From f523932179b45144d68b0432709edb5697766d82 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Mon, 25 May 2026 20:46:15 +1000
Subject: [PATCH] fix(ovn): broaden AppArmor read grant to /etc/spinifex
 (covers CA cert)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The earlier override granted reads on /etc/spinifex/ipsec/** only, which
covers the peer cert + key but NOT the cluster CA at /etc/spinifex/ca.pem.
charon then can't load the CA, can't validate the peer cert chain, and
surfaces the failure as `no trusted RSA public key found for '<peer>'`
even though identity matching now succeeds — IKE_AUTH fails with
AUTHENTICATION_FAILED and no xfrm SAs negotiate.

Grant /etc/spinifex/** instead (covers ca.pem + ipsec/peer.{pem,key})
and always rewrite the override so re-runs replace the older narrower
rule.

Refs: mulga-siv-136
---
 scripts/setup-ovn.sh | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/scripts/setup-ovn.sh b/scripts/setup-ovn.sh
index b60e3b28e..5be379cdc 100755
--- a/scripts/setup-ovn.sh
+++ b/scripts/setup-ovn.sh
@@ -249,17 +249,20 @@ install_packages
 # strongswan-charon ships an AppArmor profile for /usr/lib/ipsec/charon that
 # only allows reading from /etc/ipsec.*, /etc/strongswan.*, and a few other
 # fixed paths. ovs-monitor-ipsec writes the per-tunnel strongSwan config with
-# absolute paths to our cert + key under /etc/spinifex/ipsec/, so charon hits
-# "Permission denied" when loading them and no SAs come up. The profile
-# includes a 'local' override file expressly for site additions — drop a
-# read grant for our cert dir there and reload the profile.
+# absolute paths to our peer cert + key under /etc/spinifex/ipsec/ AND to the
+# cluster CA at /etc/spinifex/ca.pem, so charon hits "Permission denied" on
+# both load paths and surfaces as `no trusted RSA public key found for
+# '<peer>'` (CA can't be loaded → can't validate peer cert chain → no SAs).
+# The profile includes a 'local' override file expressly for site additions
+# — grant reads on /etc/spinifex/** (covers ca.pem AND ipsec/peer.{pem,key})
+# and reload.
 if [ -d /etc/apparmor.d/local ]; then
     LOCAL_OVERRIDE=/etc/apparmor.d/local/usr.lib.ipsec.charon
-    if ! grep -q '/etc/spinifex/ipsec/' "$LOCAL_OVERRIDE" 2>/dev/null; then
-        echo "  Adding AppArmor read grant for /etc/spinifex/ipsec to charon profile"
-        echo "/etc/spinifex/ipsec/** r," | sudo tee "$LOCAL_OVERRIDE" >/dev/null
-        sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon 2>/dev/null || true
-    fi
+    # Always rewrite — re-runs may have an older, narrower rule (e.g. the
+    # initial /etc/spinifex/ipsec/** only) that misses /etc/spinifex/ca.pem.
+    echo "  Adding AppArmor read grant for /etc/spinifex (cert + CA) to charon profile"
+    echo "/etc/spinifex/** r," | sudo tee "$LOCAL_OVERRIDE" >/dev/null
+    sudo apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon 2>/dev/null || true
 fi
 
 # --- Step 2: Enable services ---