Merge ~paelzer/ubuntu/+source/strongswan:merge-disco-5.7.1-1-ubuntu2 into ubuntu/+source/strongswan:ubuntu/disco-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

This is a follow up to the merge, so I reused the Bileto ticket.
=> https://bileto.ubuntu.com/#/ticket/3550

PPA refreshed at: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3550

Tests will be triggered once built.

[Karl Stenerud (kstenerud)]

Structure looks good. I don't know enough about charon to comment on the contents.

[Andreas Hasenack (ahasenack)]

I'm having some difficulties reproducing the bug in disco. Let's chat tomorrow.

review: Needs Information

[Andreas Hasenack (ahasenack)]

I'm getting this message when calling "swanctl" (no parameters):
[ 265.803822] audit: type=1400 audit(1544532219.932:34): apparmor="DENIED" operation="create" profile="/usr/sbin/swanctl" pid=1511 comm="swanctl" family="alg" sock_type="seqpacket" protocol=0 requested_mask="create" denied_mask="create"

Should that be addressed separately? A quick search didn't return results, so it might be really new.

[Andreas Hasenack (ahasenack)]

charon-systemd includes a mysql abstraction, do we need that in the other charon profile too?
-/usr/lib/ipsec/charon flags=(attach_disconnected) {
+/usr/sbin/charon-systemd flags=(complain,attach_disconnected) {
   #include <abstractions/base>
   #include <abstractions/nameservice>
   #include <abstractions/authentication>
   #include <abstractions/openssl>
   #include <abstractions/p11-kit>
+ #include <abstractions/mysql>

   capability ipc_lock,
   capability net_admin,

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Moved mysql as well, thanks

I can confirm the swanctl deny, will take a look

[Christian Ehrhardt  (paelzer)]

Both updates pushed to the branch in review here.
New bug for swanctl opened and linked here.
New upload in the Bileto PPA.

[Andreas Hasenack (ahasenack)]

Tested with the new packages, all good.

+1 provided the bileto dep8 tests don't show new issues

review: Approve

[Christian Ehrhardt  (paelzer)]

Build is fine.
(re)Tests are fine.

Tagges and uploaded.

[Christian Ehrhardt  (paelzer)]

Is in -proposed, set merged state

diff --git a/debian/changelog b/debian/changelog
index 5b4dd6e..cc5f18e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+strongswan (5.7.1-1ubuntu2) disco; urgency=medium
+
+  * d/usr.sbin.charon-systemd: fix rule for CLUSTERIP to match effective
+    path (LP: #1773956)
+  * d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: resync apparmor
+    profiles of both ways to start charon (LP: #1807664)
+  * d/usr.sbin.swanctl: add apparmor rule for af-alg plugin (LP: #1807962)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 10 Dec 2018 08:30:01 +0100
+
 strongswan (5.7.1-1ubuntu1) disco; urgency=medium
 
   * Merge with Debian unstable (LP: #1806401). Remaining changes:
diff --git a/debian/usr.lib.ipsec.charon b/debian/usr.lib.ipsec.charon
index d847f62..7159586 100644
--- a/debian/usr.lib.ipsec.charon
+++ b/debian/usr.lib.ipsec.charon
@@ -19,6 +19,7 @@
   #include <abstractions/authentication>
   #include <abstractions/openssl>
   #include <abstractions/p11-kit>
+  #include <abstractions/mysql>
 
   capability ipc_lock,
   capability net_admin,
@@ -68,10 +69,16 @@
 
   /var/lib/strongswan/*     r,
 
+  /{,var/}run/systemd/notify w,
+
   # allow self to read file descriptors (LP #1786250)
   # restrict to our own process-ID as per apparmor vars
   @{PROC}/@{pid}/fd/        r,
 
+  # for using the ha plugin (LP: #1773956)
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw,
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.lib.ipsec.charon>
 }
diff --git a/debian/usr.sbin.charon-systemd b/debian/usr.sbin.charon-systemd
index b40fa67..1f67510 100644
--- a/debian/usr.sbin.charon-systemd
+++ b/debian/usr.sbin.charon-systemd
@@ -71,9 +71,13 @@
 
   /{,var/}run/systemd/notify w,
 
+  # allow self to read file descriptors (LP #1786250)
+  # restrict to our own process-ID as per apparmor vars
+  @{PROC}/@{pid}/fd/        r,
+
   # for using the ha plugin (LP: #1773956)
-  @{PROC}/net/ipt_CLUSTERIP/ r,
-  @{PROC}/net/ipt_CLUSTERIP/* rw,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.charon-systemd>
diff --git a/debian/usr.sbin.swanctl b/debian/usr.sbin.swanctl
index 627f5c0..0ae7752 100644
--- a/debian/usr.sbin.swanctl
+++ b/debian/usr.sbin.swanctl
@@ -21,6 +21,9 @@
   # Allow communication with VICI plugin UNIX domain socket
   /run/charon.vici              rw,
 
+  # for af-alg plugin
+  network alg seqpacket,
+
   # As of 5.5.2, swanctl unnecessarily loads plugins by default, even though no
   # plugins are actually used by swanctl.  The following can be removed if
   # plugin loading is disabled.