Can't start swtpm chardev on Ubuntu

[lmussier]

Hi,

We are starting to use swtpm on our dev environement and strugle to get started.
We start from there https://github.com/stefanberger/swtpm/wiki/Using-the-IBM-TSS-with-swtpm#character-device-using-tpm_vtpm_proxy the goal being to use tpm2 tools / openssl+tpm2-openssl as if we were running a "real" tpm.

When running sudo swtpm chardev --vtpm-proxy --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322 we get the following output:
swtpm: Ioctl to create vtpm proxy failed: Operation not permitted

Do we missed to add ourself in a special group?

Env:
Ubuntu 24
swtpm 0.7.3-0ubuntu5 (installed through package manager)

[stefanberger]

The work-around for this is to add the following rule:

/usr/bin/echo "capability sys_admin," > /etc/apparmor.d/local/usr.bin.swtpm
aa-enforce /usr/bin/swtpm

@lvoytek could we have the capability sys_admin as part of the base profile?

[lvoytek]

That sounds good to me, added a launchpad bug and will update 22.04-24.10 - https://bugs.launchpad.net/ubuntu/+source/swtpm/+bug/2071478

[stefanberger]

@lvoytek There was another issue requiring yet another rule: #852 (comment)

[lvoytek]

That's fair, it would also be reasonable for swtpm to have access to files in /var/lib/libvirt/swtpm/ that it doesn't own

[lmussier]

Works for me, tested on ubuntu 24.04 with https://github.com/stefanberger/swtpm/wiki/Using-the-IBM-TSS-with-swtpm#character-device-using-tpm_vtpm_proxy and the the app armor profile in this discussion.

Beware, I was not able to /usr/bin/echo "capability sys_admin," > /etc/apparmor.d/local/usr.bin.swtpm have to create the file first (in my home), then move it to /etc/apparmor.d/local/ and finally aa-enforce /usr/bin/swtpm

Thanks @stefanberger for the tool and your help.