   /usr/share/AAVMF/** r,
+   /usr/share/qemu-efi/** r,
+   /usr/share/slof/** r,
+@@ -264,5 +264,9 @@
+   / r, # harmless on any lsb compliant system
+   /sys/bus/nd/devices/{,**/} r,
+ 
++  # required for QEMU accessing UEFI nvram variables
++  owner /var/lib/libvirt/qemu/nvram/*_VARS.fd rwk,
++  owner /var/lib/libvirt/qemu/nvram/*_VARS.ms.fd rwk,
++
+   # Site-specific additions and overrides. See local/README for details.
+   #include <local/abstractions/libvirt-qemu>