swtpm_setup cannot be run as user (AppArmor profile)

Confirmed this is an issue for kinetic and jammy-proposed

$ lxc launch ubuntu:jammy --vm test-swtpm
$ lxc exec test-swtpm bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install swtpm swtpm-tools -y

# su ubuntu

$ cd
$ /usr/share/swtpm/swtpm-create-user-config-files --overwrite
Environment variable XDG_CONFIG_HOME is not set. Using ${HOME}/.config.
Writing /home/ubuntu/.config/swtpm_setup.conf.
Writing /home/ubuntu/.config/swtpm-localca.conf.
Writing /home/ubuntu/.config/swtpm-localca.options.

$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Tue 25 Apr 2023 04:15:36 PM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
Could not find @DATAROOTDIR@/swtpm/swtpm-localca in PATH.
An error occurred. Authoring the TPM state failed.
Ending vTPM manufacturing @ Tue 25 Apr 2023 04:15:36 PM UTC

$ lxc launch ubuntu:kinetic --vm test-swtpm
$ lxc exec test-swtpm bash

# apt update && apt dist-upgrade -y
# apt install swtpm swtpm-tools -y

# su ubuntu

$ cd
$ /usr/share/swtpm/swtpm-create-user-config-files --overwrite
Environment variable XDG_CONFIG_HOME is not set. Using ${HOME}/.config.
Writing /home/ubuntu/.config/swtpm_setup.conf.
Writing /home/ubuntu/.config/swtpm-localca.conf.
Writing /home/ubuntu/.config/swtpm-localca.options.

$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Tue 25 Apr 2023 04:07:27 PM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
Could not find @DATAROOTDIR@/swtpm/swtpm-localca in PATH.
An error occurred. Authoring the TPM state failed.
Ending vTPM manufacturing @ Tue 25 Apr 2023 04:07:28 PM UTC

Lunar, however, is working properly:
$ lxc launch ubuntu:lunar --vm test-swtpm
$ lxc exec test-swtpm bash

# apt update && apt dist-upgrade -y
# apt install swtpm swtpm-tools -y

# su ubuntu

$ cd
$ /usr/share/swtpm/swtpm-create-user-config-files --overwrite
Environment variable XDG_CONFIG_HOME is not set. Using ${HOME}/.config.
Writing /home/ubuntu/.config/swtpm_setup.conf.
Writing /home/ubuntu/.config/swtpm-localca.conf.
Writing /home/ubuntu/.config/swtpm-localca.options.

$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Tue 25 Apr 2023 04:29:45 PM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
  Invoking /usr/bin/swtpm_localca --type ek --ek c3c156cd0c219f097b180d7884f5911c428f7b1e8ccbd829b28c317302a28e35edddbc334e07c0b87c771243ab7e4794ffd6f5e45a7e69d3f2182ff50956b1eb6bd90f947401a392f940b2a6fd0cb1223d25d476ac24f94490a0177885b7bc481d1facddf880e2c1c36f9712d1ae3988dfe6637170c79f53ec8e57c4eb60280058ed032c7c802ddd6d2186d4a53b04c45ef47ef7a6691d263410810cae81cf236491cf54059a250268402e30b8590b8f98d7dbd1fa58b978c0d62d0310b8212a8104a3eb2731d551265eb414be3f33319c2459deed673204f5f6e2e7bc3ef494ac8f3bc2e63439661f57...

Hello Stefan, or anyone else affected,

Accepted swtpm into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/swtpm/0.6.3-0ubuntu4.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Stefan, or anyone else affected,

Accepted swtpm into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/swtpm/0.6.3-0ubuntu3.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Verified for kinetic and jammy:
$ lxc launch ubuntu:kinetic --vm test-swtpm-kinetic
$ lxc exec test-swtpm-kinetic bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install swtpm swtpm-tools -y

# su ubuntu

$ cd
$ /usr/share/swtpm/swtpm-create-user-config-files --overwrite
$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Fri 12 May 2023 04:31:45 AM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
...
swtpm-localca: Successfully created EK certificate locally.
Successfully created NVRAM area 0x1c00016 for ECC EK certificate.
Successfully activated PCR banks sha1,sha256 among sha1,sha256,sha384,sha512.
Successfully authored TPM state.
Ending vTPM manufacturing @ Fri 12 May 2023 04:31:46 AM UTC

$ lxc launch ubuntu:jammy --vm test-swtpm-jammy
$ lxc exec test-swtpm-jammy bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install swtpm swtpm-tools -y

# su ubuntu

$ cd
$ /usr/share/swtpm/swtpm-create-user-config-files --overwrite
$ swtpm_setup --tpm2 --tpmstate . --overwrite --create-ek-cert
Starting vTPM manufacturing as ubuntu:ubuntu @ Fri 12 May 2023 04:37:14 AM UTC
TPM is listening on Unix socket.
Successfully created RSA 2048 EK with handle 0x81010001.
...
swtpm-localca: Successfully created EK certificate locally.
Successfully created NVRAM area 0x1c00016 for ECC EK certificate.
Successfully activated PCR banks sha1,sha256 among sha1,sha256,sha384,sha512.
Successfully authored TPM state.
Ending vTPM manufacturing @ Fri 12 May 2023 04:37:15 AM UTC

I verified that it works correctly now on Jammy. Thanks.

   Stefan

This bug was fixed in the package swtpm - 0.6.3-0ubuntu4.2

---------------
swtpm (0.6.3-0ubuntu4.2) kinetic; urgency=medium

  * d/p/create-user-config-files-use-correct-swtpm-localca.patch: Fix the path
    to swtpm-localca used in swtpm-create-user-config-files (LP: #2016744)

 -- Lena Voytek <email address hidden> Wed, 26 Apr 2023 14:03:08 -0700

The verification of the Stable Release Update for swtpm has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package swtpm - 0.6.3-0ubuntu3.2

---------------
swtpm (0.6.3-0ubuntu3.2) jammy; urgency=medium

  * d/p/create-user-config-files-use-correct-swtpm-localca.patch: Fix the path
    to swtpm-localca used in swtpm-create-user-config-files (LP: #2016744)

 -- Lena Voytek <email address hidden> Wed, 26 Apr 2023 15:06:00 -0700