AppArmor profile policy `unconfined_restrictions` missing for jammy and mantic 6.5 kernel

[Ankush Pathak]

A CPC snap preseeding test failure on arm64 is blocking image pulication.
A recent update, specifically 6.5.0.1017.17~22.04.1, to the jammy 6.5 kernel introduced a new AppArmor profile `unconfined_restrictions`. This is not reflected in the snap preseeding code and needs to be updated.

[ Impact ]

Boot will be slowed by ~200ms until this is resolved in livecd-rootfs

[ Test Plan ]
* Build a jammy and mantic cloud image with preseeded snaps with the 6.5.0 1017+ kernel
* Boot an instance
* Invoke "snap debug seeding"
* Ensure the output does not include "seed-restart-system-key", if it does the difference between "preseed-system-key" and "apparmor-features"/"apparmor-parser-features" is other than "policy:unconfined_restrictions"

[ Where problems could occur ]
* If the attempted fix has problems "snap debug seeding" should continue to report "seed-restart-system-key". There should not be any other fallout.

[ Other Info ]
Public cloud images block image publication on a test ensuring that snaps are preseeded. As a result this bug is blocking jammy and mantic image publication.

[Ankush Pathak (ankushpathak)]

This bug also affects the mantic 6.5 kernel.

[Philip Roche (philroche)]

Mantic livecd-rootfs 23.10.60 has now been uploaded to SRU queue @ https://launchpad.net/ubuntu/mantic/+queue?queue_state=1&queue_text=livecd-rootfs

[Philip Roche (philroche)]

Jammy livecd-rootfs 2.765.42 has now been uploaded to SRU queue @ https://launchpad.net/ubuntu/jammy/+queue?queue_state=1&queue_text=livecd-rootfs

[Robie Basak (racb)]

Based on the discussion in #ubuntu-release earlier, I think you want the current livecd-rootfs in mantic-proposed to be released first, and therefore the upload for this SRU is blocked on that?

[Philip Roche (philroche)]

I have marked Oracular "Invalid" as this is specific to the 6.5 which is not available in oracular

[Ankush Pathak (ankushpathak)]

@racb RE comment #4
As far as I understand the only reason the jammy approval should block on mantic approval is that the approvals must happen in the order of releases with later release being before an older release.

[Andreas Hasenack (ahasenack)]

I released the mantic-proposed upload that Robie was talking about in comment #4, after having asked Phil on IRC[1].

1. https://irclogs.ubuntu.com/2024/06/27/%23ubuntu-devel.html#t16:04

[Andreas Hasenack (ahasenack)]

Hello Ankush, or anyone else affected,

Accepted livecd-rootfs into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/23.10.60 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Ankush, or anyone else affected,

Accepted livecd-rootfs into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.765.44 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ankush Pathak (ankushpathak)]

Hello Andreas,

The CPC jammy and mantic fork of livecd-rootfs have been patched with the fix for this bug since 30 April 2024. Since then CPC have built and tested several images with the patched CPC livecd-rootfs fork.
As a part of our testing we run an automated test that follows the steps listed in the test plan for this bug.
Based on this I am marking the bug as verfied.

Thanks,
Ankush

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for livecd-rootfs has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package livecd-rootfs - 23.10.60

---------------
livecd-rootfs (23.10.60) mantic; urgency=medium

  [ Ankush Pathak ]
  * Add policy:unconfined_restrictions feature to 6.5 kernel (LP: #2062929)

 -- Philip Roche <email address hidden> Wed, 22 May 2024 11:55:15 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package livecd-rootfs - 2.765.44

---------------
livecd-rootfs (2.765.44) jammy; urgency=medium

  [ Rémy Martin ]
  * Backport support for building tegra-igx Server and Core images;
    LP: #2070070.

livecd-rootfs (2.765.43) jammy; urgency=medium

  * buildd/02-disk-image-uefi add udev early hook to satisfy grub-probe
    and grub-install. (LP: #2064175)

livecd-rootfs (2.765.42) jammy; urgency=medium

  [ Ankush Pathak ]
  * Add policy:unconfined_restrictions feature to 6.5 kernel (LP: #2062929)

 -- Philip Roche <email address hidden> Thu, 27 Jun 2024 14:11:06 +0100