[SRU] Add support for DCONF usb settings

[Denison Barbosa]

[Impact]

adsys does not have support for some USB settings in DCONF

[Test Plan]

1. Configure the administrative templates in the AD server:
  - The templates can be generated through adsys with `adsysctl policy admx all`

2. Configure a GPO that applies the new DCONF USB settings, they are located at:
  - {GPO}->User Config.->Policies->Admin. Templates->Ubuntu->Desktop->Shell->
    - LockDown->Mount removable storage devices as read-only
    - Privacy->Whether to protect USB devices
    - Privacy->When USB devices should be rejected

3. Login with an AD user to which the configured GPO should be applied

4. Ensure the DCONF keys are configured as expected.

[Where Problems Could Occur]

This only affects the generation of the XML files that will be deployed on the Windows AD server to allow for the DCONF keys to be configured, it has no impact on Ubuntu.

------------------------------------

[Original Description]

Adds support for some DCONF usb related settings: Allows for usbguard configuration and mounting removable media as read-only.

SRU placeholder for fix: https://github.com/ubuntu/adsys/pull/1096

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.15.2

---------------
adsys (0.15.2) oracular; urgency=medium

  [ Davi Henrique ]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [ Felipe Alencastro ]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Wed, 25 Sep 2024 08:06:40 -0400

[Andreas Hasenack (ahasenack)]

a) What happens if an older adsys receives a policy that sets these new dconf usb settings? Will it be ignored, will it crash, or something else? I think this should be part of the test plan, or if automated tests check for this scenario, then just add a note stating so.

The two other comments I have are not specific to any of the 3 bugs this upload is fixing, but about the upload in general:

b) There is a tmp directory in the diff that looks like it's a build or test artifact, and it is not present in the package currently in updates:

 tmp/cMKE91wkKA/adsys-0.14.2~22.04/tmp/21kxRXRjme/adsys-0.14.2~22.04/tmp/IOVgtSyoq1/adsys-0.15.1/docs/reference/policies/User Policies/Ubuntu/Desktop/Shell/LockDown/mount-removable-storage-devices-as-read-only.md
 tmp/cMKE91wkKA/adsys-0.14.2~22.04/tmp/21kxRXRjme/adsys-0.14.2~22.04/tmp/IOVgtSyoq1/adsys-0.15.1/docs/reference/policies/User Policies/Ubuntu/Desktop/Shell/Privacy/usb-protection-level.md
 tmp/cMKE91wkKA/adsys-0.14.2~22.04/tmp/21kxRXRjme/adsys-0.14.2~22.04/tmp/IOVgtSyoq1/adsys-0.15.1/docs/reference/policies/User Policies/Ubuntu/Desktop/Shell/Privacy/usb-protection.md

It does not look like it should be part of the upload, but let me know if I'm wrong.

c) It needs rebasing, because while this upload was waiting in the unapproved queue, a security update happened:

https://launchpad.net/ubuntu/+source/adsys/0.14.2~24.04ubuntu0.1

adsys (0.14.2~24.04ubuntu0.1) noble-security; urgency=medium

  * No change rebuild due to golang-1.22 update

 -- Evan Caville <email address hidden> Mon, 11 Nov 2024 10:15:58 +1000

That is a no-change rebuild, so we would not lose the security fix in this upload here, but given (b), plus that it's nice to preserve changelog history and this is not a backport from later releases, I think this should be fixed as well.

Given how long this was in the unapproved queue without anyone noticing/looking, please feel free to ping me directly anytime during my working hours when there is an update here, and I will do a review.

[Andreas Hasenack (ahasenack)]

Thanks for the new upload, it addresses (b) and (c). Do you have an update on (a)?

[Denison Barbosa (justdenis)]

Hey, Andreas! Thanks for the quick follow-up!

Regarding the (a) question:

Since DCONF is (in a short way) a register of key:value pairs, what matters is how other applications interact with it. If a key is added there but not used by any process or aplication, it does not affect the system at all.

TLDR: It will be ignored ;)

[Andreas Hasenack (ahasenack)]

Hello Denison, or anyone else affected,

Accepted adsys into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/adsys/0.14.3~24.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Denison, or anyone else affected,

Accepted adsys into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/adsys/0.14.3~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Denison Barbosa (justdenis)]

The test plan was executed for Noble (24.04) and I confirm it was successful. The package version used for the tests is the one proposed, as can be seen by the output of apt-cache policy:
adsys:
  Installed: 0.14.3~24.04
  Candidate: 0.14.3~24.04
  Version table:
 *** 0.14.3~24.04 100
        100 http://archive.ubuntu.com/ubuntu noble-proposed/main amd64 Packages

The following steps were executed:

1) Create a fresh VM with Ubuntu 24.04;
2) Join an active directory domain (created for test purposes);
3) Install adsys;
4) On the AD server, create a GPO that configures the new DCONF USB-related keys;
5) Authenticate on Ubuntu with an AD user which the GPO applies to;

After step 5, the policy is applied successfully and DCONF has the keys that were configured in the GPO.

[Denison Barbosa (justdenis)]

The test plan was executed for Jammy (22.04) and I confirm it was successful. The package version used for the tests is the one proposed, as can be seen by the output of apt-cache policy:
adsys:
  Installed: 0.14.3~22.04
  Candidate: 0.14.3~22.04
  Version table:
 *** 0.14.3~22.04 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages

The following steps were executed:

1) Create a fresh VM with Ubuntu 22.04;
2) Join an active directory domain (created for test purposes);
3) Install adsys;
4) On the AD server, create a GPO that configures the new DCONF USB-related keys;
5) Authenticate on Ubuntu with an AD user which the GPO applies to;

After step 5, the policy is applied successfully and DCONF has the keys that were configured in the GPO.

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for adsys has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.14.3~24.04

---------------
adsys (0.14.3~24.04) noble; urgency=medium

  [Davi Henrique]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [Felipe Alencastro]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Tue, 19 Nov 2024 06:28:25 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package adsys - 0.14.3~22.04

---------------
adsys (0.14.3~22.04) jammy; urgency=medium

  [Davi Henrique]
  * Ignore casing when fetching Registry.pol (LP: #2080390)
  * Add configurable timeout for listing GPOs (LP: #2081966)

  [Felipe Alencastro]
  * Add support for DCONF usb settings (LP: #2081968)

 -- Denison Barbosa <email address hidden> Tue, 19 Nov 2024 06:38:20 -0400