mkdir failure on NFS with Apparmor

Bug #874544 reported by Ben Beuchler
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Won't Fix
Undecided
John Johansen

Bug Description

Ubuntu 2.6.24-29.94-server

We've encountered what appears to be the same issue as #415632, but on Hardy. The patch attached to #415632 will not apply on Hardy. In specific circumstances, attempting to call mkdir() from within an app with an active AppArmor profile results in failure of the mkdir() and the following log message:

Oct 12 13:33:06 node02 kernel: [ 1094.498142] audit(1318444386.721:15): type=1503 operation="inode_mkdir" info="Failed name resolution - object not a valid entry" error=-2 requested_mask="w::" denied_mask="w::" pid=7283 profile="/usr/sbin/apache2//www.example.com" namespace="default"

Repro steps:

1) Create an apparmor hat that allows rw on an NFS-mounted directory and its subdirectories.
2) Execute code that attempts to create new subdirectories under this directory.
3) Observe that, unreliably, some combinations of mkdir()/rmdir() will result in failure of the mkdir() call and the above AppArmor log entry.

The order of events necessary to trigger the bug seems to vary depending on how mkdir() is called (via the languages built-in mkdir interface or via a system() call). Multiple hosts mounting the same NFS filesystem seem to affect each other. Calling mkdir() or rmdir() on one host affects whether or not it will subsequently succeed on another host.

Unfortunately I can't be more specific as there appears to be a random element that causes carefully elicited patterns to suddenly and spontaneously change, causing the sysadmins to scream in agony and tear at their hair.

Tags: patch
Revision history for this message
Ben Beuchler (insyte) wrote :
Revision history for this message
Brad Figg (brad-figg) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 874544

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Ben Beuchler (insyte) wrote :

apport-collect is not available in Hardy.

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Changed in linux (Ubuntu):
assignee: nobody → John Johansen (jjohansen)
Revision history for this message
John Johansen (jjohansen) wrote :

I have placed some test kernels up at

people.canonical.com/~jj/linux-headers-2.6.24-29-server_2.6.24-29.94~lp874544_amd64.deb
people.canonical.com/~jj/linux-headers-2.6.24-29-server_2.6.24-29.94~lp874544_i386.deb
people.canonical.com/~jj/linux-image-2.6.24-29-server_2.6.24-29.94~lp874544_amd64.deb
people.canonical.com/~jj/linux-image-2.6.24-29-server_2.6.24-29.94~lp874544_i386.deb

Revision history for this message
John Johansen (jjohansen) wrote :
tags: added: patch
Revision history for this message
Brad Figg (brad-figg) wrote :

@ben,

There have been test kernels out for two months now with no feedback on if they've been tested or not and if they work or not. I am marking this Incomplete and it will expire in 60 days without some feedback.

Changed in linux (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Po-Hsu Lin (cypressyew) wrote :

Closing this bug with Won't fix as this kernel is no longer supported.
Please feel free to open a new bug report if you're still experiencing this on a newer release (Bionic 18.04.3 / Disco 19.04)
Thanks!

Changed in linux (Ubuntu):
status: Incomplete → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.