** Description changed:
+ [Impact]
+
+ The default apparmor profile for swtpm blocks access to libvirt TPM2
+ NVRAM state lockfiles. This causes denials for users who want to view
+ TPM states via swtpm's socket API.
+
+ The fix for this should be backported so print-states for libvirt TPM
+ works for users by default.
+
+ The issue is fixed by adding non-owner write permissions to the
+ /var/lib/libvirt/swtpm/ directory.
+
+ [Test Plan]
+
+ $ sudo apt update && sudo apt dist-upgrade -y
+ $ sudo apt install swtpm virt-manager apparmor -y
+
+ # Create a vm with virt-manager that uses a TPM2 device and start it
+ # A directory will show up in /var/lib/libvirt/swtpm/ using the vm's ID, such
as:
+ # /var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5
+
+ # Before fix
+ $ sudo swtpm socket --print-states --tpmstate
dir=/var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5/tpm2,mode=0600
+ swtpm: SWTPM_NVRAM_Lock_Dir: Could not open lockfile: Permission denied
+
+ # After fix
+ $ sudo swtpm socket --print-states --tpmstate
dir=/var/lib/libvirt/swtpm/ab930d41-1600-4987-bfb0-34107be38cc5/tpm2,mode=0600
+ { "type": "swtpm", "states": [] }
+
+ [Where problems could occur]
+
+ This change will provide swtpm greater access to
+ /var/lib/libvirt/swtpm/. So if malicious code were to exist within
+ swtpm, it would be able to modify and write to files in the directory
+ created by other processes.
+
+ Likewise, with a change to the apparmor profile, a conflict will occur
+ on update for users that modified their profile directly.
+
+ [Other Info]
+
+ The issue was fixed in oracular in 0.7.3-0ubuntu7.
+
+ [Original Description]
+
Based on the upstream comment here -
https://github.com/stefanberger/swtpm/issues/852#issuecomment-2156039973
- users are having issues with apparmor denials when attempting to use
TPM2 NVRAM state lockfiles. This is due to the file not being owned by
the swtpm user. The issue is fixed by allowing write access to non-owned
lock files in /var/lib/libvirt/swtpm/. This was fixed upstream in my pr
here - https://github.com/stefanberger/swtpm/pull/868
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2072524
Title:
Allow non-owned lockfile writes in /var/lib/libvirt/swtpm/
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/swtpm/+bug/2072524/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
