AppArmor profiles missing for jammy and 6.8 kernel
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
livecd-rootfs (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Jammy |
Fix Released
|
Undecided
|
Ankush Pathak |
Bug Description
A CPC test build of a jammy image with 6.8 edge kernel revealed that AppArmor profiles are missing for 6.8 kernel in livecd-rootfs, leading to fall back to generic AppArmor profiles which don't contain configuration for io_uring. This leads to `snap debug seeding` output non-empty `seed-restart-
[ Impact ]
Boot will be slowed by ~200ms until this is resolved in livecd-rootfs
[ Test Plan ]
* Build a jammy cloud image with preseeded snaps with the 6.8 edge kernel
* Boot an instance
* Invoke "snap debug seeding"
* Ensure the output does not include "seed-restart-
[ Where problems could occur ]
* If the attempted fix has problems "snap debug seeding" should continue to report "seed-restart-
[ Other Info ]
Public cloud images block image publication on a test ensuring that snaps are preseeded. As a result this will block jammy image publication once the edge kernel becomes the HWE kernel.
Related branches
- Utkarsh Gupta: Approve
- Tomáš Virtus (community): Approve
- Gauthier Jolly (community): Approve
- Chloé Smith (community): Approve
- Canonical Foundations Team: Pending requested
-
Diff: 259 lines (+6/-0)50 files modifieddebian/changelog (+6/-0)
live-build/apparmor/6.8/capability (+0/-0)
live-build/apparmor/6.8/caps/extended (+0/-0)
live-build/apparmor/6.8/caps/mask (+0/-0)
live-build/apparmor/6.8/dbus/mask (+0/-0)
live-build/apparmor/6.8/domain/attach_conditions/xattr (+0/-0)
live-build/apparmor/6.8/domain/change_hat (+0/-0)
live-build/apparmor/6.8/domain/change_hatv (+0/-0)
live-build/apparmor/6.8/domain/change_onexec (+0/-0)
live-build/apparmor/6.8/domain/change_profile (+0/-0)
live-build/apparmor/6.8/domain/computed_longest_left (+0/-0)
live-build/apparmor/6.8/domain/disconnected.path (+0/-0)
live-build/apparmor/6.8/domain/fix_binfmt_elf_mmap (+0/-0)
live-build/apparmor/6.8/domain/interruptible (+0/-0)
live-build/apparmor/6.8/domain/kill.signal (+0/-0)
live-build/apparmor/6.8/domain/post_nnp_subset (+0/-0)
live-build/apparmor/6.8/domain/stack (+0/-0)
live-build/apparmor/6.8/domain/unconfined_allowed_children (+0/-0)
live-build/apparmor/6.8/domain/version (+0/-0)
live-build/apparmor/6.8/file/mask (+0/-0)
live-build/apparmor/6.8/io_uring/mask (+0/-0)
live-build/apparmor/6.8/ipc/posix_mqueue (+0/-0)
live-build/apparmor/6.8/mount/mask (+0/-0)
live-build/apparmor/6.8/mount/move_mount (+0/-0)
live-build/apparmor/6.8/namespaces/mask (+0/-0)
live-build/apparmor/6.8/namespaces/pivot_root (+0/-0)
live-build/apparmor/6.8/namespaces/profile (+0/-0)
live-build/apparmor/6.8/namespaces/userns_create (+0/-0)
live-build/apparmor/6.8/network/af_mask (+0/-0)
live-build/apparmor/6.8/network/af_unix (+0/-0)
live-build/apparmor/6.8/network_v8/af_inet (+0/-0)
live-build/apparmor/6.8/network_v8/af_mask (+0/-0)
live-build/apparmor/6.8/policy/outofband (+0/-0)
live-build/apparmor/6.8/policy/permstable32 (+0/-0)
live-build/apparmor/6.8/policy/permstable32_version (+0/-0)
live-build/apparmor/6.8/policy/set_load (+0/-0)
live-build/apparmor/6.8/policy/unconfined_restrictions/change_profile (+0/-0)
live-build/apparmor/6.8/policy/unconfined_restrictions/io_uring (+0/-0)
live-build/apparmor/6.8/policy/unconfined_restrictions/userns (+0/-0)
live-build/apparmor/6.8/policy/versions/v5 (+0/-0)
live-build/apparmor/6.8/policy/versions/v6 (+0/-0)
live-build/apparmor/6.8/policy/versions/v7 (+0/-0)
live-build/apparmor/6.8/policy/versions/v8 (+0/-0)
live-build/apparmor/6.8/policy/versions/v9 (+0/-0)
live-build/apparmor/6.8/ptrace/mask (+0/-0)
live-build/apparmor/6.8/query/label/data (+0/-0)
live-build/apparmor/6.8/query/label/multi_transaction (+0/-0)
live-build/apparmor/6.8/query/label/perms (+0/-0)
live-build/apparmor/6.8/rlimit/mask (+0/-0)
live-build/apparmor/6.8/signal/mask (+0/-0)
description: | updated |
Changed in livecd-rootfs (Ubuntu): | |
status: | New → Fix Released |
Changed in livecd-rootfs (Ubuntu Jammy): | |
status: | New → In Progress |
assignee: | nobody → Ankush Pathak (ankushpathak) |
This is ready to accept, but launchpad hasn't processed the jammy release of 2.765.45 yet and still thinks it's in proposed.