AppArmor profiles missing for jammy and 6.8 kernel

[Tomáš Virtus]

A CPC test build of a jammy image with 6.8 edge kernel revealed that AppArmor profiles are missing for 6.8 kernel in livecd-rootfs, leading to fall back to generic AppArmor profiles which don't contain configuration for io_uring. This leads to `snap debug seeding` output non-empty `seed-restart-system-key` dict (attached in snap-debug-seeding.json) after first boot.

[ Impact ]

Boot will be slowed by ~200ms until this is resolved in livecd-rootfs

[ Test Plan ]
* Build a jammy cloud image with preseeded snaps with the 6.8 edge kernel
* Boot an instance
* Invoke "snap debug seeding"
* Ensure the output does not include "seed-restart-system-key", if it does the difference between "preseed-system-key" and "apparmor-features"/"apparmor-parser-features" is other than "io_uring"

[ Where problems could occur ]
* If the attempted fix has problems "snap debug seeding" should continue to report "seed-restart-system-key". There should not be any other fallout.

[ Other Info ]

Public cloud images block image publication on a test ensuring that snaps are preseeded. As a result this will block jammy image publication once the edge kernel becomes the HWE kernel.

[Andreas Hasenack (ahasenack)]

This is ready to accept, but launchpad hasn't processed the jammy release of 2.765.45 yet and still thinks it's in proposed.

[Timo Aaltonen (tjaalton)]

Hello Tomáš, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.765.46 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted livecd-rootfs (2.765.46) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

livecd-rootfs/2.765.46 (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#livecd-rootfs

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ankush Pathak (ankushpathak)]

I have tested the package in proposed. The test was done by building a GCE image with the linux-gcp-edge kernel using livecd-rootfs from proposed. Confirmed the following:

```
$ uname -r
6.8.0-1012-gcp
$ snap debug seeding
seeded: true
preseeded: true
image-preseeding: 12.545s
seed-completion: 11.164s
```

Hence, updating tags to verification-done.

Thanks,
Ankush

[Ankush Pathak (ankushpathak)]

@utkarsh mentioned he was looking into the s390x autopkgtest failure.

[Utkarsh Gupta (utkarsh)]

It's so weird. Autopkgtest on s390x fails because it can't open http://people.canonical.com/~ubuntu-archive/seeds/ubuntu.jammy/STRUCTURE, apparently!?

I've retriggered but it fails consistently. Can't seem to figure out what's wrong. :o

[Steve Langasek (vorlon)]

> It's so weird. Autopkgtest on s390x fails because it can't open
> http://people.canonical.com/~ubuntu-archive/seeds/ubuntu.jammy/STRUCTURE, apparently!?

This looks like a firewall problem on the s390x autopkgtest runners.

I see that you did a baseline retest with migration-reference/0 and that one landed on a runner in the bos01 region: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/l/livecd-rootfs/20240812_102717_e29f6@/log.gz

The failures appear to be in the bos03 region: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy/jammy/s390x/l/livecd-rootfs/20240812_201708_d80bd@/log.gz

[Utkarsh Gupta (utkarsh)]

No more blockers anymore, this is good to go!

[Launchpad Janitor (janitor)]

This bug was fixed in the package livecd-rootfs - 2.765.46

---------------
livecd-rootfs (2.765.46) jammy; urgency=medium

  * Add 6.8 kernel apparmor features' preseeds. (LP: #2074204)

 -- Ankush Pathak <email address hidden> Fri, 26 Jul 2024 19:59:25 +0530

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for livecd-rootfs has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.