cgroup-lite fails to install in container in precise

[Serge Hallyn]

====================================
SRU Justification
1. Impact: apt-get install cgroup-lite fails
2. Development fix: /bin/cgroup-mount was changed quite a bit to not fail
3. Stable fix: some of the devel fixes are not appropriate. So instead, just do '/bin/cgroup-mount || { stop; exit 0 } in the upstart job
4. test case:
 sudo apt-get -y install lxc
 sudo lxc-create -t ubuntu -n p1 -- -r precise
 sudo lxc-start -n p1
   # log in
   sudo apt-get -y install cgroup-lite
          # this will fail
5. Regression potential: users may now think that cgroups are available for use (i.e. by lxc) when in fact they are not.

In a stock apparmor-protected container on precise, apt-get install cgroup-lite fails.

This is because it cannot mount cgroups.

Discussion on irc suggests the best fix is to make the cgroup-lite upstart job {stop; exit 0;} if /bin/mount-cgroup fails. That way package install will succeed, but the
upstart job won't be running, which users can detect.

[Serge Hallyn (serge-hallyn)]

This was fixed some time ago in more recent releases, inadvertently by working around the fact that /sys/fs/cgroups/* may have been already mounted by cgroup-bin.

[Brian Murray (brian-murray)]

Hello Serge, or anyone else affected,

Accepted cgroup-lite into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cgroup-lite/1.1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Simon Déziel (sdeziel)]

The -proposed package fails to install. Adding "set -x" to the postinst script gives this:

# apt-get -f install
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up cgroup-lite (1.1.3) ...
+ [ -e /etc/init/cgroup-lite.conf ]
+ invoke-rc.d cgroup-lite start
start: Job failed to start
invoke-rc.d: initscript cgroup-lite, action "start" failed.
+ exit 1
dpkg: error processing cgroup-lite (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 cgroup-lite
E: Sub-process /usr/bin/dpkg returned an error code (1)

# cat /var/log/upstart/cgroup-lite.log
mount: special device cgroup does not exist
/proc/self/fd/9: 4: /proc/self/fd/9: {stop: not found
umount: memory: not mounted

[Simon Déziel (sdeziel)]

Note that I use the boot command line "cgroup_disable=memory" but I don't know if that alone is explaining the problem.

[Simon Déziel (sdeziel)]

Not using "cgroup_disable=memory" fixed the issue:

# apt-get -f install
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up cgroup-lite (1.1.3) ...
+ [ -e /etc/init/cgroup-lite.conf ]
+ invoke-rc.d cgroup-lite start
+ update-rc.d -f cgroup-lite remove

Since the problem was caused by a manually added boot option, I'm not sure it should fail verification. Please feel free to mark it "verification-done" if deemed appropriate.

[Serge Hallyn (serge-hallyn)]

Hi,

this actually didn't seem to fix it for me. Sorry, I need to dig a
bit deeper and ask some questions.

In particular, the new version, after package installation, handles
'start/stop' the way I'd expect. But the package install itself appears
to be failing when the upstart job tries to start and does {stop; exit 0}

I'll look at this more tomorrow and see if I made a mistake in my
testing.

[Serge Hallyn (serge-hallyn)]

Quoting Brian Murray (<email address hidden>):
> Hello Serge, or anyone else affected,
>
> Accepted cgroup-lite into precise-proposed. The package will build now

Hi Brian,

this package did not fix the problem. I've pushed two new versions of
1.1.4 for precise-proposed, however I've decided they are not right
either. I will push a new version of 1.1.4 which pulls all the
/bin/cgroups-mount changes from trusty.

[Serge Hallyn (serge-hallyn)]

I've pushed a new version of 1.1.4, with changelog:

 cgroup-lite (1.1.4) precise-proposed; urgency=medium
 .
   * debian/cgroup-lite.upstart: undo 1.1.3 changes
   * scripts/*: pull in changes from trusty to make the scripts more
     robust to previous mounts and/or mount failures.
 .
 cgroup-lite (1.1.3) precise-proposed; urgency=low
 .
   * debian/cgroup-lite.upstart: stop and exit 0 if mount-cgroups failed.
     (LP: #1257857)

Please accept it and drop 1.1.3 and the two other (earlier) 1.1.4's.

Sorry for how much work this is turning into.

[Brian Murray (brian-murray)]

Hello Serge, or anyone else affected,

Accepted cgroup-lite into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cgroup-lite/1.1.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Serge Hallyn (serge-hallyn)]

Thanks - this fixed it for me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cgroup-lite - 1.1.4

---------------
cgroup-lite (1.1.4) precise-proposed; urgency=medium

  * debian/cgroup-lite.upstart: undo 1.1.3 changes
  * scripts/*: pull in changes from trusty to make the scripts more
    robust to previous mounts and/or mount failures.

cgroup-lite (1.1.3) precise-proposed; urgency=low

  * debian/cgroup-lite.upstart: stop and exit 0 if mount-cgroups failed.
    (LP: #1257857)
 -- Serge Hallyn <email address hidden> Wed, 18 Dec 2013 11:48:47 -0600

[Colin Watson (cjwatson)]

The verification of the Stable Release Update for cgroup-lite has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[gizero (gizero-gmail)]

Upgrading ubuntu server 12.04 today still fails with the following:

$ sudo apt-get install -f
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Setting up cgroup-lite (1.1.4) ...
start: Job failed to start
invoke-rc.d: initscript cgroup-lite, action "start" failed.
dpkg: error processing cgroup-lite (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 cgroup-lite
E: Sub-process /usr/bin/dpkg returned an error code (1)

Also reported at http://askubuntu.com/questions/401268/dpkg-error-processing-cgroup-lite-configure#new-answer?newreg=4db336bfa0b248e2965009cec7186ee8

[Michael Schaller (misch-9)]

Workaround / Fix:

$ sudo sed -i 's|{stop|{ stop|g' /etc/init/cgroup-lite.conf

$ sudo dpkg --configure cgroup-lite
Setting up cgroup-lite (1.1.4) ...
cgroup-lite start/running

[Eduard Hasenleithner (eduard-hasenleithner)]

Upgrade fails also for me.

[kapsi (kapsi-precise)]

It seems, that there is a missing whitespace in the config file ;)

Thanks to Michael Schaller (misch-9)!

[Diego Amor (diegoamor)]

misch-9 confirmed!!! is the white space!!!

[Serge Hallyn (serge-hallyn)]

Hm, I can't reproduce this. The existing package starts fine for me.

[Serge Hallyn (serge-hallyn)]

The whitespace fix has been queued for a hopefully quick SRU - however for you to hit this means you'll likely still have a (unfathomable to me) case where /bin/cgroups-mount is returning an error. If/when that happens, please do open a new bug.

[Philipp Kern (pkern)]

Another bug has been opened for this regression: https://bugs.launchpad.net/ubuntu/+source/cgroup-lite/+bug/1266993 — Serge, is the SRU tracked in a bug?

[kapsi (kapsi-precise)]

Whitespace bug is fixed with a new update.
Thanks

[Philipp Kern (pkern)]

So this is https://launchpad.net/ubuntu/+source/cgroup-lite/1.1.5 then.

[Serge Hallyn (serge-hallyn)]

> Serge, is the SRU tracked in a bug?

No, the fix was pushed before one of the separate bugs was opened.