QA (public) » openQA Project (public) » openQA Infrastructure (public)

I prepared a draft to add the package. The package doesn't seem to be built, though 🤔️

@okurz I am able to find the package at https://software.opensuse.org/download/package?package=swtpm&project=security

For openSUSE Leap 15.2 run the following as root:

zypper addrepo https://download.opensuse.org/repositories/security/openSUSE_Leap_15.2/security.repo
zypper refresh
zypper install swtpm

Not sure it can help.

@cdywan,

Seems workers have be upgraded to leap 15.3 already. then swtpm is available,right?

cdywan wrote:

The spec doesn't exclude any architecuture afair and I see aarch64 and ppc64le on devel:openQA for 15.3 🤔️

swtpm also installs fine on malbec, so it wouldn't seem like deps should have been a problem

The files are indeed not there:

https://download.opensuse.org/repositories/devel:/openQA/openSUSE_Leap_15.3/ppc64le/

Ah but of course, @okurz your PR placed the files in x86_64. So regardless of it being built on all architectures, it's not there :-D

https://github.com/os-autoinst/os-autoinst/pull/1891

I can see that the swtpm package is there.

however, later test failed with some permission denied issue: [Only on O3, OSD worked fine]

https://openqa.opensuse.org/tests/2100224#details

[2021-12-23T06:21:25.301401+01:00] [info] ::: backend::baseclass::die_handler: Backend process died, backend errors are reported below in the following lines:
  Can't mkdir('/tmp/mytpm1'): Permission denied at /usr/lib/os-autoinst/backend/qemu.pm line 520
[2021-12-23T06:21:25.301765+01:00] [info] ::: OpenQA::Qemu::Proc::save_state: Saving QEMU state to qemu_state.json

rfan1 wrote:

however, later test failed with some permission denied issue: [Only on O3, OSD worked fine]

https://openqa.opensuse.org/tests/2100224#details

[2021-12-23T06:21:25.301401+01:00] [info] ::: backend::baseclass::die_handler: Backend process died, backend errors are reported below in the following lines:
  Can't mkdir('/tmp/mytpm1'): Permission denied at /usr/lib/os-autoinst/backend/qemu.pm line 520
[2021-12-23T06:21:25.301765+01:00] [info] ::: OpenQA::Qemu::Proc::save_state: Saving QEMU state to qemu_state.json

Apparmor profiles for the worker need to be extended

rfan1 wrote:
however, later test failed with some permission denied issue: [Only on O3, OSD worked fine]

Confirmed. I ran the test from #101015 on malbec since that's the machine I was checking the package availability on earlier. And it has /usr/share/openqa/script/worker { ... /tmp/* rwk, ... } which is what's in openQA master.

I don't know what oss-cobbler-03 is, though, which your o3 job ran on. I can't get to it from my machine or o3 🤔️ It also seems to have no unique worker class meaning I couldn't do a smoke test on it even if I knew how to login.

So, why doesn't this machine probably have the apparmor rules we have in git?

cdywan wrote:

rfan1 wrote:
however, later test failed with some permission denied issue: [Only on O3, OSD worked fine]

Confirmed. I ran the test from #101015 on malbec since that's the machine I was checking the package availability on earlier. And it has /usr/share/openqa/script/worker { ... /tmp/* rwk, ... } which is what's in openQA master.

I don't know what oss-cobbler-03 is, though, which your o3 job ran on. I can't get to it from my machine or o3 🤔️ It also seems to have no unique worker class meaning I couldn't do a smoke test on it even if I knew how to login.

So, why doesn't this machine probably have the apparmor rules we have in git?

As discussed with internal team members, we didn't know how to access the o3 workers.
@okurz Do you know who is the right person maintaining the o3 workers?

BR//Richard.

It's likely maintained by @ggardet_arm, "guillaume_g" in irc://libera.chat/opensuse-factory

That's expected I guess, since schedule/security/tpm_tools.yaml is not part of https://github.com/os-autoinst/os-autoinst-distri-openSUSE

ggardet_arm wrote:

That's expected I guess, since schedule/security/tpm_tools.yaml is not part of https://github.com/os-autoinst/os-autoinst-distri-openSUSE

So should I simply disregard any issues here, if the test is not really maintained? As stated above I have no way of investigating why the apparmor profiles don't seem to match what's in git.

I installed os-autoinst-swtpm on the following workers:

• openqa-aarch64 (on openSUSE network)
• oss-cobbler-03 (Remote worker)

It is not installed on ip-10-0-0-58 (remote worker) because there is no such package available in repos (SLE15-SP2 machine).

Thanks all for the kindly help!

I can see the latest run failed again with worker 'openqaworker7':
https://openqa.opensuse.org/tests/2123351

rfan1 wrote:

Thanks all for the kindly help!

I can see the latest run failed again with worker 'openqaworker7':
https://openqa.opensuse.org/tests/2123351

This job failed in backend died: Can't mkdir('/tmp/mytpm1'): Permission denied at /usr/lib/os-autoinst/backend/qemu.pm line 520. In 'openqaworker7', there are two 'mkdir',

  openqaworker7:~ # whereis mkdir
  mkdir: /usr/bin/mkdir /bin/mkdir /usr/share/man/man1/mkdir.1.gz
  openqaworker7:~ # ll -h /bin/mkdir
  lrwxrwxrwx 1 root root 14 Sep 24 15:51 /bin/mkdir -> /usr/bin/mkdir

And we define the permission of /usr/bin/mkdir rix in 'usr.share.openqa.script.worker'. So I guess when we call 'mkdir' in the code, the '/bin/mkdir' is called, then it reports 'permission denied'. Maybe we could call '/usr/bin/mkdir' directly in the code.

Xiaojing_liu wrote:

rfan1 wrote:

Thanks all for the kindly help!

I can see the latest run failed again with worker 'openqaworker7':
https://openqa.opensuse.org/tests/2123351

This job failed in backend died: Can't mkdir('/tmp/mytpm1'): Permission denied at /usr/lib/os-autoinst/backend/qemu.pm line 520. In 'openqaworker7', there are two 'mkdir',

  openqaworker7:~ # whereis mkdir
  mkdir: /usr/bin/mkdir /bin/mkdir /usr/share/man/man1/mkdir.1.gz
  openqaworker7:~ # ll -h /bin/mkdir
  lrwxrwxrwx 1 root root 14 Sep 24 15:51 /bin/mkdir -> /usr/bin/mkdir

And we define the permission of /usr/bin/mkdir rix in 'usr.share.openqa.script.worker'. So I guess when we call 'mkdir' in the code, the '/bin/mkdir' is called, then it reports 'permission denied'. Maybe we could call '/usr/bin/mkdir' directly in the code.

Thank you for taking a look, Jane! This was a really good clue. I wasn't even thinking of the symlink situation - so this a bit like #99195#note-18 where the destination of /bin/sh changed in 15.3. And I keep forgetting we don't enable apparmor on osd.

https://github.com/os-autoinst/openQA/pull/4433

cdywan wrote:

Xiaojing_liu wrote:

This job failed in backend died: Can't mkdir('/tmp/mytpm1'): Permission denied at /usr/lib/os-autoinst/backend/qemu.pm line 520. In 'openqaworker7', there are two 'mkdir',

Something Tina brought up in the daily, even if mkdir is accessible subfolders under /tmp won't be. Which is why I think we also need the pattern fixed:

https://github.com/os-autoinst/openQA/pull/4434

Regarding /bin/mkdir vs. /usr/bin/mkdir - what apparmor needs to be allowed is the actual real path. It doesn't care about the symlinks.
See https://progress.opensuse.org/issues/99195#note-17

Also, for the bash issue https://progress.opensuse.org/issues/99195#note-8, the error message was:

Can't exec "/bin/sh": Permission denied at /usr/share/openqa/script/../lib/OpenQA/Task/Job/FinalizeResults.pm line 63.

The Can't exec comes from apparmor, while the Can't mkdir comes from the mkdir syscall. I would expect Can't exec "/usr/bin/mkdir" if it was an apparmor issue here.

tinita wrote:

Regarding /bin/mkdir vs. /usr/bin/mkdir - what apparmor needs to be allowed is the actual real path. It doesn't care about the symlinks.
See https://progress.opensuse.org/issues/99195#note-17

Also, for the bash issue https://progress.opensuse.org/issues/99195#note-8, the error message was:

Can't exec "/bin/sh": Permission denied at /usr/share/openqa/script/../lib/OpenQA/Task/Job/FinalizeResults.pm line 63.

The Can't exec comes from apparmor, while the Can't mkdir comes from the mkdir syscall. I would expect Can't exec "/usr/bin/mkdir" if it was an apparmor issue here.

I assume we only see one or the other, even if both apply. Thank you for elaborating, though, my comments were rather too concise.

Regarding mkdir, I think perl's mkdir doesn't use the /usr/bin/mkdir at all, but a syscall. if I remove it from my PATH variable, I can still execute mkdir in a perl script.

New issue hit now:

https://openqa.opensuse.org/tests/2133810#details

Reason: backend died: open3: exec of swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --log level=20 -d failed: Permission denied at /usr/lib/perl5/vendor_perl/5.26.1/Mojo/IOLoop/ReadWriteProcess.pm line 127.

rfan1 wrote:

New issue hit now:

https://openqa.opensuse.org/tests/2133810#details

Reason: backend died: open3: exec of swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --log level=20 -d failed: Permission denied at /usr/lib/perl5/vendor_perl/5.26.1/Mojo/IOLoop/ReadWriteProcess.pm line 127.

https://github.com/os-autoinst/openQA/pull/4449

cdywan wrote:

rfan1 wrote:

New issue hit now:

https://openqa.opensuse.org/tests/2133810#details

Reason: backend died: open3: exec of swtpm socket --tpmstate dir=/tmp/mytpm1 --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock --log level=20 -d failed: Permission denied at /usr/lib/perl5/vendor_perl/5.26.1/Mojo/IOLoop/ReadWriteProcess.pm line 127.

https://github.com/os-autoinst/openQA/pull/4449

@cdywan

Thanks for the quick fix, it can pass now.
https://openqa.opensuse.org/tests/2137553