running a command for a snap in try mode fails on trusty

[Thomas Voß]

When executing snapd's spread test suite, tests/main/try fails with:

+ echo 'Given a buildable snap which access confinement-protected resources in a known directory'
Given a buildable snap which access confinement-protected resources in a known directory
+ echo 'When try is executed on that directory with devmode enabled'
When try is executed on that directory with devmode enabled
+ snap try /home/gopath/src/github.com/snapcore/snapd/tests/lib/snaps/test-snapd-tools --devmode
test-snapd-tools 1.0 mounted from /home/gopath/src/github.com/snapcore/snapd/tests/lib/snaps/test-snapd-tools
+ echo 'Then the snap command is able to access the protected resource'
Then the snap command is able to access the protected resource
+ test-snapd-tools.head -1 /dev/kmsg
cannot snap-exec: cannot read info for "test-snapd-tools": cannot find installed snap "test-snapd-tools" at revision x3

mount reports:

qemu:ubuntu-14.04-64 .../tests/main/try# mount
/dev/sda1 on / type ext4 (rw)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/cgroup type tmpfs (rw)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
udev on /dev type devtmpfs (rw,mode=0755)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755)
none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880)
none on /run/shm type tmpfs (rw,nosuid,nodev)
none on /run/user type tmpfs (rw,noexec,nosuid,nodev,size=104857600,mode=0755)
none on /sys/fs/pstore type pstore (rw)
tracefs on /var/lib/ureadahead/debugfs/tracing type tracefs (rw,relatime)
systemd on /sys/fs/cgroup/systemd type cgroup (rw,noexec,nosuid,nodev,none,name=systemd)
/var/lib/snapd/snaps/core_6.snap on /snap/core/6 type squashfs (ro)
/home/gopath/src/github.com/snapcore/snapd/tests/lib/snaps/test-snapd-tools on /snap/test-snapd-tools/x1 type none (rw,bind)
/home/gopath/src/github.com/snapcore/snapd/tests/lib/snaps/test-snapd-tools on /snap/test-snapd-tools/x2 type none (rw,bind)
/home/gopath/src/github.com/snapcore/snapd/tests/lib/snaps/test-snapd-tools on /snap/test-snapd-tools/x3 type none (rw,bind)

snap list reports:

qemu:ubuntu-14.04-64 .../tests/main/try# snap list
Name Version Rev Developer Notes
core 16.04.1 6 canonical -
test-snapd-tools 1.0 x3 devmode,try

[Thomas Voß (thomas-voss)]

The following setup gives me a working shell

> export SNAP_NAME=test-snapd-tools
> /usr/lib/snapd/snap-confine snap.test-snapd-tools.head /bin/bash

with the following /proc/self/mountinfo:

qemu:ubuntu-14.04-64 .../tests/main/try# cat /proc/self/mountinfo
79 48 7:0 / / rw,relatime - squashfs /dev/loop0 ro
80 79 0:6 / /dev rw,relatime - devtmpfs udev rw,size=736824k,nr_inodes=184206,mode=755
81 80 0:14 / /dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=000
82 79 8:1 /etc /etc rw,relatime - ext4 /dev/sda1 rw,data=ordered
83 79 8:1 /home /home rw,relatime - ext4 /dev/sda1 rw,data=ordered
84 79 8:1 /root /root rw,relatime - ext4 /dev/sda1 rw,data=ordered
85 79 0:4 / /proc rw,nosuid,nodev,noexec,relatime - proc proc rw
86 79 0:17 / /sys rw,nosuid,nodev,noexec,relatime - sysfs sysfs rw
87 86 0:19 / /sys/fs/cgroup rw,relatime - tmpfs none rw,size=4k,mode=755
88 87 0:25 / /sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,relatime - cgroup systemd rw,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd
89 87 0:26 / /sys/fs/cgroup/cpuset rw,relatime - cgroup cgroup rw,cpuset
90 87 0:27 / /sys/fs/cgroup/cpu rw,relatime - cgroup cgroup rw,cpu
91 87 0:28 / /sys/fs/cgroup/cpuacct rw,relatime - cgroup cgroup rw,cpuacct
92 87 0:29 / /sys/fs/cgroup/blkio rw,relatime - cgroup cgroup rw,blkio
93 87 0:30 / /sys/fs/cgroup/memory rw,relatime - cgroup cgroup rw,memory
94 87 0:31 / /sys/fs/cgroup/devices rw,relatime - cgroup cgroup rw,devices
95 87 0:32 / /sys/fs/cgroup/freezer rw,relatime - cgroup cgroup rw,freezer
96 87 0:33 / /sys/fs/cgroup/net_cls rw,relatime - cgroup cgroup rw,net_cls
97 87 0:34 / /sys/fs/cgroup/perf_event rw,relatime - cgroup cgroup rw,perf_event
98 87 0:35 / /sys/fs/cgroup/net_prio rw,relatime - cgroup cgroup rw,net_prio
99 87 0:36 / /sys/fs/cgroup/hugetlb rw,relatime - cgroup cgroup rw,hugetlb
100 87 0:37 / /sys/fs/cgroup/pids rw,relatime - cgroup cgroup rw,pids
101 86 0:20 / /sys/fs/fuse/connections rw,relatime - fusectl none rw
102 86 0:7 / /sys/kernel/debug rw,relatime - debugfs none rw
103 86 0:12 / /sys/kernel/security rw,relatime - securityfs none rw
104 86 0:24 / /sys/fs/pstore rw,relatime - pstore none rw
105 79 8:1 /tmp /tmp rw,relatime - ext4 /dev/sda1 rw,data=ordered
106 105 7:0 / /tmp/snap.rootfs_aECzku rw,relatime - squashfs /dev/loop0 ro
107 106 0:6 / /tmp/snap.rootfs_aECzku/dev rw,relatime - devtmpfs udev rw,size=736824k,nr_inodes=184206,mode=755
108 107 0:14 / /tmp/snap.rootfs_aECzku/dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=000
109 106 8:1 /etc /tmp/snap.rootfs_aECzku/etc rw,relatime - ext4 /dev/sda1 rw,data=ordered
110 106 8:1 /home /tmp/snap.rootfs_aECzku/home rw,relatime - ext4 /dev/sda1 rw,data=ordered
111 106 8:1 /root /tmp/snap.rootfs_aECzku/root rw,relatime - ext4 /dev/sda1 rw,data=ordered
112 106 0:4 / /tmp/snap.rootfs_aECzku/proc rw,nosuid,nodev,noexec,relatime - proc proc rw
113 106 0:17 / /tmp/snap.rootfs_aECzku/sys rw,nosuid,nodev,noexec,relatime - sysfs sysfs rw
114 113 0:19 / /tmp/snap.rootfs_aECzku/sys/fs/cgroup rw,relatime - tmpfs none rw,size=4k,mode=755
115 114 0:25 / /tmp/snap.rootfs_aECzku/sys/fs/cgroup/systemd rw,nosuid,nodev,noexec,...

[Zygmunt Krynicki (zyga)]

This might be bind vs rbind but I need to check. Thanks for attaching mountinfo.

[Zygmunt Krynicki (zyga)]

Can you please re-check with snap-confine 1.0.44 that is in the image PPA?

[Zygmunt Krynicki (zyga)]

This was traced to missing "mount --bind /snap; mount --make-rshared /snap" that was previously done by systemd (where it is pid 1). This was fixed (at the moment it hasn't landed yet) through the snapd 14.04 enablement patches.

[Michael Vogt (mvo)]

This bug is "in-progress" for a long time, is this status still accurate?