libvirt swtpm pid files duplicating in /run/libvirt/qemu/swtpm/

[Lena Voytek]

[Impact]

When a user shuts down a qemu vm that uses swtpm, the swtpm pid file will be left behind.

This fix should be backported to Kinetic to stop ongoing clutter from dead pid files.

The issue is fixed using a patch commit from upstream that clears out the existing swtpm pid file when the vm shuts down.

[Test Plan]

To test, install virt-manager and swtpm then create a vm:

# sudo apt install virt-manager swtpm

Create a vm in virt-manager and on the last page

> Select "Customize configuration before install"
> Click Finish

> Click Add Hardware
> Select TPM with Model "TIS" and version 2.0

> Click "Begin Installation"

Turn the vm off and on a few times then check /run/libvirt/qemu/swtpm:

# sudo ls -la /run/libvirt/qemu/swtpm

In the original version multiple pid files will show up, e.g.

drwxrwx--- 2 libvirt-qemu swtpm 80 Nov 17 13:34 .
drwxr-xr-x 5 root root 180 Nov 17 13:34 ..
-rw-r--r-- 1 root root 5 Nov 17 12:57 1-win11-swtpm.pid
-rw-r--r-- 1 root root 5 Nov 17 13:34 2-win11-swtpm.pid

With the fix only one pid file will show up per running TPM virtual machine and the folder will be empty if there are none.

[Where problems could occur]

This fix modifies the qemu_tpm stop function, which is triggered when a vm completes shutdown. So any issues that arise from this fix would happen at this point. Most likely, when an issue shows up it would be related to file system manipulation in the /run/libvirt/qemu/swtpm directory.

[Other Info]

Fix added to lunar in version 8.6.0-0ubuntu4

[Original Description]

As a spinoff of LP: #1989100, we found that swtpm pid files were not being removed after shutting down a vm in Kinetic. Listing the directory /run/libvirt/qemu/swtpm after a few vm restarts shows all old pid files are still there:

$ sudo ls -la /run/libvirt/qemu/swtpm

drwxrwx--- 2 libvirt-qemu swtpm 80 Nov 17 13:34 .
drwxr-xr-x 5 root root 180 Nov 17 13:34 ..
-rw-r--r-- 1 root root 5 Nov 17 12:57 1-win11-swtpm.pid
-rw-r--r-- 1 root root 5 Nov 17 13:34 2-win11-swtpm.pid
...
srw------- 1 libvirt-qemu kvm 0 Nov 17 16:20 5-win11-swtpm.sock

[Christian Ehrhardt  (paelzer)]

Already uploaded to Lunar-proposed.
Now tests and review is complete for SRUs as well so I uploaded it to K -unapproved too.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 8.6.0-0ubuntu5

---------------
libvirt (8.6.0-0ubuntu5) lunar; urgency=medium

  * d/p/u/tests-Fix-libxlxml2domconfigtest-with-latest-xen.patch: fix FTBFS
    with latest libxl

libvirt (8.6.0-0ubuntu4) lunar; urgency=medium

  [ Lena Voytek ]
  * d/p/u/fix-swtpm-pid-duplication.patch: Clean up swtpm pids after a vm
    shuts down (LP: #1997269)

  [Christian Ehrhardt ]
  * d/p/u/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch: prevent
    apparmor denials on USB forwarding (LP: #1993304)
  * d/p/u/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch:
    tolerate the impact of too large udev data avoiding a busy loop
    (LP: #1996176)

 -- Christian Ehrhardt <email address hidden> Tue, 22 Nov 2022 16:13:36 +0100

[Brian Murray (brian-murray)]

Hello Lena, or anyone else affected,

Accepted libvirt into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libvirt/8.6.0-0ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lena Voytek (lvoytek)]

Verified with the following on Kinetic

$ sudo su
# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF
# exit
$ sudo apt update && sudo apt upgrade -y
$ sudo apt install swtpm virt-manager

Created a Windows 11 vm with TPM 2.0, then started and stopped it several times

$ sudo ls -la /run/libvirt/qemu/swtpm
total 0
drwxrwx--- 2 libvirt-qemu swtpm 40 Dec 5 14:30 .
drwxr-xr-x 5 root root 140 Dec 5 14:30 ..

All files were removed properly after shutdown

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 8.6.0-0ubuntu3.1

---------------
libvirt (8.6.0-0ubuntu3.1) kinetic; urgency=medium

  [ Lena Voytek ]
  * d/p/u/fix-swtpm-pid-duplication.patch: Clean up swtpm pids after a vm
    shuts down (LP: #1997269)

  [Christian Ehrhardt ]
  * d/p/u/lp-1993304-apparmor-allow-getattr-on-usb-devices.patch: prevent
    apparmor denials on USB forwarding (LP: #1993304)
  * d/p/u/lp-1996176-nodedev-ignore-EINVAL-from-libudev-in-udevEventHandl.patch:
    tolerate the impact of too large udev data avoiding a busy loop
    (LP: #1996176)

 -- Christian Ehrhardt <email address hidden> Tue, 22 Nov 2022 11:21:30 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for libvirt has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.