Project

General

Profile

action #55412

[opensuse] test fails in sshd (cannot read /proc/sys/fs/pipe-max-size)

Added by msmeissn about 2 years ago. Updated about 2 years ago.

Status:
Resolved
Priority:
Urgent
Assignee:
Category:
Bugs in existing tests
Target version:
-
Start date:
2019-08-13
Due date:
% Done:

0%

Estimated time:
Difficulty:

Description

Observation

openQA test in scenario opensuse-15.0-DVD-Updates-x86_64-gnome@uefi fails in
sshd

Test suite description

Reproducible

Fails since (at least) Build 20190810-2

Expected result

Last good: 20190810-1 (or more recent)

Further details

Always latest result in this scenario: latest

History

#1 Updated by msmeissn about 2 years ago

problem is here I think:

[2019-08-13T04:45:49.342 CEST] [debug] /var/lib/openqa/cache/openqa1-opensuse/tests/opensuse/tests/console/sshd.pm:65 called opensusebasetest::select_serial_terminal
[2019-08-13T04:45:49.342 CEST] [debug] <<< testapi::select_console(testapi_console='root-virtio-terminal')
[2019-08-13T04:45:49.343 CEST] [debug] <<< consoles::virtio_terminal::open_pipe(pipe_prefix='/var/lib/openqa/pool/12/virtio_console')
[2019-08-13T04:45:49.345 CEST] [debug] Backend process died, backend errors are reported below in the following lines:
Can't open file "/proc/sys/fs/pipe-max-size": Permission denied at /usr/lib/os-autoinst/consoles/virtio_terminal.pm line 144.

[2019-08-13T04:45:49.345 CEST] [info] ::: OpenQA::Qemu::Proc::save_state: Saving QEMU state to qemu_state.json

#2 Updated by okurz about 2 years ago

  • Status changed from New to In Progress
  • Assignee set to okurz

#3 Updated by okurz about 2 years ago

pretty sure it's due to missing adjustements to apparmor due to gh#os-autoinst/os-autoinst#1182 from cfconrad/virtio_terminal_with_tcp

#4 Updated by okurz about 2 years ago

for i in power8 aarch64 imagetester openqaworker1 openqaworker4; do echo $i && ssh root@$i "aa-complain /usr/share/openqa/script/worker && systemctl restart openqa-worker.target"; done

retriggered incomplete jobs over web UI, monitoring https://openqa.opensuse.org/tests/1005501

Afterwards should adjust apparmor profile.

#5 Updated by okurz about 2 years ago

  • Status changed from In Progress to Feedback

https://openqa.opensuse.org/tests/1005515 is fine, https://github.com/os-autoinst/openQA/pull/2257 created for apparmor adjustement. After the roll-out of said PR I can enforce the profiles on all workers again.

#6 Updated by cfconrad about 2 years ago

I see. Yes this is my fault.
I think it is enough to allow reading /proc/sys/fs/pipe-max-size.
The other thing which comes into my mind could be mkfifo https://github.com/os-autoinst/os-autoinst/blob/master/backend/qemu.pm#L851 but I do not see such message in the logs.

#7 Updated by cfconrad about 2 years ago

I would like to enable apparmor in my test instance.
Is it enough to just start it with systemctl start apparmor ?

#8 Updated by okurz about 2 years ago

cfconrad wrote:

The other thing which comes into my mind could be mkfifo https://github.com/os-autoinst/os-autoinst/blob/master/backend/qemu.pm#L851 but I do not see such message in the logs.

yes, me neither. I guess the changes I proposed in the PR are enough.

#9 Updated by okurz about 2 years ago

cfconrad wrote:

I would like to enable apparmor in my test instance.
Is it enough to just start it with systemctl start apparmor ?

yes, this should be enough when you have the openQA package installed along with the profiles that should end up in /etc/apparmor.d/usr.share.openqa.script.openqa and /etc/apparmor.d/usr.share.openqa.script.worker . Take a look into /var/log/audit/audit.log for reports from apparmor what it denies. To have a better, complete picture the services should be separated so that a machine (or a container?) runs the worker only along with the worker profile and a different machine for the web UI and other services. I consider aa-complain <path/to/profile> and aa-enforce </path/to/profile> most helpful to selectively enable/disable profiles along with reports about violations in the aforementioned log file.

#10 Updated by cfconrad about 2 years ago

thanks a lot for that detailed answer!

#11 Updated by SLindoMansilla about 2 years ago

  • Subject changed from test fails in sshd (cannot read /proc/sys/fs/pipe-max-size) to [opensuse] test fails in sshd (cannot read /proc/sys/fs/pipe-max-size)

#12 Updated by okurz about 2 years ago

  • Status changed from Feedback to Resolved

the new packages have been rolled out, the profiles are enforced due to the automatic restart. I deleted the backup files with for i in power8 aarch64 imagetester openqaworker1 openqaworker4; do echo $i && ssh root@$i "rm -f /etc/apparmor.d/usr.share.openqa.script.worker.rpmsave"; done

Also available in: Atom PDF