Enable /dev/sgx_vepc access for the group 'sgx'

[Pedro Principeza]

[ Impact ]

On systems where Intel SGX is available, access to a specific device node (/dev/sgx_vepc) must be enforced, with a specific permission (0660) and group (sgx).

This allows KVM-based virtual machines to use such feature (the SGX "enclaves") in a proper fashion. Without this, a manual udev rule needs to be created.

[ Test Plan ]

As the patch itself only tailors the permissions/group to the device node, in a system with Intel-SGX enabled, merely `ls -la` against the device node should show if the permissions and group are seen as expected.

[ Where problems could occur ]

N/A. This seems to be a very straightforward inclusion, very specific to access enablement to the SGX reserved memory used for hosting enclaves.

[ Other Info ]

N/A.

[Pedro Principeza (pprincipeza)]

Patch in question in Upstream is here [0].

[0] https://github.com/systemd/systemd/commit/b5d3138f9177bbc3505f42ba073d08d4f90b4888

[Nick Rosbrook (enr0n)]

This udev rule is present in Kinetic and newer.

[Steve Langasek (vorlon)]

Hello Pedro, or anyone else affected,

Accepted systemd into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/systemd/249.11-0ubuntu3.8 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[William Wilson (jawn-smith)]

The verification passed for jammy:

```
william@william-Latitude-E7470  ~  apt-cache policy udev
udev:
  Installed: 249.11-0ubuntu3.7
  Candidate: 249.11-0ubuntu3.8
  Version table:
 *** 249.11-0ubuntu3.8 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     249.11-0ubuntu3.7 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
     249.11-0ubuntu3 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
 william@william-Latitude-E7470  ~  ls -al /dev/sgx_vepc
crw------- 1 root root 10, 125 Mar 14 14:01 /dev/sgx_vepc
william@william-Latitude-E7470  ~  apt-cache policy udev
udev:
  Installed: 249.11-0ubuntu3.8
  Candidate: 249.11-0ubuntu3.8
  Version table:
 *** 249.11-0ubuntu3.8 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     249.11-0ubuntu3.7 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
     249.11-0ubuntu3 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
 william@william-Latitude-E7470  ~  ls -al /dev/sgx_vepc
crw-rw---- 1 root sgx 10, 125 Mar 14 14:01 /dev/sgx_vepc
```

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted systemd (249.11-0ubuntu3.8) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

linux-intel-iotg/5.15.0-1027.32 (amd64)
linux-lowlatency/5.15.0-68.75 (arm64, amd64)
systemd/249.11-0ubuntu3.8 (arm64, ppc64el)
openrazer/3.2.0+dfsg-3 (i386)
multipath-tools/0.8.8-1ubuntu1.22.04.1 (s390x)
netplan.io/0.105-0ubuntu2~22.04.1 (amd64)
fwupd/1.7.9-1~22.04.1 (armhf)
udisks2/2.9.4-1ubuntu2 (amd64)
zfs-linux/unknown (s390x)
dbus/1.12.20-2ubuntu4.1 (s390x)
linux-ibm/5.15.0-1027.30 (amd64)
samba/unknown (s390x)
tang/11-1 (arm64)
gvfs/1.48.2-0ubuntu1 (arm64)
php8.1/unknown (s390x)
linux-nvidia/5.15.0-1018.18 (amd64)
csync2/2.0-25-gc0faaf9-1 (s390x)
tinyssh/20190101-1ubuntu1 (s390x)
mosquitto/2.0.11-1ubuntu1 (amd64)
casync/2+20201210-1build1 (ppc64el)
linux-gke/5.15.0-1029.34 (arm64, amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#systemd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Timo Aaltonen (tjaalton)]

Hello Pedro, or anyone else affected,

Accepted systemd into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/systemd/249.11-0ubuntu3.9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[William Wilson (jawn-smith)]

The verification passed for jammy:

william@william-Latitude-E7470  ~  apt-cache policy udev
udev:
  Installed: 249.11-0ubuntu3.7
  Candidate: 249.11-0ubuntu3.9
  Version table:
     249.11-0ubuntu3.9 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
 *** 249.11-0ubuntu3.7 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
        100 /var/lib/dpkg/status
     249.11-0ubuntu3 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
 william@william-Latitude-E7470  ~  ls -l /dev/sgx_vepc
crw------- 1 root root 10, 125 Mar 24 12:42 /dev/sgx_vepc
william@william-Latitude-E7470  ~  apt-cache policy udev
udev:
  Installed: 249.11-0ubuntu3.9
  Candidate: 249.11-0ubuntu3.9
  Version table:
 *** 249.11-0ubuntu3.9 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     249.11-0ubuntu3.7 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
     249.11-0ubuntu3 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
 william@william-Latitude-E7470  ~  ls -l /dev/sgx_vepc
crw-rw---- 1 root sgx 10, 125 Mar 24 12:48 /dev/sgx_vepc
 william@william-Latitude-E7470  ~ 

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted systemd (249.11-0ubuntu3.9) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

casync/2+20201210-1build1 (ppc64el)
dpdk/21.11.3-0ubuntu0.22.04.1 (arm64)
fwupd/1.7.9-1~22.04.1 (armhf)
init-system-helpers/unknown (s390x)
initramfs-tools/0.140ubuntu13.1 (amd64)
libsdl2/2.0.20+dfsg-2ubuntu1.22.04.1 (s390x)
libsoup3/3.0.7-0ubuntu1 (s390x)
libvirt/8.0.0-1ubuntu7.4 (s390x)
linux-lowlatency-hwe-5.19/5.19.0-1021.22~22.04.1 (amd64, arm64)
linux-nvidia/5.15.0-1018.18 (amd64)
mutter/42.5-0ubuntu1 (amd64)
netplan.io/0.105-0ubuntu2~22.04.3 (arm64, s390x)
network-manager/1.36.6-0ubuntu2 (s390x)
nextepc/unknown (s390x)
open-iscsi/2.1.5-1ubuntu1 (s390x)
openrazer/3.2.0+dfsg-3 (i386)
pdns-recursor/unknown (s390x)
postgresql-14/unknown (s390x)
pystemd/0.7.0-5build1 (s390x)
samba/unknown (s390x)
strongswan/unknown (s390x)
systemd/249.11-0ubuntu3.9 (s390x)
umockdev/0.17.7-1 (s390x)
zfs-linux/unknown (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#systemd

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 249.11-0ubuntu3.9

---------------
systemd (249.11-0ubuntu3.9) jammy; urgency=medium

  * udev: gracefully handle rename failures (LP: #2002445)
    Files:
    - debian/patches/lp2002445/core-device-ignore-failed-uevents.patch
    - debian/patches/lp2002445/sd-device-introduce-device_get_property_int.patch
    - debian/patches/lp2002445/sd-device-make-device_set_syspath-clear-sysname-and-sysnu.patch
    - debian/patches/lp2002445/udev-restore-syspath-and-properties-on-failure.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=a7ad4a9fc708500c61e3b8127f112d8c90049b2c

systemd (249.11-0ubuntu3.8) jammy; urgency=medium

  * network/dhcp4: accept local subnet routes from DHCP (LP: #2004478)
    File: debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=96928d5f45ebbfe682b47e842d63506fa0ac9583
  * udev: avoid NIC renaming race with kernel (LP: #2002445)
    Files:
    - debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
    - debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
    - debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
    - debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
    - debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=20dc4d51a340669c26c446c23b5a84516e82ea74
  * network: create stacked netdevs after the underlying link is (LP: #2000880)
    File: debian/patches/lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=ab620e709f3f62eda86af26fd66c00d6e5165a25
  * Enable /dev/sgx_vepc access for the group 'sgx' (LP: #2009502)
    File: debian/patches/lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=434480ae4059a16ccbde9613be0c26ff1983cc3a

 -- Nick Rosbrook <email address hidden> Mon, 20 Mar 2023 10:32:08 -0400

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for systemd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.