[Bug 1989100] Re: AppArmor DENIES swtpm pid file access

[Lena Voytek]

** Description changed:

+ [Impact]
+ 
+ When attempting to set up a vm with libvirt using swtpm in Kinetic,
+ swtpm's apparmor profile will deny access to the pid file in
+ /run/libvirt/qemu/swtpm/.
+ 
+ The fix for this issue should be backported to Kinetic because it blocks
+ all users attempting to set up a libvirt TPM vm with an error.
+ 
+ This bug is fixed by removing the "owner" tag from the line "owner
+ /run/libvirt/qemu/swtpm/*.pid rwk," allowing libvirt-created pid files
+ to be used.
+ 
+ [Test Plan]
+ 
+ The fix can be tested using virt-manager Windows 11 iso in ~/Win11.iso:
+ 
+ # sudo apt update && sudo apt dist-upgrade -y
+ # sudo apt install virt-manager swtpm
+ 
+ > Open virt-manager
+ > Click New Virtual Machine button
+ 
+ Step 1:
+ > Select "Local install media (ISO image or CDROM)
+ > Click Forward
+ 
+ Step 2:
+ > Click Browse and find Windows 11 iso
+ > Select "Automatically detect from the installation media / source"
+ > Click Forward
+ 
+ Step 3:
+ > Use >= 4096 MiB for Memory
+ > Use >= 2 CPUs
+ > Click Forward
+ 
+ Step 4:
+ > Select "Enable storage for this virtual machine"
+ > Use >= 70 GiB for storage size
+ > Click Forward
+ 
+ Step 5:
+ > Select "Customize configuration before install"
+ > Click Finish
+ 
+ Config Screen:
+ > For Overview > Firmware select UEFI x86_64: /usr/share/OVMF/OVMF_CODE_4M.secboot.fd
+ > For Boot Options select "SATA CDROM 1" and move it to top
+ 
+ > Click Add Hardware
+ > Select TPM with Model "TIS" and version 2.0
+ 
+ > Click "Begin Installation"
+ 
+ [Where problems could occur]
+ 
+ By removing the owner tag in line in the apparmor profile, any file with
+ a .pid extension in /run/libvirt/qemu/swtpm/ will be manipulatable by
+ swtpm. If swtpm were to act maliciously, it would have an overall
+ greater reach in this folder.
+ 
+ [Original Description]
+ 
  libvirt 8.6.0-0ubuntu1
  apparmor 3.0.7-1ubuntu1
  
  One of our CI tests runs virt-install in a specific way that ultimately
  fails with this in the error message:
  
-     ERROR    internal error: Could not get process id of swtpm
+     ERROR internal error: Could not get process id of swtpm
  
  The journal has this message:
  
-     audit: type=1400 audit(1662628523.308:121): apparmor="DENIED"
+     audit: type=1400 audit(1662628523.308:121): apparmor="DENIED"
  operation="file_inherit" profile="swtpm"
  name="/run/libvirt/qemu/swtpm/1-VmNotInstalled-swtpm.pid" pid=13944
  comm="swtpm" requested_mask="w" denied_mask="w" fsuid=118 ouid=0
  
- This is nested virtualization.  If you need the exact invocation of
- virt-install, I can dig that out.
+ This is nested virtualization. If you need the exact invocation of virt-
+ install, I can dig that out.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to swtpm in Ubuntu.
https://bugs.launchpad.net/bugs/1989100

Title:
  AppArmor DENIES swtpm pid file access

Status in libvirt package in Ubuntu:
  Confirmed
Status in swtpm package in Ubuntu:
  In Progress

Bug description:
  [Impact]

  When attempting to set up a vm with libvirt using swtpm in Kinetic,
  swtpm's apparmor profile will deny access to the pid file in
  /run/libvirt/qemu/swtpm/.

  The fix for this issue should be backported to Kinetic because it
  blocks all users attempting to set up a libvirt TPM vm with an error.

  This bug is fixed by removing the "owner" tag from the line "owner
  /run/libvirt/qemu/swtpm/*.pid rwk," allowing libvirt-created pid files
  to be used.

  [Test Plan]

  The fix can be tested using virt-manager Windows 11 iso in
  ~/Win11.iso:

  # sudo apt update && sudo apt dist-upgrade -y
  # sudo apt install virt-manager swtpm

  > Open virt-manager
  > Click New Virtual Machine button

  Step 1:
  > Select "Local install media (ISO image or CDROM)
  > Click Forward

  Step 2:
  > Click Browse and find Windows 11 iso
  > Select "Automatically detect from the installation media / source"
  > Click Forward

  Step 3:
  > Use >= 4096 MiB for Memory
  > Use >= 2 CPUs
  > Click Forward

  Step 4:
  > Select "Enable storage for this virtual machine"
  > Use >= 70 GiB for storage size
  > Click Forward

  Step 5:
  > Select "Customize configuration before install"
  > Click Finish

  Config Screen:
  > For Overview > Firmware select UEFI x86_64: /usr/share/OVMF/OVMF_CODE_4M.secboot.fd
  > For Boot Options select "SATA CDROM 1" and move it to top

  > Click Add Hardware
  > Select TPM with Model "TIS" and version 2.0

  > Click "Begin Installation"

  [Where problems could occur]

  By removing the owner tag in line in the apparmor profile, any file
  with a .pid extension in /run/libvirt/qemu/swtpm/ will be
  manipulatable by swtpm. If swtpm were to act maliciously, it would
  have an overall greater reach in this folder.

  [Original Description]

  libvirt 8.6.0-0ubuntu1
  apparmor 3.0.7-1ubuntu1

  One of our CI tests runs virt-install in a specific way that
  ultimately fails with this in the error message:

      ERROR internal error: Could not get process id of swtpm

  The journal has this message:

      audit: type=1400 audit(1662628523.308:121): apparmor="DENIED"
  operation="file_inherit" profile="swtpm"
  name="/run/libvirt/qemu/swtpm/1-VmNotInstalled-swtpm.pid" pid=13944
  comm="swtpm" requested_mask="w" denied_mask="w" fsuid=118 ouid=0

  This is nested virtualization. If you need the exact invocation of
  virt-install, I can dig that out.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1989100/+subscriptions