apparmor-geoclue: test failed

Affected images versions

Deployment	Type	v2022	v2023	v2024dev1	v2024dev3
apt	minimal/fixedfunction				✅
ostree	minimal/fixedfunction
apt	target/hmi				✅
ostree	target/hmi
apt	basesdk				✅
apt	sdk				✅
apt	nfs
apt	lxc
apt	image-builder
apt	package-source-builder

apparmor-geoclue fails on all images and architectures probably since the bookworm rebase. See: https://qa.apertis.org/report/v2024dev3/20230719.0017/apt

Unaffected images versions

All images before the bookworm rebase (< v2024dev2) are unaffected.

Testcase

https://qa.apertis.org/report/v2024dev3/20230719.0017/apt

Steps to reproduce

Follow steps as explained at https://qa.apertis.org/testcases/v2024dev3/apparmor-geoclue.html

Expected result

Test should succeed.

Actual result

Test fails with:

#---8<--- expected parsed apparmor output from journal
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/passwd
# request_mask:r
#--->8---
112
#---8<--- actual parsed apparmor output from journal
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/passwd
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/var/lib/dbus/machine-id
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/proc/sys/net/ipv6/conf/all/disable_ipv6
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/ssl/certs/
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/proc/sys/net/ipv6/conf/all/disable_ipv6
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/ssl/certs/
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/services
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/proc/sys/net/ipv6/conf/all/disable_ipv6
# request_mask:r
# ====
# profile:/usr/libexec/geoclue
# sdmode:REJECTING
# denied_mask:r
# operation:open
# name:/etc/ssl/certs/
# request_mask:r

Reproducibility

How often the issue is hit when repeating the test and changing nothing (same device, same image, etc.)?

Put the ✅ in the most appropriate entry:

1. ✅ always
2. often, but not always
3. rarely

Root cause

Apparmor rules need to be updated.

Outcomes

TBD

Management data

This section is for management only, it should be the last one in the description.

/cc @andrunko @em @sagar @sudarshan @wlozano

Phabricator link: https://phabricator.apertis.org/T9944