Confine wsdd with apparmor

[Alessandro Astone]

Limit resource access to increase security.

The apparmor profile needs to allow network access (ipv4 and ipv6), and r/w access to at least $XDG_RUNTIME_DIR

[Alessandro Astone (aleasto)]

Sorry, rebased patch on ubuntu/devel

[Paride Legovini (paride)]

Hi, I see you recently contributed to src:wsdd on the Debian packaging side, and the package is currently a sync. Do you plan to upstream these changes to Debian and take care of the sync once those hopefully land?

[Alessandro Astone (aleasto)]

Yes, I am upstreaming all changes to debian as well, but using ubuntu for a first review since these changes interest us the most: https://bugs.launchpad.net/ubuntu/+source/wsdd/+bug/2070025

[Alessandro Astone (aleasto)]

Debian change: https://salsa.debian.org/grantma/wsdd/-/merge_requests/6

[Vladimir Petko (vpa1977)]

wsdd 2:0.8-2ubuntu1 seems to be failing discovery autopkgtest due to the introduced restrictions.
The previous version passed the test.
Would it be possible to look into the issue[1]?

[1] https://objectstorage.prodstack5.canonical.com/swift/v1/AUTH_0f9aae918d5b4744bf7b827671c86842/autopkgtest-oracular/oracular/amd64/w/wsdd/20240718_131717_fcb99@/log.gz

[Alessandro Astone (aleasto)]

Oops! We actually added a new autopkgtest and the new apparmor profile in a single upload, but apparently I never tested the two in combination; sorry!

Attaching a fix (that also includes other minor changes addressing a late review @ https://bugs.launchpad.net/ubuntu/+source/wsdd/+bug/2071453/comments/9 )

I've also built this version in my ppa; once it's published you can verify that this solves the issue by triggering https://autopkgtest.ubuntu.com/request.cgi?release=oracular&package=wsdd&arch=amd64&trigger=wsdd%2F2%3A0.8-2ubuntu2~ppa1&ppa=aleasto%2Ftests

[Alessandro Astone (aleasto)]

Found more differences between a local cloud vm and ubuntu infra...
Verified this works from ppa: https://autopkgtest.ubuntu.com/results/autopkgtest-oracular-aleasto-tests/oracular/amd64/w/wsdd/20240723_070819_f0714@/log.gz

[Launchpad Janitor (janitor)]

This bug was fixed in the package wsdd - 2:0.8-2ubuntu3

---------------
wsdd (2:0.8-2ubuntu3) oracular; urgency=medium

  * Set XDG_RUNTIME_DIR in autopkgtest

 -- Alessandro Astone <email address hidden> Tue, 23 Jul 2024 09:21:36 +0200