KVM guest execution start apparmor blocks on /dev/ptmx now (regression?)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apparmor (Ubuntu) |
Won't Fix
|
Undecided
|
Unassigned | ||
linux (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
lxc (Ubuntu) |
Fix Released
|
Wishlist
|
Christian Brauner | ||
lxd (Ubuntu) |
Invalid
|
Undecided
|
Unassigned |
Bug Description
Setup:
- Xenial host
- lxd guests with Trusty, Xenial, ...
- add a LXD profile to allow kvm [3] (inspired by stgraber)
- spawn KVM guests in the LXD guests using the different distro release versions
- guests are based on the uvtool default template which has a serial console [4]
Issue:
- guest starting with serial device gets blocked by apparmor and killed on creation
- This affects at least ppc64el and x86 (s390x has no serial concept that would match)
- This appeared in our usual checks on -proposed releases so maybe we can/should stop something?
Last good was "Apr 5, 2017 10:40:50 AM" first bad one "Apr 8, 2017 5:11:22 AM"
Background:
We use this setup for a while and it was working without a change on our end.
Also the fact that it still works in the Trusty LXD makes it somewhat suspicious.
Therefore I'd assume an SRUed change in LXD/Kernel/Apparmor might be the reason and open this bug to get your opinion on it.
You can look into [1] and search for uvt-kvm create in it.
Deny in dmesg:
[652759.606218] audit: type=1400 audit(149267135
Qemu-log:
2017-04-
There was a similar issue on qmeu namespacing (which we don't use on any of these releases) [2].
While we surely don't have the "same" issue the debugging on the namespacing might be worth as it could be related.
Workaround for now:
- drop serial section from guest xml
[1]: https:/
[2]: https:/
[3]: https:/
[4]: https:/
---
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: ppc64el
DistroRelease: Ubuntu 16.04
NonfreeKernelMo
Package: lxd
PackageArchitec
ProcKernelCmdline: root=UUID=
ProcLoadAvg: 3.15 3.02 3.83 1/3056 79993
ProcSwaps:
Filename Type Size Used Priority
/swap.img file 8388544 0 -1
ProcVersion: Linux version 4.4.0-72-generic (buildd@
ProcVersionSign
Syslog:
Tags: xenial uec-images
Uname: Linux 4.4.0-72-generic ppc64le
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: utah
_MarkForUpload: True
cpu_cores: Number of cores present = 20
cpu_coreson: Number of cores online = 20
cpu_smt: SMT is off
---
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: ppc64el
DistroRelease: Ubuntu 16.04
NonfreeKernelMo
Package: lxd
PackageArchitec
ProcEnviron:
TERM=xterm
PATH=(custom, no user)
LANG=C.UTF-8
SHELL=/bin/bash
ProcKernelCmdline: root=UUID=
ProcLoadAvg: 5.56 5.25 4.60 1/3057 3526
ProcSwaps:
Filename Type Size Used Priority
none virtual 8388544 8388544 0
ProcVersion: Linux version 4.4.0-72-generic (buildd@
ProcVersionSign
Syslog:
Tags: xenial uec-images
Uname: Linux 4.4.0-72-generic ppc64le
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:
_MarkForUpload: True
cpu_cores: Number of cores present = 20
cpu_coreson: Number of cores online = 20
cpu_smt: SMT is off
---
AlsaDevices:
total 0
crw-rw---- 1 root audio 116, 1 Apr 12 17:37 seq
crw-rw---- 1 root audio 116, 33 Apr 12 17:37 timer
AplayDevices: Error: [Errno 2] No such file or directory
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: ppc64el
ArecordDevices: Error: [Errno 2] No such file or directory
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
DistroRelease: Ubuntu 16.04
IwConfig: Error: [Errno 2] No such file or directory
Lsusb:
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
NonfreeKernelMo
Package: linux (not installed)
PciMultimedia:
ProcFB:
ProcKernelCmdLine: root=UUID=
ProcLoadAvg: 6.01 5.68 4.92 1/3060 83740
ProcSwaps:
Filename Type Size Used Priority
/swap.img file 8388544 0 -1
ProcVersion: Linux version 4.4.0-72-generic (buildd@
ProcVersionSign
RelatedPackageV
linux-
linux-
linux-firmware 1.157.8
RfKill: Error: [Errno 2] No such file or directory
Tags: xenial uec-images
Uname: Linux 4.4.0-72-generic ppc64le
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: utah
_MarkForUpload: True
cpu_cores: Number of cores present = 20
cpu_coreson: Number of cores online = 20
cpu_dscr: DSCR is 0
cpu_freq:
min: 3.691 GHz (cpu 120)
max: 3.691 GHz (cpu 8)
avg: 3.691 GHz
cpu_runmode:
Could not retrieve current diagnostics mode,
No kernel interface to firmware
cpu_smt: SMT is off
tags: | added: regression-proposed |
tags: | added: kernel-da-key |
Changed in linux (Ubuntu): | |
importance: | Undecided → Medium |
Changed in lxc (Ubuntu): | |
status: | In Progress → Fix Committed |
assignee: | nobody → Christian Brauner (cbrauner) |
Changed in lxc (Ubuntu): | |
status: | Fix Committed → Fix Released |
This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:
apport-collect 1684481
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.