Bubblewrap upstream-as-root test fails on libcap2 1:2.31-1 and later

[Łukasz Zemczak]

The bubblewrap upstream-as-root test started failing after libcap2 1:2.31-1 got synced from Debian. The same failure can be seen with 1:2.32-1. I have reproduced the issue locally on focal - when using the focal-proposed version, the aforementioned test fails, where with the release version (1:2.27-1) it passes.

It seems to fail here already:
bwrap --bind / / --tmpfs /tmp --as-pid-1 --cap-drop CAP_KILL --cap-drop CAP_FOWNER --unshare-pid capsh --print
assert_not_file_has_content caps.test '^Current: =.*cap_kill'

It looks like the requested caps did not get dropped, as the logs show that both cap_kill and cap_fowner are still there. This is only for the upstream-as-root test, i.e. executing tests/test-run.sh as root.

This might be an issue with bubblewrap, but seeing that it all works fine with the release version, it all feels weird.

[Łukasz Zemczak (sil2100)]

Example test output log: https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-focal/focal/amd64/b/bubblewrap/20200217_205507_3784d@/log.gz

[Sebastien Bacher (seb128)]

Bisecting the failing it started with this commit
https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=afef3ef1

'Change the definition of 'all' to be all named capabilities.
[This will be included in libcap-2.29.]

This change concerns the text formating functions:

  C: cap_to_text(), cap_from_text()
 Go: cap.FromText() and cap.Set.String()

Prior to this commit, "all" meant every bit of the capability vector
was raised - both named, and unnamed capabilities.'

[Sebastien Bacher (seb128)]

Reported to bubblewrap upstream on https://github.com/containers/bubblewrap/issues/353 let's see what they say

[Christian Ehrhardt  (paelzer)]

FYI - I'm taking a look if the proposed change on the issue would help us to unblock the new libcap2.

[Christian Ehrhardt  (paelzer)]

Test build in https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3943/+packages works against the older libcap2
=> https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-focal-ci-train-ppa-service-3943/focal/amd64/b/bubblewrap/20200226_102201_2465e@/log.gz

I'm now setting up tests with the following combinations:
- new libpcap2 - old bubblewrap (expect fail)
- new libpcap2 - new bubblewrap (expected to work)
- old libpcap2 - new bubblewrap (expected to work)

Unfortunately all of the above passed, so the fix might be harder to confirm than expected :-/

Note this is masked on s390x and will need a bump there to the new version:
$ grep -Hrn bubble
ubuntu-release:22:force-badtest bubblewrap/0.4.0-1ubuntu1/s390x

The upload with the bubblewrap fix can be reviewed at:
https://code.launchpad.net/~paelzer/ubuntu/+source/bubblewrap/+git/bubblewrap/+merge/379880

[Christian Ehrhardt  (paelzer)]

The MP was approved and I uploaded but it seems Lukasz did the same upload already.
=> https://launchpad.net/ubuntu/+source/bubblewrap/0.4.0-1ubuntu3

I now marked the MP as rejected.

[Sebastien Bacher (seb128)]

https://launchpad.net/ubuntu/+source/bubblewrap/0.4.0-1ubuntu3