[FFe] wrap swtpm in an apparmor profile

Bug #1950631 reported by Christian Ehrhardt 
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Invalid
High
Unassigned
swtpm (Ubuntu)
Fix Released
High
Lena Voytek

Bug Description

Dear Release Team,

Please accept the swtpm apparmor profile as a Jammy FFe.

PPA: ppa:lvoytek/swtpm-apparmor-profile-jammy

[Rationale]

swtpm is being MIRed right now (bug 1948748) and while not (yet, still in security revieww) being called out explicitly - adding in the apparmor profile is a good addition in regard to security. Eventually this is another new guest<->host interface which generally are high ranked in attack profiles - so adding another layer (Steve already made the user swtpm runs with more safe) of security seems like an important thing.

[Regression Potential]

If the apparmor profile is missing certain exceptions then some users may encounter permission denied errors with their setup.
But before Jammy swtpm wasn't in the Archive at all and that isn't released yet - so it can't be felt like a regression. And the profile has the usual means of local includes to allow users to overcome this without too much hazzle.

swtpm is not seeded (but about to, see MIR bug above).

[Proposed upload]

Code: https://code.launchpad.net/~lvoytek/ubuntu/+source/swtpm/+git/swtpm/+merge/415813

Build: https://launchpad.net/~lvoytek/+archive/ubuntu/swtpm-apparmor-profile-jammy

[Tests]

autopkgtest output:

============================================================================
Testsuite summary for swtpm 0.6.1
============================================================================
# TOTAL: 58
# PASS: 50
# SKIP: 8
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
============================================================================
make[3]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
make[2]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
make[1]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src/tests'
make[1]: Entering directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src'
make[1]: Leaving directory '/tmp/autopkgtest.cLbuOZ/build.Gmd/src'
autopkgtest [10:14:10]: test run-tests: -----------------------]
autopkgtest [10:14:11]: test run-tests: - - - - - - - - - - results - - - - - - - - - -
run-tests PASS
autopkgtest [10:14:11]: @@@@@@@@@@@@@@@@@@@@ summary
run-tests PASS
qemu-system-x86_64: terminating on signal 15 from pid 58469 (/usr/bin/python3)

[Original Description]

This is a spin off from MIR bug 1948748 for swtpm.

As we can see in bug 1859506 it currently seems to run in guest-context which is good as that is already rather reduced and safer than e.g. the libvirt daemon.

But still we should evaluate adding a further reduced profile just for swtpm and have it transition there.

Tags: server-todo

Related branches

CVE References

tags: added: server-todo
Utkarsh Gupta (utkarsh)
Changed in libvirt (Ubuntu):
status: New → Triaged
Revision history for this message
Utkarsh Gupta (utkarsh) wrote :

Hi Christian,

I know this is known and you're aware of this but I am marking this as "Triaged" so it doesn't come across as a "New" bug which has no actions from the triager. :)

Lena Voytek (lvoytek)
Changed in libvirt (Ubuntu):
assignee: nobody → Lena Voytek (lvoytek)
Lena Voytek (lvoytek)
Changed in swtpm (Ubuntu):
status: New → In Progress
Changed in libvirt (Ubuntu):
status: Triaged → In Progress
Changed in swtpm (Ubuntu):
assignee: nobody → Lena Voytek (lvoytek)
tags: added: server-next
removed: server-todo
Lena Voytek (lvoytek)
summary: - wrap swtpm in an apparmor profile
+ [FFe] wrap swtpm in an apparmor profile
Lena Voytek (lvoytek)
description: updated
tags: added: server-todo
removed: server-next
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

It seems we need no libvirt task for this and since swtpm can be used without libvirt having it in src:swtpm itself is better anyway.

Changed in libvirt (Ubuntu):
importance: Undecided → High
Changed in swtpm (Ubuntu):
importance: Undecided → High
Changed in libvirt (Ubuntu):
status: In Progress → Invalid
assignee: Lena Voytek (lvoytek) → nobody
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
description: updated
Lena Voytek (lvoytek)
Changed in swtpm (Ubuntu):
status: In Progress → New
description: updated
Revision history for this message
Steve Langasek (vorlon) wrote :

FFe granted.

Changed in swtpm (Ubuntu):
status: New → Confirmed
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Thank you Steve!
Re-reviewed and sponsored to Jammy

@Lena - do not forget to try to upstream it so that at some point we can drop the Delta.

Changed in swtpm (Ubuntu):
status: Confirmed → Fix Committed
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

FYI this is blocked in proposed failing its autopkgtests.
This is reproducible in Ubuntu infra as well as locally in VM.

I'll try to extend the rules as needed and will let you know what i found eventually.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :
Download full text (5.8 KiB)

Test stuck here:

4 0 356 1 20 0 2888 1716 - Ss hvc1 0:00 /bin/sh
1 0 3081 356 20 0 2888 140 - S+ hvc1 0:00 \_ /bin/sh
4 0 3082 3081 20 0 10192 4268 - S+ hvc1 0:00 \_ su -s /bin/bash ubuntu -c set -e; export USER=`id -nu`; . /etc/profile >/dev/null 2>&1 || true; . ~/.profile >/dev/null 2>&1 || true; buildtree="/tmp/autopkgtest.y9SOlW/build.P79/src"; mkdir -
4 1000 3091 3082 20 0 7892 3844 do_wai Ss ? 0:00 \_ bash -c set -e; export USER=`id -nu`; . /etc/profile >/dev/null 2>&1 || true; . ~/.profile >/dev/null 2>&1 || true; buildtree="/tmp/autopkgtest.y9SOlW/build.P79/src"; mkdir -p -m 1777 -- "
0 1000 3099 3091 20 0 2888 1000 do_wai S ? 0:00 \_ /bin/sh /tmp/autopkgtest.y9SOlW/build.P79/src/debian/tests/run-tests
1 1000 3100 3099 20 0 7892 1756 do_wai S ? 0:00 \_ bash -c set -e; export USER=`id -nu`; . /etc/profile >/dev/null 2>&1 || true; . ~/.profile >/dev/null 2>&1 || true; buildtree="/tmp/autopkgtest.y9SOlW/build.P79/src"; mkdir -p -m 1
0 1000 3104 3100 20 0 6192 1024 pipe_r S ? 0:00 | \_ tee -a /tmp/autopkgtest.y9SOlW/run-tests-stderr
1 1000 3101 3099 20 0 7892 1672 do_wai S ? 0:00 \_ bash -c set -e; export USER=`id -nu`; . /etc/profile >/dev/null 2>&1 || true; . ~/.profile >/dev/null 2>&1 || true; buildtree="/tmp/autopkgtest.y9SOlW/build.P79/src"; mkdir -p -m 1
0 1000 3103 3101 20 0 6192 1016 pipe_r S ? 0:00 | \_ tee -a /tmp/autopkgtest.y9SOlW/run-tests-stdout
0 1000 6038 3099 20 0 6676 2484 do_wai S ? 0:00 \_ make -j4 check VERBOSE=1
0 1000 6039 6038 20 0 7760 3388 do_wai S ? 0:00 \_ /bin/bash -c fail=; \ if (target_option=k; case ${target_option-} in ?) ;; *) echo "am__make_running_with_option: internal error: invalid" "target option '${target_option-}' spe
1 1000 7081 6039 20 0 7760 1988 do_wai S ? 0:00 \_ /bin/bash -c fail=; \ if (target_option=k; case ${target_option-} in ?) ;; *) echo "am__make_running_with_option: internal error: invalid" "target option '${target_option-}'
0 1000 7082 7081 20 0 6684 2676 do_wai S ? 0:00 \_ make check
0 1000 7086 7082 20 0 6684 2696 do_wai S ? 0:00 \_ make check-TESTS
0 1000 7094 7086 20 0 7760 3344 do_wai S ? 0:00 \_ /bin/bash -c set +e; bases='test_vtpm_proxy.log test_tpm2_vtpm_proxy.log test_ctrlchannel2.log test_ctrlchannel4.log test_tpm2_ctrlchannel2.log test_commandline.
0 1000 7103 7094 20 0 6908 2892 do_wai S ? 0:00 \_ make test-suite.log TEST_LOGS=test_vtpm_proxy.log test_tpm2_vtpm_proxy.log test_ctrlchannel2.log test_ctrlchannel4.log test_tpm2_ctrlchannel2.log test_comman
0 1000 ...

Read more...

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Now things pass locally, running the same on infra over lunch to see if it is good there as well.

============================================================================
Testsuite summary for swtpm 0.6.3
============================================================================
# TOTAL: 58
# PASS: 50
# SKIP: 8
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
============================================================================
make[3]: Leaving directory '/tmp/autopkgtest.GhwPFN/build.2Yo/src/tests'
make[2]: Leaving directory '/tmp/autopkgtest.GhwPFN/build.2Yo/src/tests'
make[1]: Leaving directory '/tmp/autopkgtest.GhwPFN/build.2Yo/src/tests'
make[1]: Entering directory '/tmp/autopkgtest.GhwPFN/build.2Yo/src'
make[1]: Leaving directory '/tmp/autopkgtest.GhwPFN/build.2Yo/src'
autopkgtest [12:52:59]: test run-tests: -----------------------]
autopkgtest [12:53:00]: test run-tests: - - - - - - - - - - results - - - - - - - - - -
run-tests PASS
autopkgtest [12:53:00]: - - - - - - - - - - running shell - - - - - - - - - -

Revision history for this message
Lena Voytek (lvoytek) wrote :

Thank you for finding that! I can get a merge request going for it. Should I try and get it added in before the version bump?

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

It is all ready for review and tested in https://code.launchpad.net/~paelzer/ubuntu/+source/swtpm/+git/swtpm/+merge/417221 already.
No need to act other than reviewing this one.

Revision history for this message
Lena Voytek (lvoytek) wrote :

Ah sorry, not sure how I didn't see that. I'll get to reviewing the mp then

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

FYI - Fixup uploaded as part of 0.6.3-0ubuntu1

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package swtpm - 0.6.3-0ubuntu1

---------------
swtpm (0.6.3-0ubuntu1) jammy; urgency=medium

  * Update to the stable release v0.6.3 (LP: 1948748)
    - swtpm:
      + Do not chdir(/) when using --daemon
      + Check header size indicator against expected size (CVE-2022-23645)
    - swtpm-localca:
      + Re-implement variable resolution for swtpm-localca.conf
      + Test for available issuercert before creating CA
    - tests:
      + Use ${WORKDIR} in config files to test env. var replacement
    - man:
      + Add missing .config directory to path description when using ${HOME}
    - build-sys:
      + Add probing for -fstack-protector
      + configure: Fix typo TPM2 -> TMP2
    - swtpm_setup:
      + Report stderr as returned by external tool (swtpm-localcal)
      + Fix exit code on error to be '1'.
  * d/usr.bin.swtpm: fix hang on unix sockets due to apparmor rules

swtpm (0.6.1-0ubuntu6) jammy; urgency=medium

  * Add apparmor profile to swtpm (LP: #1950631)
    - d/usr.bin.swtpm: Create new apparmor profile
    - d/swtpm.install: Copy apparmor profile to /etc/apparmor.d/
    - d/rules: Deploy the swtpm apparmor profile
    - d/control: Add dh-apparmor as a dependency

 -- Christian Ehrhardt <email address hidden> Tue, 22 Mar 2022 09:31:40 +0100

Changed in swtpm (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.