This bug was fixed in the package apparmor - 2.13.2-9ubuntu6.1
---------------
apparmor (2.13.2-9ubuntu6.1) disco-proposed; urgency=medium
* lp1820068.patch: don't skip read cache when options are set (LP: #1820068)
* reenable ubuntu/parser-conf-no-expr-simplify.patch
-- Jamie Strandboge <ja...@ubuntu.com> Thu, 06 Jun 2019 21:04:34 +0000
** Changed in: apparmor (Ubuntu Disco)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1820068
Title:
specifying -O no-expr-simplify results in cache miss
Status in AppArmor:
Fix Released
Status in apparmor package in Ubuntu:
Fix Released
Status in apparmor source package in Disco:
Fix Released
Status in apparmor source package in Eoan:
Fix Released
Bug description:
[Impact]
* AppArmor 2.13 unconditionally invalidates its cache when parser options
are specified. To decrease compile times for ARM systems, -O no-expr-simplify
has been used in Ubuntu for click and snap policy for many years, but was
temporarily disabled during the disco development release with the 2.13 upload
so caching properly worked everywhere. Now that a simple upstream workaround is
available (and already in eoan), we'd like to apply the upstream patch and
re-enable -O no-expr-simplify.
* A condition of the AppArmor 2.13 feature freeze exception was to fix this
bug in SRU to re-enable -O no-expr-simplify. This will help compile times for
all architectures with default and typical AppArmor policy (ie, a mixture of
(distro) system and snap policy), but especially ARM systems with snaps where
the improvement could be in terms of minutes saved.
* Specifically, the upstream patch workaround to no longer unconditionally
skip reading the cache when parser options are specified. It also re-enables an
existing quilt patch to update /etc/apparmor/parser.conf to use
no-expr-simplify.
[Test Case]
# setup
$ mkdir -p /tmp/aa/cache /tmp/aa/profiles
$ cp /etc/apparmor.d/sbin.dhclient /tmp/aa/profiles/
# no options, no cache, expect a miss and to write
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
# no options, cache, expect a hit
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache hit: /tmp/aa/cache/26b63962.0/sbin.dhclient
# reset
$ rm -rf /tmp/aa/cache/*
# options, no cache, expect a miss and to write
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load -O no-expr-simplify --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
# options, cache, expect a hit
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load -O no-expr-simplify --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient # SHOULD BE A HIT
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
Same thing happens if omitting -O no-expr-simplify but add Optimize
=no-expr-simplify to /etc/apparmor/parser.conf.
[Regression Potential]
The regression potential is considered low since the patch is simple
and easily verifiable. If something went wrong, it would be around
cache invalidation which the above test case will demonstrate it works
correctly.
# Original description
With 2.13.2 and the most recent testsuite patches from the 2.13
branch, I find that the cache works correctly when no options are
specified. Eg
# setup
$ mkdir -p /tmp/aa/cache /tmp/aa/profiles
$ cp /etc/apparmor.d/sbin.dhclient /tmp/aa/profiles/
# no options, no cache, expect a miss and to write
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
# no options, cache, expect a hit
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache hit: /tmp/aa/cache/26b63962.0/sbin.dhclient
# reset
$ rm -rf /tmp/aa/cache/*
# options, no cache, expect a miss and to write
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load -O no-expr-simplify --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
# options, cache, expect a hit
$ /sbin/apparmor_parser -k --write-cache --cache-loc=/tmp/aa/cache
--skip-kernel-load -O no-expr-simplify --add -- /tmp/aa/profiles
Cache: added primary location '/tmp/aa/cache'
Cache miss: /tmp/aa/profiles/sbin.dhclient # SHOULD BE A HIT
Wrote cache: /tmp/aa/cache/26b63962.0/sbin.dhclient
Same thing happens if omitting -O no-expr-simplify but add Optimize
=no-expr-simplify to /etc/apparmor/parser.conf.
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1820068/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
