1884980 - Add an apparmor profile to fix userns in the .deb package

Status: RESOLVED WONTFIX

(Release Engineering :: General, defect, P1)

Description

[Gabriel Bustamante [:gabriel]]

Lets set up AppArmor in the .deb package asap.

Comment 1

[Gabriel Bustamante [:gabriel]]

Attachment: Bug 1884980 - Add an AppArmor profile to fix userns in the .deb package r?jcristau,#releng-reviewers

Comment 2

[Gabriel Bustamante [:gabriel]]

Attachment: Bug 1884980 - Add dh-apparmor to the debian-repackage image r?jcristau,#releng-reviewers

Depends on D204409

Comment 3

[Gabriel Bustamante [:gabriel]]

Attachment: Bug 1884980 - Update test_deb.py to reflect changes in deb.py r?jcristau,#releng-reviewers

Depends on D204552

Comment 4

[Gabriel Bustamante [:gabriel]]

Looks like /etc/apparmor.d/firefox was patched to match beta, devedition, and nightly.

https://git.launchpad.net/ubuntu/+source/apparmor/tree/profiles/apparmor.d/firefox?h=ubuntu/noble-devel

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile firefox /usr/lib/firefox{,-esr,-beta,-devedition,-nightly}/firefox{,-esr,-bin} flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/firefox>
}

Comment 5

[Gabriel Bustamante [:gabriel]]

So, I keep checking on the 24.04 daily build and I don't see this change yet. I wonder when it will land. I am hesitant to land the changes we were baking to fix this because I dunno how they will interact with this /usr/lib/firefox{,-esr,-beta,-devedition,-nightly}/firefox profile. Not sure what policy would apply to the binary (same reason we were going to leave firefox and firefox-esr out of the patch.)

Comment 6

[Gabriel Bustamante [:gabriel]]

I was able to confirm Ubuntu's fix landed on the Noble Numbat Daily Build :)

ubuntu@ubuntu:~$ cd /etc/apparmor.d/
ubuntu@ubuntu:/etc/apparmor.d$ cat firefox 
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile firefox /usr/lib/firefox{,-esr,-beta,-devedition,-nightly}/firefox{,-esr,-bin} flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/firefox>
}