Bug 13568 - Multiple issues with AppArmor recipe
Summary: Multiple issues with AppArmor recipe
Status: RESOLVED FIXED
Alias: None
Product: Other YP Layers
Classification: Build System, Metadata & Runtime
Component: meta-security (show other bugs)
Version: 2.6.4
Hardware: All Multiple
: Undecided normal
Target Milestone: 3.1 M4
Assignee: Armin Kuster
QA Contact:
URL:
Whiteboard: with backport
Depends on:
Blocks:
 
Reported: 2019-10-02 22:05 UTC by Anders Montonen
Modified: 2019-10-18 18:55 UTC (History)
0 users

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Anders Montonen 2019-10-02 22:05:58 UTC 
These issues were found with Thud, but I believe they affect all releases.

1. systemd.bbclass will delete the init script installed under /etc/init.d if "sysvinit" is not in DISTRO_FEATURES. This can be worked around with the following kludge:

python() {
    if 'postfuncs' in d.getVarFlags('do_install'):
        postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '')
        d.setVarFlags('do_install', { 'postfuncs': postfuncs })
}

2. The /lib/apparmor/functions script does not work with BusyBox xargs. Fixed by adding findutils to RDEPENDS.

3. The /lib/apparmor/functions script also requires "getconf", which is explicitly deleted by libc-common.bbclass.
Comment 1 Armin Kuster 2019-10-02 22:48:28 UTC 
Thanks for the defect. 

How can i reproduce this so that maybe I can fix and test for future regressions?
Comment 2 Anders Montonen 2019-10-03 19:45:33 UTC 
I'm using a custom distro based on the demo images from the meta-atmel layer, but I believe the following will suffice:

In the distro conf:
DISTRO_FEATURES_append = " systemd apparmor"
DISTRO_FEATURES_BACKFILL_CONSIDERED += "sysvinit"
VIRTUAL-RUNTIME_init_manager = "systemd"
VIRTUAL-RUNTIME_initscripts = "systemd-compat-units"

Create an apparmor_%.bbappend:
PTEST_ENABLED = "0" # The tests do not build
SYSTEMD_AUTO_ENABLE = "enable"

Add apparmor IMAGE_INSTALL.

When the image boots, the apparmor service should start, but currently fails.
Comment 3 Anders Montonen 2019-10-03 21:51:58 UTC 
There was another BusyBox incompatibility in the functions script. This is the "works for me" bbappend I ended up with:

apparmor_%.bbappend:
PTEST_ENABLED = "0"                                                                             
                                                                                                
python() {                                                                                      
    if 'postfuncs' in d.getVarFlags('do_install'):                                              
        postfuncs = d.getVarFlags('do_install')['postfuncs'].replace('rm_sysvinit_initddir', '')
        d.setVarFlags('do_install', { 'postfuncs': postfuncs })                                 
}                                                                                               
                                                                                                
do_install_append() {                                                                           
    sed -i -e 's/getconf _NPROCESSORS_ONLN/nproc/' ${D}/lib/apparmor/functions                  
    sed -i -e 's/ls -AU/ls -A/' ${D}/lib/apparmor/functions                                     
}                                                                                               
                                                                                                
SYSTEMD_AUTO_ENABLE = "enable"                                                                  
RDEPENDS_${PN}_append = " findutils"
Comment 4 Armin Kuster 2019-10-09 17:32:39 UTC 
I have time to look into this today.
Comment 5 Armin Kuster 2019-10-16 17:02:39 UTC 
patch on list

https://patchwork.openembedded.org/patch/165852/

this passes the apparmor test with and w/o systemd enabled.
Comment 6 Armin Kuster 2019-10-18 18:55:07 UTC 
this should be fixed in master and zeus now.