Allow non-owned lockfile writes in /var/lib/libvirt/swtpm/
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
swtpm (Ubuntu) | Status tracked in Oracular | |||||
Jammy |
Fix Committed
|
Undecided
|
Lena Voytek | |||
Mantic |
Won't Fix
|
Undecided
|
Lena Voytek | |||
Noble |
Fix Committed
|
Undecided
|
Lena Voytek | |||
Oracular |
Fix Released
|
Undecided
|
Lena Voytek |
Bug Description
[Impact]
The default apparmor profile for swtpm blocks access to libvirt TPM2 NVRAM state lockfiles. This causes denials for users who want to view TPM states via swtpm's socket API.
The fix for this should be backported so print-states for libvirt TPM works for users by default.
The issue is fixed by adding non-owner write permissions to the /var/lib/
[Test Plan]
$ sudo apt update && sudo apt dist-upgrade -y
$ sudo apt install swtpm virt-manager apparmor -y
# Create a vm with virt-manager that uses a TPM2 device and start it
# A directory will show up in /var/lib/
# /var/lib/
# Before fix
$ sudo swtpm socket --print-states --tpmstate dir=/var/
swtpm: SWTPM_NVRAM_
# After fix
$ sudo swtpm socket --print-states --tpmstate dir=/var/
{ "type": "swtpm", "states": [] }
[Where problems could occur]
This change will provide swtpm greater access to /var/lib/
Likewise, with a change to the apparmor profile, a conflict will occur on update for users that modified their profile directly.
[Other Info]
The issue was fixed in oracular in 0.7.3-0ubuntu7.
[Original Description]
Based on the upstream comment here - https:/
Related branches
- git-ubuntu bot: Approve
- Bryce Harrington (community): Approve
- Canonical Server Reporter: Pending requested
-
Diff: 38 lines (+12/-0)2 files modifieddebian/changelog (+10/-0)
debian/usr.bin.swtpm (+2/-0)
- git-ubuntu bot: Approve
- Bryce Harrington (community): Approve
- Canonical Server Reporter: Pending requested
-
Diff: 38 lines (+12/-0)2 files modifieddebian/changelog (+10/-0)
debian/usr.bin.swtpm (+2/-0)
- git-ubuntu bot: Approve
- Bryce Harrington (community): Approve
- Canonical Server Reporter: Pending requested
-
Diff: 38 lines (+12/-0)2 files modifieddebian/changelog (+10/-0)
debian/usr.bin.swtpm (+2/-0)
Changed in swtpm (Ubuntu Jammy): | |
assignee: | nobody → Lena Voytek (lvoytek) |
Changed in swtpm (Ubuntu Mantic): | |
assignee: | nobody → Lena Voytek (lvoytek) |
Changed in swtpm (Ubuntu Noble): | |
assignee: | nobody → Lena Voytek (lvoytek) |
Changed in swtpm (Ubuntu Oracular): | |
assignee: | nobody → Lena Voytek (lvoytek) |
status: | New → In Progress |
Changed in swtpm (Ubuntu Jammy): | |
status: | New → In Progress |
Changed in swtpm (Ubuntu Mantic): | |
status: | New → In Progress |
Changed in swtpm (Ubuntu Noble): | |
status: | New → In Progress |
description: | updated |
This bug was fixed in the package swtpm - 0.7.3-0ubuntu7
---------------
swtpm (0.7.3-0ubuntu7) oracular; urgency=medium
* d/usr.bin.swtpm: libvirt/ swtpm/ to fix
- Add sys_admin capability to apparmor profile to allow access to kernel
modules such as tpm_vtpm_proxy (LP: #2071478)
- Allow non-owned lockfile write access in /var/lib/
apparmor denials when working with TPM2 locks (LP: #2072524)
-- Lena Voytek <email address hidden> Tue, 09 Jul 2024 06:06:00 -0700