[2.2b5] ntp test failed: can't find ntpq

[Jason Hobbs]

I tried to run the ntp test on my node but it failed with this error:

/tmp/user_data.sh.q0nDDL/scripts/testing/ntp: 26: /tmp/user_data.sh.q0nDDL/scripts/testing/ntp: ntpq: not found

This is with 2.2beta5

[Mike Pontillo (mpontillo)]

I saw this once as well, but couldn't reproduce the issue.

[Lee Trager (ltrager)]

This bug manifests itself a bit differently for me. ntpd is found but I get permission denied on libcap.so.2 and then ntp fails to start back up again.

+ sudo -n timeout 10 ntpd -gq
ntpd: error while loading shared libraries: libcap.so.2: cannot stat shared object: Permission denied
+ e=127
+ sudo -n systemctl start ntp.service
Job for ntp.service failed because the control process exited with error code. See "systemctl status ntp.service" and "journalctl -xe" for details.

[Lee Trager (ltrager)]

This appears to be due to apparmor

[ 49.115951] audit: type=1400 audit(1491266937.561:15): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/sbin/ntpd" pid=2153 comm="apparmor_parser"
[ 49.156571] systemd[1]: apt-daily.timer: Adding 4h 41min 45.232716s random time.
[ 53.152097] audit: type=1400 audit(1491266941.956:16): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/ntpd" name="overlay/etc/ld.so.cache" pid=2484 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 53.152161] audit: type=1400 audit(1491266941.956:17): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/ntpd" name="lib/x86_64-linux-gnu/libcap.so.2.24" pid=2484 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 53.163246] audit: type=1400 audit(1491266941.964:18): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/ntpd" name="overlay/etc/ld.so.cache" pid=2496 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
[ 53.163313] audit: type=1400 audit(1491266941.964:19): apparmor="DENIED" operation="getattr" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/ntpd" name="lib/x86_64-linux-gnu/libcap.so.2.24" pid=2496 comm="ntpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

[LaMont Jones (lamont)]

See https://bugs.launchpad.net/maas/+bug/1408106 -- apparmor and overlayfs do not play well together.

[Frode Nordahl (fnordahl)]

This issue is hitting users of MAAS versions prior to 2.2 as well. Is this fix subject for backport?