Ubuntu
swtpm package

AppArmor denials when running swtpm as unprivileged user with session libvirtd

Bug #2017874 reported by James Henstridge
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
swtpm (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

I was trying to set up a libvirt VM with an emulated TPM under qemu:///session (i.e. a libvirtd instance running as myself).

I configured swtpm by running the following:

    swtpm_setup --create-config-files skip-if-exist --tpm2

And tried creating a VM with "virt-install --connect qemu:///session --name core-desktop --tpm emulator ...", which produced the following output:

    Starting install...
    ERROR operation failed: swtpm died and reported:
    Domain installation does not appear to have been successful.
    If it was, you can restart your domain by running:
      virsh --connect qemu:///session start core-desktop
    otherwise, please restart your installation.

Searching the journal for relevant messages showed:

    Apr 27 16:28:16 scruffy audit[3303311]: AVC apparmor="DENIED" operation="file_inherit" class="file" profile="swtpm" name="/run/user/1000/libvirt/qemu/run/swtpm/1-core-desktop-swtpm.pid" pid=3303311 comm="swtpm" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
    Apr 27 16:28:16 scruffy audit[3303311]: AVC apparmor="DENIED" operation="mknod" class="file" profile="swtpm" name="/run/user/1000/libvirt/qemu/run/swtpm/1-core-desktop-swtpm.sock" pid=3303311 comm="swtpm" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
    Apr 27 16:28:16 scruffy kernel: audit: type=1400 audit(1682584096.368:1355): apparmor="DENIED" operation="file_inherit" class="file" profile="swtpm" name="/run/user/1000/libvirt/qemu/run/swtpm/1-core-desktop-swtpm.pid" pid=3303311 comm="swtpm" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
    Apr 27 16:28:16 scruffy kernel: audit: type=1400 audit(1682584096.368:1356): apparmor="DENIED" operation="mknod" class="file" profile="swtpm" name="/run/user/1000/libvirt/qemu/run/swtpm/1-core-desktop-swtpm.sock" pid=3303311 comm="swtpm" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
    Apr 27 16:28:16 scruffy libvirtd[3303247]: operation failed: swtpm died and reported:

It looks like the AppArmor policy in /etc/apparmor.d/usr.bin.swtpm is set up to allow a system wide swtpm to access its socket and pid files in /run/libvirt/qemu/swtpm, but not an unprivileged swtpm in $XDG_RUNTIME_DIR/libvirt/qemu/run/swtpm.

ProblemType: Bug
DistroRelease: Ubuntu 23.04
Package: swtpm 0.7.3-0ubuntu1
ProcVersionSignature: Ubuntu 6.2.0-18.18-generic 6.2.6
Uname: Linux 6.2.0-18-generic x86_64
ApportVersion: 2.26.1-0ubuntu2
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Thu Apr 27 16:45:25 2023
InstallationDate: Installed on 2021-03-28 (759 days ago)
InstallationMedia: Ubuntu 21.04 "Hirsute Hippo" - Alpha amd64 (20210327)
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: swtpm
UpgradeStatus: Upgraded to lunar on 2023-03-19 (38 days ago)

Revision history for this message
James Henstridge (jamesh) wrote :
Revision history for this message
James Henstridge (jamesh) wrote :

I was able to get swtpm running by adding the following rules to the AppArmor profile:

    owner /run/user/[0-9]*/libvirt/qemu/run/swtpm/*.sock rwk,
    owner /run/user/[0-9]*/libvirt/qemu/run/swtpm/*.pid rwk,

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in swtpm (Ubuntu):
status: New → Confirmed
Revision history for this message
Olivier Gayot (ogayot) wrote (last edit ):

I am also affected. I created a VM with virt-manager (connected to the QEMU/KVM User session) and added a TPM to it.

Starting the VM failed with:

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 72, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/createvm.py", line 2008, in _do_async_install
    installer.start_install(guest, meter=meter)
  File "/usr/share/virt-manager/virtinst/install/installer.py", line 695, in start_install
    domain = self._create_guest(
             ^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtinst/install/installer.py", line 637, in _create_guest
    domain = self.conn.createXML(initial_xml or final_xml, 0)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/libvirt.py", line 4470, in createXML
    raise libvirtError('virDomainCreateXML() failed')
libvirt.libvirtError: operation failed: swtpm died and reported:

and the journal shows the apparmor errors that James mentioned.

Revision history for this message
Olivier Gayot (ogayot) wrote :

Submitting debdiff that modifies the apparmor profile accordingly.

Package available as 0.7.3-0ubuntu2~ppa1 in the following PPA: https://launchpad.net/~ogayot/+archive/ubuntu/mantic-proposed

Revision history for this message
Olivier Gayot (ogayot) wrote :

Resubmitting debdiff to drop the unwanted newline change.

Revision history for this message
Simon Quigley (tsimonq2) wrote :

Uploaded to Mantic, thank you!

Changed in swtpm (Ubuntu):
status: Confirmed → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package swtpm - 0.7.3-0ubuntu2

---------------
swtpm (0.7.3-0ubuntu2) mantic; urgency=medium

  * d/usr.bin.swtpm: Configure apparmor to grant access to relevant files in
    /run/user/<UID>/libvirt/qemu/run/swtpm/ files when using the
    qemu:///session bus (LP: #2017874)

 -- Olivier Gayot <email address hidden> Fri, 04 Aug 2023 11:10:37 +0200

Changed in swtpm (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.