Lubuntu
/
livecd-rootfs
mirror of https://git.launchpad.net/livecd-rootfs
3
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: bind correct apparmor feature for validating snap seed

Browse Source 
During Realtime kernel image build, there was an error during
validating snap seed which derivative images copied 5.19
apparmor feature and can't validate when Realtime kernel (5.15)
installed [0].

To prevent this, bind correct apparmor feature with kernel
version.

[0] https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2024639
jammy-sru-1996489
Jess Jang 1 year ago
parent aec2395457
commit 6b54faa6be
32 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File

1
live-build/apparmor/5.19/capability
Unescape View File

@ -0,0 +1 @@
0xffffff

1
live-build/apparmor/5.19/caps/mask
Unescape View File

@ -0,0 +1 @@
chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read

1
live-build/apparmor/5.19/dbus/mask
Unescape View File

@ -0,0 +1 @@
acquire send receive

1
live-build/apparmor/5.19/domain/attach_conditions/xattr
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/change_hat
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/change_hatv
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/change_onexec
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/change_profile
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/computed_longest_left
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/fix_binfmt_elf_mmap
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/post_nnp_subset
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/stack
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/domain/version
Unescape View File

@ -0,0 +1 @@
1.2

1
live-build/apparmor/5.19/file/mask
Unescape View File

@ -0,0 +1 @@
create read write exec append mmap_exec link lock

1
live-build/apparmor/5.19/mount/mask
Unescape View File

@ -0,0 +1 @@
mount umount pivot_root

1
live-build/apparmor/5.19/namespaces/pivot_root
Unescape View File

@ -0,0 +1 @@
no

1
live-build/apparmor/5.19/namespaces/profile
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/network/af_mask
Unescape View File

@ -0,0 +1 @@
unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp

1
live-build/apparmor/5.19/network/af_unix
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/network_v8/af_mask
Unescape View File

@ -0,0 +1 @@
unspec unix inet ax25 ipx appletalk netrom bridge atmpvc x25 inet6 rose netbeui security key netlink packet ash econet atmsvc rds sna irda pppox wanpipe llc ib mpls can tipc bluetooth iucv rxrpc isdn phonet ieee802154 caif alg nfc vsock kcm qipcrtr smc xdp

1
live-build/apparmor/5.19/policy/set_load
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/policy/versions/v5
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/policy/versions/v6
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/policy/versions/v7
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/policy/versions/v8
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/ptrace/mask
Unescape View File

@ -0,0 +1 @@
read trace

1
live-build/apparmor/5.19/query/label/data
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/query/label/multi_transaction
Unescape View File

@ -0,0 +1 @@
yes

1
live-build/apparmor/5.19/query/label/perms
Unescape View File

@ -0,0 +1 @@
allow deny audit quiet

1
live-build/apparmor/5.19/rlimit/mask
Unescape View File

@ -0,0 +1 @@
cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime

1
live-build/apparmor/5.19/signal/mask
Unescape View File

@ -0,0 +1 @@
hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm term stkflt chld cont stop stp ttin ttou urg xcpu xfsz vtalrm prof winch io pwr sys emt lost

13
live-build/functions
Unescape View File

@ -767,7 +767,10 @@ snap_validate_seed() {
# a snap pre-seeding issue can occur, where the incorrect apparmor features are reported
# basic copy of a directory structure overriding the "generic" feature set
# which is tied to the LTS kernel
cp -R --verbose /usr/share/livecd-rootfs/live-build/apparmor/${kern_major_min}/* /usr/share/livecd-rootfs/live-build/apparmor/generic/
# Bind kernel apparmor directory to feature directory for snap preseeding
umount "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
mount --bind /usr/share/livecd-rootfs/live-build/apparmor/${kern_major_min} "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
fi
fi
@ -777,6 +780,14 @@ snap_validate_seed() {
/usr/lib/snapd/snap-preseed $(realpath "${CHROOT_ROOT}")
chroot "${CHROOT_ROOT}" apparmor_parser --skip-read-cache --write-cache --skip-kernel-load --verbose -j `nproc` /etc/apparmor.d
fi
# Unmount kernel specific apparmor feature
# mount generic apparmor feature again (cleanup)
if [ -d /build/config/hooks.d/extra/apparmor/${kern_major_min} ]; then
umount "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
mount -o bind /usr/share/livecd-rootfs/live-build/apparmor/generic "${CHROOT_ROOT}/sys/kernel/security/apparmor/features/"
fi
}
snap_from_seed() {

Write Preview
Loading…
Cancel
Save