Focal 5.15 kernel apparmor mismatch missing snap_validate_preseed functionality in livecd-rootfs

[John Chittum]

kernel bug

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2045384

introduced an apparmor change to the 5.15. This rolled down to the Focal HWE 5.15 kernel, causing failures to properly snap seed

The original functionality was added into ubuntu/master and ubuntu/jammy with this bug:

https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2015596

which happened during the HWE roll to the 5.19 kernel. There was an assumption that a breaking change like this would not affect Focal, as rolls were done. However, 2045384 shows that this is not necessarily true.

To fix 2045384, a backport to focal of the functionality in snap_validate_seed allowing matching on kernel version, and the creation of kernel specific directories is required

[ Impact ]

Boot will be slowed by ~200ms until this is resolved in livecd-rootfs

[ Test Plan ]

 * for focal build any cloud image with preseeded snaps with HWE 5.15 kernel
 * boot
 * run `snap debug seeding`
 * assert the test described above passes

[ Where problems could occur ]

 * Similar patches already exist for later releases 6.2, 6.5 kernel etc. and have been used on other private customer kernels and all kernels released after 22.04, so there is already a good track record for this patchset and it shouldn't create any issues.

[ Other Info ]

 * This is a time-sensitive issue for a paying customer

[Catherine Redfield (catred)]

Patch for updating the changelog to cover the added function as well as the new apparmor directory

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "LP2059730.patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Philip Roche (philroche)]

MP with catred's proposed changes @ https://code.launchpad.net/~philroche/livecd-rootfs/+git/livecd-rootfs/+merge/463488

[Philip Roche (philroche)]

Focal livecd-rootfs `2.664.53` with these proposed changes now in upload queue https://launchpad.net/ubuntu/focal/+queue?queue_state=1&queue_text=livecd-rootfs

[Timo Aaltonen (tjaalton)]

Hello John, or anyone else affected,

Accepted livecd-rootfs into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.664.53 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Philip Roche (philroche)]

Verified Focal:

This exact proposed version of livecd-rootfs has been used in cloud image build for many weeks now and has met all of the steps listed in the test plan.

GCE daily minimal image daily-ubuntu-minimal-2004-focal-v20240405`` being one such image with snaps and built using this version of livecd-rootfs.

Steps:

1. Launch `daily-ubuntu-minimal-2004-focal-v20240405` from project `ubuntu-os-cloud-devel` in GCE

```
gcloud compute instances create $(petname) --zone=europe-west1-d --image=daily-ubuntu-minimal-2004-focal-v20240405 --image-project=ubuntu-os-cloud-devel
```

4. logged in and ran `sudo snap debug seeding`

```
ubuntu@usable-mullet:~$ sudo snap debug seeding
seeded: true
preseeded: true
image-preseeding: 5.744s
seed-completion: 3.278s
```

5. and just to double check, yes there are snaps

```
ubuntu@usable-mullet:~$ snap list
Name Version Rev Tracking Publisher Notes
core20 20240111 2182 latest/stable canonical✓ base
google-cloud-cli 471.0.0 229 latest/stable/… google-cloud-sdk✓ classic
snapd 2.61.2 21184 latest/stable canonical✓ snapd
```