Merge ~paelzer/ubuntu/+source/swtpm:bump-0.6.3-jammy into ubuntu/+source/swtpm:ubuntu/jammy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

This contains
- upstream v6.1.0..v6.3.0 stable changes (kept as individual commits).
- tarball is from https://github.com/stefanberger/swtpm/releases/tag/v0.6.3
- a fix for the apparmor profile

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4809/+packages

This fixes:
- the request by security (https://bugs.launchpad.net/ubuntu/+source/swtpm/+bug/1948748/comments/11)
- apparmor issue blocking migration (bug 1950631)
- generally stabilizes swtpm for jammy

(now good) Autopkgtest logs:
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ci-train-ppa-service-4809/jammy/amd64/s/swtpm/20220322_115315_f84ac@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ci-train-ppa-service-4809/jammy/s390x/s/swtpm/20220322_115802_f84ac@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ci-train-ppa-service-4809/jammy/armhf/s/swtpm/20220322_120054_8a59f@/log.gz
https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-ci-train-ppa-service-4809/jammy/arm64/s/swtpm/20220322_120216_ab240@/log.gz

[Lena Voytek (lvoytek)]

The upstream additions look good to me. I don't see the apparmor profile change here though, should that show up in the diff?

changelog, builds, and tests look good to me

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Indeed I didn't push that part yet, doing so now ...

[Lena Voytek (lvoytek)]

Looks good to me! I confirm the apparmor profile addition works properly

review: Approve

[Christian Ehrhardt  (paelzer)]

Review here, tests and foundations feedback is ok - uploading.

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading swtpm_0.6.3-0ubuntu1.dsc: done.
  Uploading swtpm_0.6.3.orig.tar.gz: done.
  Uploading swtpm_0.6.3-0ubuntu1.debian.tar.xz: done.
  Uploading swtpm_0.6.3-0ubuntu1_source.buildinfo: done.
  Uploading swtpm_0.6.3-0ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/CHANGES b/CHANGES
index 5040187..75a6170 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,27 @@
 CHANGES - changes for swtpm
 
+version 0.6.3:
+  - swtpm:
+    - Do not chdir(/) when using --daemon
+  - swtpm-localca:
+    - Re-implement variable resolution for swtpm-localca.conf
+  - tests:
+    - Use ${WORKDIR} in config files to test env. var replacement
+  - man:
+    - Add missing .config directory to path description when using ${HOME}
+  - build-sys:
+    - Add probing for -fstack-protector
+    - configure: Fix typo TPM2 -> TMP2
+
+version 0.6.2:
+  - swtpm:
+    - Check header size indicator against expected size (CVE-2022-23645)
+  - swtpm-localca:
+    - Test for available issuercert before creating CA
+  - swtpm_setup:
+    - Report stderr as returned by external tool (swtpm-localcal)
+    - Fix exit code on error to be '1'.
+
 version 0.6.1:
   - swtpm:
     - Clear keys from stack and heap
diff --git a/configure.ac b/configure.ac
index 6614d5d..aa5bbfc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -23,7 +23,7 @@
 #       This file is derived from tpm-tool's configure.in.
 #
 
-AC_INIT([swtpm], [0.6.1])
+AC_INIT([swtpm], [0.6.3])
 AC_PREREQ([2.69])
 AC_CONFIG_SRCDIR(Makefile.am)
 AC_CONFIG_HEADERS([config.h])
@@ -384,17 +384,20 @@ AC_ARG_ENABLE([hardening],
   AS_HELP_STRING([--disable-hardening], [Disable hardening flags]))
 
 if test "x$enable_hardening" != "xno"; then
-	TMP="$($CC -fstack-protector-strong $srcdir/include/swtpm/tpm_ioctl.h 2>&1)"
-	if echo $TMP | $GREP 'unrecognized command line option' >/dev/null; then
-		HARDENING_CFLAGS="-fstack-protector -Wstack-protector "
+	# Some versions of gcc fail with -Wstack-protector,
+	# some with -Wstack-protector-strong enabled
+	if ! $CC -fstack-protector-strong -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null; then
+		if $CC -fstack-protector -Wstack-protector $srcdir/include/swtpm/tpm_ioctl.h 2>/dev/null; then
+			HARDENING_CFLAGS="-fstack-protector -Wstack-protector"
+		fi
 	else
-		HARDENING_CFLAGS="-fstack-protector-strong -Wstack-protector "
+		HARDENING_CFLAGS="-fstack-protector-strong -Wstack-protector"
 	fi
 
 	dnl Must not have -O0 but must have a -O for -D_FORTIFY_SOURCE=2
 	TMP1="$(echo $CFLAGS | sed -n 's/.*\(-O0\).*/\1/p')"
 	TMP2="$(echo $CFLAGS | sed -n 's/.*\(-O\).*/\1/p')"
-	if test -z "$TMP1" && test -n "$TPM2"; then
+	if test -z "$TMP1" && test -n "$TMP2"; then
 		HARDENING_CFLAGS="$HARDENING_CFLAGS -D_FORTIFY_SOURCE=2 "
 	fi
 	dnl Check linker for 'relro' and 'now'
diff --git a/debian/changelog b/debian/changelog
index bafaa79..2358ac3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,26 @@
+swtpm (0.6.3-0ubuntu1) jammy; urgency=medium
+
+  * Update to the stable release v0.6.3 (LP: 1948748)
+    - swtpm:
+      + Do not chdir(/) when using --daemon
+      + Check header size indicator against expected size (CVE-2022-23645)
+    - swtpm-localca:
+      + Re-implement variable resolution for swtpm-localca.conf
+      + Test for available issuercert before creating CA
+    - tests:
+      + Use ${WORKDIR} in config files to test env. var replacement
+    - man:
+      + Add missing .config directory to path description when using ${HOME}
+    - build-sys:
+      + Add probing for -fstack-protector
+      + configure: Fix typo TPM2 -> TMP2
+    - swtpm_setup:
+      + Report stderr as returned by external tool (swtpm-localcal)
+      + Fix exit code on error to be '1'.
+  * d/usr.bin.swtpm: fix hang on unix sockets due to apparmor rules
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 22 Mar 2022 09:31:40 +0100
+
 swtpm (0.6.1-0ubuntu6) jammy; urgency=medium
 
   * Add apparmor profile to swtpm (LP: #1950631)
diff --git a/debian/usr.bin.swtpm b/debian/usr.bin.swtpm
index 9223918..3d79c9f 100644
--- a/debian/usr.bin.swtpm
+++ b/debian/usr.bin.swtpm
@@ -16,6 +16,7 @@ profile swtpm /usr/bin/swtpm {
 
   network inet stream,
   network inet6 stream,
+  unix (send) type=dgram addr=none peer=(addr=none),
 
   owner /tmp/** rwk,
   owner /usr/bin/swtpm r,
diff --git a/man/man8/swtpm_setup.pod b/man/man8/swtpm_setup.pod
index 178337b..13e8464 100644
--- a/man/man8/swtpm_setup.pod
+++ b/man/man8/swtpm_setup.pod
@@ -28,7 +28,7 @@ If this parameter is not provided, the default configuration file
 will be used. The search order for the default configuration file is
 as follows. If the environment variable XDG_CONFIG_HOME is set,
 ${XDG_CONFIG_HOME}/swtpm_setup.conf will be used if available, otherwise if
-the environment variable HOME is set, ${HOME}/swtpm_setup.conf
+the environment variable HOME is set, ${HOME}/.config/swtpm_setup.conf
 will be used if available. If none of the previous ones are available, /etc/swtpm_setup.conf
 will be used.
 
diff --git a/samples/swtpm_localca.c b/samples/swtpm_localca.c
index 1617977..2a5aaa0 100644
--- a/samples/swtpm_localca.c
+++ b/samples/swtpm_localca.c
@@ -135,7 +135,7 @@ static int create_localca_cert(const gchar *lockfile, const gchar *statedir,
             goto error;
     }
 
-    if (access(signkey, R_OK) != 0) {
+    if (access(signkey, R_OK) != 0 || access(issuercert, R_OK) != 0) {
         g_autofree gchar *directory = g_path_get_dirname(signkey);
         g_autofree gchar *cakey = g_strjoin(G_DIR_SEPARATOR_S, directory, "swtpm-localca-rootca-privkey.pem", NULL);
         g_autofree gchar *cacert = g_strjoin(G_DIR_SEPARATOR_S, directory, "swtpm-localca-rootca-cert.pem", NULL);
@@ -821,13 +821,28 @@ int main(int argc, char *argv[])
         if (ret != 0)
             goto error;
     } else {
+        int create_certs = 0;
+
+        /* create certificate if either the signing key or issuer cert are missing */
         if (access(signkey, R_OK) != 0) {
             if (stat(signkey, &statbuf) == 0) {
                 logerr(gl_LOGFILE, "Need read rights on signing key %s for user %s.\n",
                        signkey, curr_user ? curr_user->pw_name : "<unknown>");
                 goto error;
             }
+            create_certs = 1;
+        }
+
+        if (access(issuercert, R_OK) != 0) {
+            if (stat(issuercert, &statbuf) == 0) {
+                logerr(gl_LOGFILE, "Need read rights on issuer certificate %s for user %s.\n",
+                       issuercert, curr_user ? curr_user->pw_name : "<unknown>");
+                goto error;
+            }
+            create_certs = 1;
+        }
 
+        if (create_certs) {
             logit(gl_LOGFILE, "Creating root CA and a local CA's signing key and issuer cert.\n");
             if (create_localca_cert(lockfile, statedir, signkey, signkey_password,
                                     issuercert) != 0) {
diff --git a/samples/swtpm_localca_utils.c b/samples/swtpm_localca_utils.c
index 7aeb9cf..76cb57f 100644
--- a/samples/swtpm_localca_utils.c
+++ b/samples/swtpm_localca_utils.c
@@ -58,10 +58,12 @@ gchar *get_config_value(gchar **config_file_lines, const gchar *configname, cons
     for (idx = 0; config_file_lines[idx] != NULL; idx++) {
         const gchar *line = config_file_lines[idx];
         if (regexec(&preg, line, 2, pmatch, 0) == 0) {
-            result = g_strndup(&line[pmatch[1].rm_so],
-                               pmatch[1].rm_eo - pmatch[1].rm_so);
-            /* coverity: g_strchmop modifies in-place */
-            result = g_strchomp(result);
+            g_autofree gchar *tmp = NULL;
+
+            tmp = g_strndup(&line[pmatch[1].rm_so],
+                            pmatch[1].rm_eo - pmatch[1].rm_so);
+            g_strchomp(tmp);
+            result = resolve_string(tmp);
             break;
         }
     }
diff --git a/src/swtpm/swtpm.c b/src/swtpm/swtpm.c
index 476b398..8e6f52a 100644
--- a/src/swtpm/swtpm.c
+++ b/src/swtpm/swtpm.c
@@ -461,9 +461,9 @@ int swtpm_main(int argc, char **argv, const char *prgname, const char *iface)
 
     if (daemonize) {
 #ifdef __APPLE__
-        if (0 != osx_daemon(0, 0)) {
+        if (0 != osx_daemon(1, 0)) {
 #else
-        if (0 != daemon(0, 0)) {
+        if (0 != daemon(1, 0)) {
 #endif
             logprintf(STDERR_FILENO, "Error: Could not daemonize.\n");
             goto exit_failure;
diff --git a/src/swtpm/swtpm_chardev.c b/src/swtpm/swtpm_chardev.c
index 7ccd754..2fa2668 100644
--- a/src/swtpm/swtpm_chardev.c
+++ b/src/swtpm/swtpm_chardev.c
@@ -510,9 +510,9 @@ int swtpm_chardev_main(int argc, char **argv, const char *prgname, const char *i
 
     if (daemonize) {
 #if defined __APPLE__
-       if (0 != osx_daemon(0, 0)) {
+       if (0 != osx_daemon(1, 0)) {
 #else
-       if (0 != daemon(0, 0)) {
+       if (0 != daemon(1, 0)) {
 #endif
            logprintf(STDERR_FILENO, "Error: Could not daemonize.\n");
            goto exit_failure;
diff --git a/src/swtpm/swtpm_nvfile.c b/src/swtpm/swtpm_nvfile.c
index 9f5c9bb..7f69cbd 100644
--- a/src/swtpm/swtpm_nvfile.c
+++ b/src/swtpm/swtpm_nvfile.c
@@ -1266,6 +1266,7 @@ SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
                         uint8_t *hdrversion, bool quiet)
 {
     blobheader *bh = (blobheader *)data;
+    uint16_t hdrsize;
 
     if (length < sizeof(bh)) {
         if (!quiet)
@@ -1291,8 +1292,16 @@ SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
         return TPM_BAD_VERSION;
     }
 
+    hdrsize = ntohs(bh->hdrsize);
+    if (hdrsize != sizeof(blobheader)) {
+        logprintf(STDERR_FILENO,
+                  "bad header size: %u != %zu\n",
+                  hdrsize, sizeof(blobheader));
+        return TPM_BAD_DATASIZE;
+    }
+
     *hdrversion = bh->version;
-    *dataoffset = ntohs(bh->hdrsize);
+    *dataoffset = hdrsize;
     *hdrflags = ntohs(bh->flags);
 
     return TPM_SUCCESS;
diff --git a/src/swtpm_setup/swtpm_setup.c b/src/swtpm_setup/swtpm_setup.c
index ddbcc64..c254096 100644
--- a/src/swtpm_setup/swtpm_setup.c
+++ b/src/swtpm_setup/swtpm_setup.c
@@ -254,6 +254,7 @@ static int call_create_certs(unsigned long flags, const gchar *configfile, const
         for (idx = 0; flags_to_certfiles[idx].filename != NULL; idx++) {
             if (flags & flags_to_certfiles[idx].flag) {
                 g_autofree gchar *standard_output = NULL;
+                g_autofree gchar *standard_error = NULL;
                 GError *error = NULL;
                 gchar **lines;
 
@@ -263,8 +264,8 @@ static int call_create_certs(unsigned long flags, const gchar *configfile, const
                 logit(gl_LOGFILE, "  Invoking %s\n", s);
                 g_free(s);
 
-                success = g_spawn_sync(NULL, cmd, NULL, G_SPAWN_STDERR_TO_DEV_NULL, NULL, NULL,
-                                       &standard_output, NULL, &exit_status, &error);
+                success = g_spawn_sync(NULL, cmd, NULL, 0, NULL, NULL,
+                                       &standard_output, &standard_error, &exit_status, &error);
                 if (!success) {
                     logerr(gl_LOGFILE, "An error occurred running %s: %s\n",
                            create_certs_tool, error->message);
@@ -273,7 +274,7 @@ static int call_create_certs(unsigned long flags, const gchar *configfile, const
                     break;
                 } else if (exit_status != 0) {
                     logerr(gl_LOGFILE, "%s exit with status %d: %s\n",
-                           prgname, exit_status, standard_output);
+                           prgname, WEXITSTATUS(exit_status), standard_error);
                     ret = 1;
                     break;
                 }
@@ -287,6 +288,8 @@ static int call_create_certs(unsigned long flags, const gchar *configfile, const
 
                 g_free(standard_output);
                 standard_output = NULL;
+                g_free(standard_error);
+                standard_error = NULL;
             }
         }
     }
@@ -1468,9 +1471,12 @@ int main(int argc, char *argv[])
           tmpbuffer);
 
 out:
-error:
     g_strfreev(swtpm_prg_l);
     g_free(gl_LOGFILE);
 
     exit(ret);
+
+error:
+    ret = 1;
+    goto out;
 }
diff --git a/swtpm.spec b/swtpm.spec
index 35a2a4a..f8757a3 100644
--- a/swtpm.spec
+++ b/swtpm.spec
@@ -7,7 +7,7 @@
 
 Summary: TPM Emulator
 Name:           swtpm
-Version:        0.6.1
+Version:        0.6.3
 Release:        1%{?dist}
 License:        BSD
 Url:            https://github.com/stefanberger/swtpm
@@ -172,6 +172,12 @@ fi
 %{_datadir}/swtpm/swtpm-create-tpmca
 
 %changelog
+* Mon Mar 07 2022 Stefan Berger <[e-mail]> - 0.6.3-1.20220225git-------
+- v0.6.3 release
+
+* Fri Feb 18 2022 Stefan Berger <[e-mail]> - 0.6.2-1.20220218git-------
+- v0.6.2 release
+
 * Mon Sep 20 2021 Stefan Berger <[e-mail]> - 0.6.1-0.20210917git-------
 - v0.6.1 release
 
diff --git a/swtpm.spec.in b/swtpm.spec.in
index d69ede0..81196ec 100644
--- a/swtpm.spec.in
+++ b/swtpm.spec.in
@@ -172,6 +172,12 @@ fi
 %{_datadir}/swtpm/swtpm-create-tpmca
 
 %changelog
+* Mon Mar 07 2022 Stefan Berger <[e-mail]> - 0.6.3-1.20220225git-------
+- v0.6.3 release
+
+* Fri Feb 18 2022 Stefan Berger <[e-mail]> - 0.6.2-1.20220218git-------
+- v0.6.2 release
+
 * Mon Sep 20 2021 Stefan Berger <[e-mail]> - 0.6.1-0.20210917git-------
 - v0.6.1 release
 
diff --git a/tests/test_swtpm_setup_create_cert b/tests/test_swtpm_setup_create_cert
index 3bb753c..f80505c 100755
--- a/tests/test_swtpm_setup_create_cert
+++ b/tests/test_swtpm_setup_create_cert
@@ -30,13 +30,14 @@ function cleanup()
 
 # We want swtpm_cert to use the local CA and see that the
 # local CA script automatically creates a signingkey and
-# self-signed certificate
+# self-signed certificate; use ${WORKDIR} in the config files
+# to test env variable resolution
 
 cat <<_EOF_ > ${workdir}/swtpm-localca.conf
-statedir=${workdir}
-signingkey = ${SIGNINGKEY}
-issuercert = ${ISSUERCERT}
-certserial = ${CERTSERIAL}
+statedir=\${WORKDIR}
+signingkey = \${WORKDIR}/signingkey.pem
+issuercert = \${WORKDIR}/issuercert.pem
+certserial = \${WORKDIR}/certserial
 _EOF_
 
 cat <<_EOF_ > ${workdir}/swtpm-localca.options
@@ -50,8 +51,8 @@ _EOF_
 
 cat <<_EOF_ > ${workdir}/swtpm_setup.conf
 create_certs_tool=${SWTPM_LOCALCA}
-create_certs_tool_config=${workdir}/swtpm-localca.conf
-create_certs_tool_options=${workdir}/swtpm-localca.options
+create_certs_tool_config=\${WORKDIR}/swtpm-localca.conf
+create_certs_tool_options=\${WORKDIR}/swtpm-localca.options
 _EOF_
 
 # We need to adapt the PATH so the correct swtpm_cert is picked
@@ -61,7 +62,8 @@ export PATH=${ROOT}/src/swtpm_cert:${PATH}
 export SWTPM_ROOTCA_PASSWORD=password
 
 # we need to create at least one cert: --create-ek-cert
-$SWTPM_SETUP \
+WORKDIR=${workdir} \
+  $SWTPM_SETUP \
 	--tpm-state ${workdir} \
 	--create-ek-cert \
 	--config ${workdir}/swtpm_setup.conf \