canonical-ci-engineering team mailing list archive

[Vincent Ladeuil <vila+ci@xxxxxxxxxxxxx>]

>>>>> Stéphane Graber <stephane.graber@xxxxxxxxxxxxx> writes:

    > On Thu, Oct 10, 2013 at 10:12:39AM +0300, Timo Jyrinki wrote:
    >> Hi,
    >> 
    >> Thanks to the efforts yesterday, an lxc problem was identified and
    >> fixed (https://lists.ubuntu.com/archives/saucy-changes/2013-October/011959.html)
    >> during the night my time.
    >> 
    >> However, cyphermox reported to me that he updated the containers and
    >> the 'check' (autopilot) jobs of cu2d continue to fail. So the dbus <->
    >> apparmor <-> lxc triangle is not yet in complete harmony. He suggested
    >> checking the /var/log/upstart/lightdm.log and sending it to stgraber /
    >> security team. So here goes:
    >> 
    >> http://pastebin.ubuntu.com/6216936/
    >> 
    >> It's taken from dx-autopilot-intel and the latest container
    >> saucy-i386-20131010-0216.
    >> 
    >> -Timo
    >> 
    >> ps. thanks Evan for the ubuntu-engineering post

    > Can you make sure the host is up to date,

It is.

    > reboot it after that

Done.

    > (since the dbus apparmor changes came through a kernel change) and
    > then tell me what version of LXC is on the host

root@dx-autopilot-intel:/var/lib/jenkins# apt-cache policy lxc
lxc:
  Installed: 1.0.0~alpha1-0ubuntu10
  Candidate: 1.0.0~alpha1-0ubuntu10
  Version table:
 *** 1.0.0~alpha1-0ubuntu10 0
        500 http://us.archive.ubuntu.com/ubuntu/ saucy/main i386 Packages
        100 /var/lib/dpkg/status

    > and attach the "dmesg" output right after a failure.

dmesg attached.

    > If it's really still an apparmor profile issue, there will be denials in
    > the dmesg output, if not, then it's something else that's breaking your
    > tests.

Now, otto (which is creating the lxc container) mounts an iso and as
such requires a loop device. To get that it disables:

root@dx-autopilot-intel:/etc/apparmor.d/disable# ls -lart
total 8
lrwxrwxrwx 1 root root   33 Jun  4 10:34 usr.sbin.rsyslogd -> /etc/apparmor.d/usr.sbin.rsyslogd
drwxr-xr-x 9 root root 4096 Oct 10 13:14 ..
lrwxrwxrwx 1 root root   33 Oct 10 13:15 usr.bin.lxc-start -> /etc/apparmor.d/usr.bin.lxc-start
drwxr-xr-x 2 root root 4096 Oct 10 13:15 .

Not sure how that interacts with the profiles but without them the
container can't be started and use its iso.

          Vincent