Merge ~paelzer/ubuntu/+source/strongswan:lp-1780534-stroke-segfault-lp-1773956-clusterip-apparmor-bionic into ubuntu/+source/strongswan:ubuntu/bionic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

test PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3563
Ticket for autotests: https://bileto.ubuntu.com/#/ticket/3563

qa-regression tests ran fine

[Andreas Hasenack (ahasenack)]

+1 if you are happy with not addressing swanctl and syncing both charon profiles.

review: Approve

[Christian Ehrhardt  (paelzer)]

The swanctl alg issue we have no bug, nor do we know if it actually inhibits functionality.
Unless I heard of a real case I held back the change from the SRU.
The same is true for the syncing of the two profiles.

Thanks a lot for double checking all of this!

Tag pushed and uploaded for SRU processing.

diff --git a/debian/changelog b/debian/changelog
index d31b635..cf0ab43 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+strongswan (5.6.2-1ubuntu2.4) bionic; urgency=medium
+
+  * fix stroke and lookip execution in containers (LP: #1780534). Binaries
+    need to be able to read map and execute themselves
+    - d/usr.lib.ipsec.lookip: add rmix to own binary
+    - d/usr.lib.ipsec.stroke: add rmix to own binary
+  * d/usr.lib.ipsec.charon: allow CLUSTERIP for ha plugin (LP: #1773956)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 12 Dec 2018 15:52:43 +0100
+
 strongswan (5.6.2-1ubuntu2.3) bionic-security; urgency=medium
 
   * SECURITY UPDATE: Insufficient input validation in gmp plugin
diff --git a/debian/usr.lib.ipsec.charon b/debian/usr.lib.ipsec.charon
index 9e24c74..c5dba27 100644
--- a/debian/usr.lib.ipsec.charon
+++ b/debian/usr.lib.ipsec.charon
@@ -71,6 +71,10 @@
 
   /var/lib/strongswan/*     r,
 
+  # for using the ha plugin (LP: #1773956)
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/ r,
+  @{PROC}/@{pid}/net/ipt_CLUSTERIP/* rw,
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.lib.ipsec.charon>
 }
diff --git a/debian/usr.lib.ipsec.lookip b/debian/usr.lib.ipsec.lookip
index de10433..614cda8 100644
--- a/debian/usr.lib.ipsec.lookip
+++ b/debian/usr.lib.ipsec.lookip
@@ -15,6 +15,8 @@
 /usr/lib/ipsec/lookip {
   #include <abstractions/base>
 
+  /usr/lib/ipsec/lookip     rmix,
+
   /run/charon.lkp           rw,
 
   # Site-specific additions and overrides. See local/README for details.
diff --git a/debian/usr.lib.ipsec.stroke b/debian/usr.lib.ipsec.stroke
index 9d20ee7..af9cdcc 100644
--- a/debian/usr.lib.ipsec.stroke
+++ b/debian/usr.lib.ipsec.stroke
@@ -17,6 +17,8 @@
 
   capability dac_override,
 
+  /usr/lib/ipsec/stroke         rmix,
+
   /etc/strongswan.conf          r,
   /etc/strongswan.d/            r,
   /etc/strongswan.d/**          r,