Comment 1 for bug 1931064

On Mon, Jun 07, 2021 at 05:14:50AM -0000, Andrea Righi wrote:
> Public bug reported:
>
> The lxc autotest is failing with the following error(s) on the latest
> kernel linux-unstable 5.13:
>
> FAIL: lxc-tests: lxc-test-apparmor (1s)
> ---
> failed - opened /sys/kernel/uevent_helper
> ---
> PASS: lxc-tests: lxc-test-apparmor-generated (0s)
> PASS: lxc-tests: lxc-test-apparmor-mount (29s)
> FAIL: lxc-tests: lxc-test-attach (1s)
> ---
> attach.c: 410: main: Using "/tmp/attach_x8lgO2" as temporary log file for container lxc-attach-test
>
> I was able to bisect the problem and found that the offending commit is:
>
> bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 ("proc: Check /proc/$pid/attr/
> writes against file opener")
>
> This commit looks like a sane fix, so simply reverting it in the kernel
> doesn't seem a viable solution.
>
> I think we should address and understand the issue in the lxc package.

So this failure implies that the
/sys/kernel/uevent_helper
file that we denied access to via AppArmor can now be opened. And then
lxc-test-attach reports an LSM label mismatch in the link you posted
below too so that seems scary...

>
> Detailed log of the failure: https://autopkgtest.ubuntu.com/results
> /autopkgtest-impish-canonical-kernel-team-
> bootstrap/impish/amd64/l/lxc/20210601_082733_a3ae4@/log.gz
>
> ** Affects: lxc (Ubuntu)
> Importance: Undecided
> Status: New
>
> ** Description changed:
>
> The lxc autotest is failing with the following error(s) on the latest
> kernel linux-unstable 5.13:
>
> FAIL: lxc-tests: lxc-test-apparmor (1s)
> ---
> failed - opened /sys/kernel/uevent_helper
> ---
> PASS: lxc-tests: lxc-test-apparmor-generated (0s)
> PASS: lxc-tests: lxc-test-apparmor-mount (29s)
> FAIL: lxc-tests: lxc-test-attach (1s)
> ---
> attach.c: 410: main: Using "/tmp/attach_x8lgO2" as temporary log file for container lxc-attach-test
>
> I was able to bisect the problem and found that the offending commit is:
>
> bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 ("proc: Check /proc/$pid/attr/
> writes against file opener")
>
> This commit looks like a sane fix, so simply reverting it in the kernel
> doesn't seem a viable solution.
>
> I think we should address and understand the issue in the lxc package.
> +
> + Detailed log of the failure: https://autopkgtest.ubuntu.com/results
> + /autopkgtest-impish-canonical-kernel-team-
> + bootstrap/impish/amd64/l/lxc/20210601_082733_a3ae4@/log.gz
>
> --
> You received this bug notification because you are a member of Ubuntu
> containers team, which is subscribed to lxc in Ubuntu.
> Matching subscriptions: lxc
> https://bugs.launchpad.net/bugs/1931064
>
> Title:
> lxc autotest failure with kernel >= 5.13
>
> Status in lxc package in Ubuntu:
> New
>
> Bug description:
> The lxc autotest is failing with the following error(s) on the latest
> kernel linux-unstable 5.13:
>
> FAIL: lxc-tests: lxc-test-apparmor (1s)
> ---
> failed - opened /sys/kernel/uevent_helper
> ---
> PASS: lxc-tests: lxc-test-apparmor-generated (0s)
> PASS: lxc-tests: lxc-test-apparmor-mount (29s)
> FAIL: lxc-tests: lxc-test-attach (1s)
> ---
> attach.c: 410: main: Using "/tmp/attach_x8lgO2" as temporary log file for container lxc-attach-test
>
> I was able to bisect the problem and found that the offending commit
> is:
>
> bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 ("proc: Check
> /proc/$pid/attr/ writes against file opener")
>
> This commit looks like a sane fix, so simply reverting it in the
> kernel doesn't seem a viable solution.
>
> I think we should address and understand the issue in the lxc package.
>
> Detailed log of the failure: https://autopkgtest.ubuntu.com/results
> /autopkgtest-impish-canonical-kernel-team-
> bootstrap/impish/amd64/l/lxc/20210601_082733_a3ae4@/log.gz
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1931064/+subscriptions