QRT test-kernel-security's seccomp_filter test failed on 3.0.0-15

[C de-Avillez]

running the QRT for Kernel SRU on Oneiric, 3.0.0.15 (tracking bug 903188).

======================================================================
FAIL: test_110_seccomp_filter (__main__.KernelSecurityTest)
seccomp_filter works
----------------------------------------------------------------------
Traceback (most recent call last):
  File "./test-kernel-security.py", line 1370, in test_110_seccomp_filter
    self.assertShellExitEquals(expected, ["./seccomp_tests"])
  File "/home/ubuntu/qrt-test-kernel/testlib.py", line 923, in assertShellExitEquals
    self.assertEquals(expected, rc, msg + result + report)
AssertionError: Got exit code 1, expected 0
Command: './seccomp_tests'
Output:
FAIL :: mode_one_ok
FAIL :: mode_one_kill
FAIL :: mode_one_ok
FAIL :: mode_one_kill
PASS :: add_filter_too_long
FAIL :: mode_one_ok
FAIL :: mode_one_kill
PASS :: add_filter_too_long
PASS :: add_filter_too_short
Read in:
Mode: 13
1 (sys_exit): (error_code == 0 || error_code == 1) && (error_code != 1)
3 (sys_read): 1
4 (sys_write): fd == 1
5 (sys_open): 1
6 (sys_close): 1
33 (sys_access): 1
45 (sys_brk): 1
91 (sys_munmap): 1
122 (sys_newuname): 1
125 (sys_mprotect): 1
172 (sys_prctl): option > 32 && option < 37
192 (sys_mmap_pgoff): 1
197 (sys_fstat64): 1
243 (unknown): 1
FAIL :: mode_one_ok
FAIL :: mode_one_kill
PASS :: add_filter_too_long
PASS :: add_filter_too_short
PASS :: add_filter_null
PASS :: add_bool_apply
PASS :: add_bool_apply_event
PASS :: add_bool_apply_fail
PASS :: add_bool_apply_get
PASS :: add_bool_apply_add
PASS :: add_bool_apply_drop
PASS :: add_bool_apply_drop_die
PASS :: add_ftrace_apply
PASS :: add_ftrace_apply_fail
PASS :: add_ftrace_apply_get
PASS :: add_ftrace_apply_append_get
PASS :: add_drop_ftrace_proc
PASS :: keep_exec
PASS :: keep_exec_drop
PASS :: lose_exec

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: linux-image-3.0.0-15-virtual 3.0.0-15.24
ProcVersionSignature: User Name 3.0.0-15.24-virtual 3.0.13
Uname: Linux 3.0.0-15-virtual i686
AlsaDevices:
 total 0
 crw-rw---- 1 root audio 116, 1 Dec 14 16:19 seq
 crw-rw---- 1 root audio 116, 33 Dec 14 16:19 timer
AplayDevices: Error: [Errno 2] No such file or directory
ApportVersion: 1.23-0ubuntu4
Architecture: i386
ArecordDevices: Error: [Errno 2] No such file or directory
Date: Wed Dec 14 18:34:11 2011
Ec2AMI: ami-bd4983d4
Ec2AMIManifest: ubuntu-us-east-1/images-testing/ubuntu-oneiric-daily-i386-server-20111214.manifest.xml
Ec2AvailabilityZone: us-east-1d
Ec2InstanceType: m1.small
Ec2Kernel: aki-805ea7e9
Ec2Ramdisk: unavailable
Lspci:

Lsusb: Error: command ['lsusb'] failed with exit code 1: unable to initialize libusb: -99
ProcKernelCmdLine: root=LABEL=cloudimg-rootfs ro console=hvc0
ProcModules:
 iptable_filter 12706 0 - Live 0x00000000
 ip_tables 18106 1 iptable_filter, Live 0x00000000
 x_tables 21975 2 iptable_filter,ip_tables, Live 0x00000000
 acpiphp 23408 0 - Live 0x00000000
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)

[C de-Avillez (hggdh2)]

Xen version: 3.0.3-rc5-8.1.14.f. I wonder if this is another aspect of bug 861843

[C de-Avillez (hggdh2)]

Discussed with JJ. This sounds very similar to bug 861843, but with different failures in the seccomp_filter test. End result is still a kernel GPF.

I will engage Ben and Scott.

[Ben Howard (darkmuggle-deactivatedaccount)]

Looking at the stack trace, I agree that this is looks like like bug 861843. We have been cleared by Amazon to disclose this specific issue as it only affects our kernel not the EC2 hyper-visor.

[John Johansen (jjohansen)]

I agree this looks like its bug 861843 and with seccomp passing on all other instances sizes tested I think we can pass this from a security regression pov.

[C de-Avillez (hggdh2)]

Making public, and setting bug 861843 as a duplicate of this one.

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 904381

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[C de-Avillez (hggdh2)]

The missing data, whatever it is, may be due to bug 904489.