[Bug 1968335] [NEW] apparmor profile needs extension

[Andre Wagner]

Public bug reported:

Hi team,
I've tried to create a socket activated systemd service for supplying a software tpm for qemu. As it didn't worked I recognized that the swtpm package ships an apparmor profile. To make it work i've to add a read/write/lock permission for the tpm's nvram folder and a read/write permission for the tpm's unix socket used for the connection with qemu.

Since there is no default location for the tpm nvram (correct?) I
suggest using "/var/lib/swtpm" which follows the /var/lib/<package>
convention.

Since there is no default location for the tpm unix socket I suggest
using "/run/swtpm/sock" which follows the systemd.socket unit
conventions

A patch which adds the settings is attached to this message.

Greetings,
André

** Affects: swtpm (Ubuntu)
     Importance: Undecided
         Status: New

** Patch added: "add_socket_and_nvram.diff"
   https://bugs.launchpad.net/bugs/1968335/+attachment/5578260/+files/add_socket_and_nvram.diff

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to swtpm in Ubuntu.
https://bugs.launchpad.net/bugs/1968335

Title:
  apparmor profile needs extension

Status in swtpm package in Ubuntu:
  New

Bug description:
  Hi team,
  I've tried to create a socket activated systemd service for supplying a software tpm for qemu. As it didn't worked I recognized that the swtpm package ships an apparmor profile. To make it work i've to add a read/write/lock permission for the tpm's nvram folder and a read/write permission for the tpm's unix socket used for the connection with qemu.

  Since there is no default location for the tpm nvram (correct?) I
  suggest using "/var/lib/swtpm" which follows the /var/lib/<package>
  convention.

  Since there is no default location for the tpm unix socket I suggest
  using "/run/swtpm/sock" which follows the systemd.socket unit
  conventions

  A patch which adds the settings is attached to this message.

  Greetings,
  André

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/swtpm/+bug/1968335/+subscriptions