sysfs_tpm: PermissionError

[kaxing]

tpm snap source: https://code.launchpad.net/~snappy-hwe-team/snappy-hwe-snaps/+git/tpm

$ sudo checkbox-snappy.plainbox run -i '2013.com.canonical.certification::sysfs_tpm'
===============================[ Analyzing Jobs ]===============================
=============================[ Session Statistics ]=============================
This session is about 0.00% complete
Estimated duration is 3.00 for automated jobs.
Estimated duration cannot be determined for manual jobs.
Size of the desired job list: 1
Size of the effective execution plan: 2
===========================[ Running Selected Jobs ]============================
--------------[ Running job 1 / 2. Estimated time left: 0:00:03 ]---------------
-----------------------------[ Hardware Manifest ]------------------------------
ID: 2013.com.canonical.plainbox::manifest
Category: 2013.com.canonical.plainbox::uncategorised
(Command output hidden)
Outcome: job passed
--------------[ Running job 2 / 2. Estimated time left: 0:00:02 ]---------------
---------------------[ Collect TPM information from sysfs ]---------------------
ID: 2013.com.canonical.certification::sysfs_tpm
Category: 2013.com.canonical.certification::tpm
(Command output hidden)
Outcome: job failed
==================================[ Results ]===================================
 ☑ : Hardware Manifest
 ☒ : Collect TPM information from sysfs
kaxing@localhost:~$ sudo checkbox-snappy.plainbox -D run -i '2013.com.canonical.certification::sysfs_tpm'
INFO plainbox.commands: Loading all providers...
INFO plainbox.secure.providers.v1: Provider initialized plainbox-provider-docker, version 1.0
INFO plainbox.secure.providers.v1: Provider initialized plainbox-provider-ipdt, version 0.1
INFO plainbox.secure.providers.v1: Provider initialized plainbox-provider-snappy-resource, version 1.0
INFO plainbox.secure.providers.v1: Provider initialized plainbox-provider-snappy, version 0.1
INFO plainbox.secure.providers.v1: Provider initialized plainbox-provider-tpm2, version 1.0
INFO plainbox.secure.providers.v1: Provider initialized 2013.com.canonical.plainbox:manifest, version 1.0
INFO plainbox.secure.providers.v1: Provider initialized 2013.com.canonical.plainbox:exporters, version 1.0
INFO plainbox.secure.providers.v1: Provider initialized 2013.com.canonical.plainbox:categories, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider 2013.com.canonical.plainbox:manifest, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider 2013.com.canonical.plainbox:exporters, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider 2013.com.canonical.plainbox:categories, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider plainbox-provider-docker, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider plainbox-provider-ipdt, version 0.1
INFO plainbox.secure.providers.v1: Loading content for provider plainbox-provider-snappy-resource, version 1.0
INFO plainbox.secure.providers.v1: Loading content for provider plainbox-provider-snappy, version 0.1
INFO plainbox.secure.providers.v1: Loading content for provider plainbox-provider-tpm2, version 1.0
===============================[ Analyzing Jobs ]===============================
=============================[ Session Statistics ]=============================
This session is about 0.00% complete
Estimated duration is 3.00 for automated jobs.
Estimated duration cannot be determined for manual jobs.
Size of the desired job list: 1
Size of the effective execution plan: 2
===========================[ Running Selected Jobs ]============================
--------------[ Running job 1 / 2. Estimated time left: 0:00:03 ]---------------
-----------------------------[ Hardware Manifest ]------------------------------
ID: 2013.com.canonical.plainbox::manifest
Category: 2013.com.canonical.plainbox::uncategorised
INFO plainbox.config: Loading configuration from ['/etc/xdg/plainbox.conf', '/root/snap/checkbox-snappy/x1/.config/plainbox.conf']
INFO plainbox.runner: Running <JobDefinition id:'2013.com.canonical.plainbox::manifest' plugin:'resource'>
(Command output hidden)
INFO plainbox.session.state: Job Hardware Manifest result changed to <DiskJobResult execution_duration:3.9816901683807373 io_log_filename:'/root/snap/checkbox-snappy/x1/.cache/plainbox/sessions/pbox-2016-10-19T11.02.14.session/io-logs/2013.com.canonical.plainbox__manifest.record.gz' outcome:'pass' return_code:0>
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.plainbox::manifest': Resource({'ns': '2013.com.canonical.certification'})
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.plainbox::manifest': Resource({'ns': '2016.com.intel.ipdt'})
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.plainbox::manifest': Resource({'ns': '2013.com.canonical.certification'})
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.plainbox::manifest': Resource({'has_wwan_module': 'True', 'has_tpm_chip': 'True', 'ns': '2013.com.canonical.certification', 'has_i2c': 'True'})
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.plainbox::manifest': Resource({'ns': '2013.com.canonical.certification'})
Outcome: job passed
--------------[ Running job 2 / 2. Estimated time left: 0:00:02 ]---------------
---------------------[ Collect TPM information from sysfs ]---------------------
ID: 2013.com.canonical.certification::sysfs_tpm
Category: 2013.com.canonical.certification::tpm
INFO plainbox.runner: Running <JobDefinition id:'2013.com.canonical.certification::sysfs_tpm' plugin:'resource'>
(Command output hidden)
INFO plainbox.session.state: Job Collect TPM information from sysfs result changed to <DiskJobResult execution_duration:1.098583459854126 io_log_filename:'/root/snap/checkbox-snappy/x1/.cache/plainbox/sessions/pbox-2016-10-19T11.02.14.session/io-logs/2013.com.canonical.certification__sysfs_tpm.record.gz' outcome:'fail' return_code:1>
INFO plainbox.ctrl: Storing resource record '2013.com.canonical.certification::sysfs_tpm': Resource({'x-sysfs-device-name': 'tpm0', 'active': '0'})
Outcome: job failed
==================================[ Results ]===================================
 ☑ : Hardware Manifest
 ☒ : Collect TPM information from sysfs

2013.com.canonical.certification__sysfs_tpm.stderr:
Traceback (most recent call last):
  File "/snap/checkbox-snappy/x1/lib/python3.5/site-packages/guacamole/core.py", line 248, in eat
    return self._dispatch()
  File "/snap/checkbox-snappy/x1/lib/python3.5/site-packages/guacamole/core.py", line 298, in _dispatch
    result = ingredient.dispatch(self.context)
  File "/snap/checkbox-snappy/x1/lib/python3.5/site-packages/guacamole/ingredients/cmdtree.py", line 152, in dispatch
    return self._dispatch(context, 0)
  File "/snap/checkbox-snappy/x1/lib/python3.5/site-packages/guacamole/ingredients/cmdtree.py", line 165, in _dispatch
    retval = command.invoked(context)
  File "/tmp/nest-fr1k6g4s.cdbaf8800c5ff05769c9aa3252afdce6434f6736e9aa17ff2ea630f9f8e0e65b/tpm-sysfs-resource", line 55, in invoked
    with open(tpm_filename, 'rt', encoding='utf-8') as stream:
PermissionError: [Errno 13] Permission denied: '/sys/class/tpm/tpm0/device/cancel'

[Sylvain Pineau (sylvain-pineau)]

Did you install both tpm and checkbox snap using --devmode?

[kaxing (kaxing)]

Tried 'snap install --edge --devmode tpm', ver: 1.2-3/rev:9 , still got the same permission issue.

[kaxing (kaxing)]

Image: f335673a2a386fc839cc68376bc8d6dd *ubuntu-core-16-amd64.img.xz

snap list
Name Version Rev Developer Notes
checkbox-snappy 0.10~s16 48 ce-certification-qa devmode
core 16.04.1 394 canonical -
docker 1.11.2-9 49 canonical devmode
network-manager 1.2.2-7 35 canonical devmode
pc 16.04-0.8 9 canonical -
pc-kernel 4.4.0-45-4 37 canonical -
tpm 1.2-3 9 canonical devmode

found an interesting situation: sysfs_tpm job without sudo it works fine,
with sudo it says permission denied; message:
cannot mount namespace file for namespace group tpm. errmsg: Permission denied

the rest of test also having the permission issue.

[Chris Wayne (cwayne)]

This is a bug in snap-confine, where it's currently impossible to run snap commands from other snaps.