[00:08] sbeattie: ugh.. the 5.5 test suite doesn't seem to want to be run out of tree. Probably will have to patch it a lot. :-P [00:11] sbeattie: oh wait.. hah.. no.. the problem is that mysql-testsuite is no longer a meta-package in 5.5 .. so installing it pulls in 5.1's test suite [00:12] SpamapS: oh! Haha. [00:12] * sbeattie sighs. [00:12] sbeattie: my bad. ;) I'll fix that in the upcoming 5.5.21 upload [00:12] SpamapS: thanks, appreciate you digging into it. [00:12] Still waiting for upstream to confirm that they do not believe it is safe to have a dynamically linked /usr/bin/mysql [01:26] New bug: #959856 in mod-wsgi (main) "installing mod-wsgi doesn't create link in /etc/apache2/mods-enabled" [Undecided,New] https://launchpad.net/bugs/959856 [01:40] New bug: #959864 in samba (main) "/etc/init.d/smbd is missing LSB information" [Undecided,New] https://launchpad.net/bugs/959864 [02:50] jjohansen: jdstrand: is there a sort of aa_get_profile() to complement aa_change_profile()? [02:50] really i just want to know if i'm confined. [02:50] (and if not, not try to transition) [02:59] hallyn: yes see man aa_getcon [02:59] jjohansen: thanks! [03:00] hallyn: note aa_get_peercon will only return an error atm because socket labeling isn't implemented yet [03:02] hallyn: also technically you are getting the context, which could be more than a profile, but since stacking isn't yet supported it is currently only a profile [03:02] also the profile name "unconfined" will indicate no confinement [03:03] hallyn: there should also be perl, python, and ruby bindings for those fns [04:09] hi is how do i change the resolution on my ubuntu server? [04:24] jjohansen: thanks. i only need c, and only want to check if i'm unconfined (if a transition failed) [04:39] jjohansen: hm, seems aa_onexec requires a different transition perm than aa_change_context [04:43] and http://wiki.apparmor.net/index.php/AppArmorAPIs uses wrong name (aa_onexec_profile) [04:44] all right i guess lxc will use aa_change_profile() for now. it'll work, though it's not really "correct" === JanC_ is now known as JanC [05:24] hallyn: hrmm, sorry about the wiki, its uhmm about the last documentation to get updated, I'll make sure it gets a refresh for those. change_onexec does use a slightly different variation to the change_profile perm. I look and see why it isn't working [06:16] is there a quick way to tunnel a request on a specific port through a ubuntu box/ [06:16] blendedbychris: ssh -L or ssh -D [06:16] blendedbychris: or ssh -R if you want to go from the remote to your local machine [06:18] SpamapS: can that watch for any application though that tries to use port 389 for instances [06:18] instance* [06:18] blendedbychris: no, thats just a quick and dirty tunnel.. you'd have to tell the app to use the tunnel [06:19] blendedbychris: if you want an IP level tunnel.. openvpn is pretty simple [06:20] what do you call the "middle" node? the proxy? [06:20] the openvpn method might work if i could set some arbitrary hostname [06:21] so ldap://proxy:389 -> 50.32.111.22 (my proxy) -> ldap://10.32.33.53:389 === bladernr_afk is now known as bladernr_ [06:30] blendedbychris: yeah, you could just use ssh for LDAP with 'ssh -L 389:10.32.33.53:389 50.32.111.22' [06:31] blendedbychris: but that would only work if you did that on every client [06:31] blendedbychris: for openvpn you're basically setting up an IP tunnel, so it gets more complicated [06:32] SpamapS: are you pretty familiar with ldap? [06:32] i'm kinda naive in the subject… [06:32] does the standard ldap:// protocol have encryption at all? [06:33] this really just solves half the problem is what i'm getting at … that internal server needs to be encrypted too ideally [06:34] blendedbychris: LDAP can use STARTTLS to do encryption, or you can run it fully wrapped in SSL as 'ldaps' which runs on port 636 [06:34] blendedbychris: depends on what your clients support. Most modern ones can do starttls [06:35] client meaning the app requesting say an ldap search? [06:39] blendedbychris: righ [06:46] SpamapS: gotcha… currently it looks like i am only able to connect via plaintext… [06:46] if i force TLS i get TLS: peer cert untrusted or revoked (0x42) [06:47] running ldapsearch -h 10.1.50.211 -p 389 -ZZ -d5 -b "" -s base "(objectClass=*)" [06:48] not sure if i've set my certs up properly though [06:48] blendedbychris: looks like no [06:49] FFS [06:49] blendedbychris: probably not trusted. Thats why people avoid end-to-end SSL.. its a nightmare to manage :) [06:49] do i have to grab the cert from the ldap server? [06:49] "Customer, you need to enable 88 and 464 from AD to your test VM for me to set up krb on it" "Them, I opened 88 and 464, what was your IP again?" [06:49] IOW I think they just opened their krb to the internet :-/ [06:50] too many acronyms [06:50] brain imploded [06:58] blendedbychris: this is a twinkie.. it represents the normal bad security energy on the internet for any one entity. Now, imagine a twinkie roughly the size of manhattan. [06:59] ugh [06:59] i'm ignoring that [06:59] tcpdump… how do i make it output the actual data instead of just the summary ? [07:01] haha [07:01] love it [07:02] SpamapS: where is that quote from? [07:02] Ghostbusters? [07:04] with TLS should I see unencrypted data in tcpdump? [07:06] blendedbychris: only the word "STARTTLS" [07:06] twb: thanks [07:07] blendedbychris: well that and maybe a EHLO or HELO or whatever, depends on the protocol [07:07] well definatly not the password right heh? [07:07] blendedbychris: you're using 389? [07:07] yes [07:07] Port 389 I mean [07:07] OK so that's starttls [07:07] the ldaps port is assumed to be TLSd from the get-go [07:08] wait what? [07:08] There are two ways of doing TLS. Either you use the plaintext port and start every conversation with "quick turn on TLS!" or you use a dedicated port. [07:08] twb: yes that was ghostbusters :) [07:08] e.g. smtps. imaps, ldaps are dedicated ports [07:08] SpamapS: good because I couldn't find the bloody quote... stupid ddg [07:09] it was really badly botched [07:09] http://en.wikiquote.org/wiki/Ghostbusters [07:09] i have a more important question… who the hell would enable 389 and not force starttls? [07:09] SpamapS: no kidding [07:09] blendedbychris: lazy people [07:09] Well, let's say this Twinkie represents the normal amount of psychokinetic energy in the New York area. Based on this morning's sample, it would be a Twinkie... thirty-five feet long, weighing approximately six hundred pounds. [07:09] I think I'm still doing it at some prisons [07:10] is it typical to run 686 with starttls? [07:10] blendedbychris: you can't run *starttls* on 636 [07:10] That only takes tls [07:10] gotcha [07:17] does this sound right… i'm asking my it dudes for the public cert and an account that has access to "poll" the directory [07:17] query the directory? [07:21] They should have a certificate hierarchy, and you should add their CA cert to your trusted cert list [07:21] isn't that what i'm asking for? [07:21] their public ca cert? [07:21] If they are stupid and lazy, instead of having a cert hierarchy, they will have self-signed certs everywhere, in which case you ask specifically for the cert they're using for LDAP [07:22] certs are always "public"; they're just public keys signed by other keypairs [07:22] okay so what's the smartest way i can ask heh [07:22] What are you actually trying to achieve? [07:22] get the cert and probably have them make another account to query ad [07:23] so i can use starttls [07:23] on some web server we run externally [07:23] currently we have an internal web server that is performing queries in plaintext [07:24] So ACTUALLY what is happening is you have a working AD LDAP/krb infrastructure, and you have a new httpd, and you want people to be able to log into web apps under the new httpd using their existing AD accounts? [07:24] correct [07:24] And everything is working except it's not encrypting the LDAP conversation? [07:25] well i am about to add another httpd that isn't even hosted internally so starttls is a must [07:25] but yes [07:25] OK [07:26] The new httpd is running Ubuntu 10.04? [07:26] ya [07:26] And is it apache, or what? [07:26] nginx [07:26] OK, is nginx using PADL libpam_ldap, or what? [07:27] php's whatever [07:27] is the client [07:27] Ugh [07:27] Do you know the path to the ldap.conf that is reading? [07:28] e.g. is it /etc/ldap.conf or /etc/ldap/ldap.conf [07:28] big ol guess that it's /etc/ldap/ldap.conf [07:28] You need to know what LDAP client it's using and what config file to edit [07:29] Ubuntu at a minimum has both the ones I just mentioned, used by different LDAP clients :-/ [07:29] let me double check [07:30] it's using openldap [07:30] On what do you base that conclusion? [07:31] Actually an easy way to test it would just be to put bullshit in the suspected file, restart the app, and see if it is broken [07:32] Looking at ldap.conf(5), it seems that you cannot say "always use starttls". You can either set an ldaps://... URI, in which case it uses tcp/636, or you can make sure the *app* issues a starttls by configuring the app. [07:33] FWIW I just use ldaps, although the #openldap people didn't seem to like that [07:33] ya [07:33] everything i read it's "dated" [07:33] whatever [07:34] twb: i'm basing that conclusion on php manual i guess…. it mentions openldap [07:35] http://paste.debian.net/160386/ is what my ldap.conf looks like; I symlink /etc/ldap.conf and /etc/ldap/ldap.conf together; the #openldap people hate that, too. [07:35] Note that "ldap" resolves to my LDAP server, which listens on 636/tcp, and cyber.pem is my CA cert [07:36] righto [07:36] either way though i just need to ask for a the ca cert for ldap and an account to do queries [07:37] IMO your first step is to make sure 636 is open [07:37] why? i don't care to use ldaps i just want to use starttls [07:37] 18:32 Looking at ldap.conf(5), it seems that you cannot say "always use starttls". You can either set an ldaps://... URI, in which case it uses tcp/636, or you can make sure the *app* issues a starttls by configuring the app. [07:38] hrm [07:38] i see what you are saying [07:38] the server needs to force starttls [07:38] If you want to use starttls specifically, rather than "I want the traffic encrypted", then you'll need to ask #php for help [07:38] imho [07:38] blendedbychris: if the ldap server only allows starttls, then you'd have a non-working system AFAICT [07:39] indeed [07:39] The starttls request is issued by the client side [07:39] i should have a non-working system because the system that is working is working in such a way that it shouldn't :) [07:40] Either the libldap to use 636 which implicitly forces TLS, or ask #php or whatever how to force starttls [07:40] okay… [07:40] thanks… you have gone above and beyond my desired wishes [07:41] Er, s/the/tell/ [07:41] Be grateful they don't want SPNEGO [07:58] if I install a dependency with dpkg -s bladep.deb then run apt-get install thing_that_needs_that_dep [07:58] will it pick up bladep? [08:11] New bug: #959990 in ntp (main) "unnecessary ntpdate invokation" [Undecided,New] https://launchpad.net/bugs/959990 [08:12] sabgenton: use apt, not dpkg [08:12] twb: dude the very reason I'm asking this is for times when my package isn't in a repository [08:13] You should tell your vendor to fix that [08:13] twb: or are you saying I can use apt on a .deb? [08:15] twb: I very much dought ubuntu is going to repo every thing I ask for [08:16] If some random crack-head makes a .deb and doesn't know how to put it in an apt repo, it is probably not a good deb for you to install. [08:19] I think that's a bit rude to call someone who doesn't use debian or ubuntu a crack-head [08:19] I'm not interested in your opinions. [08:20] twb: do I basicly have to make a PPA if I want a deb to be known to apt? [08:20] twb: sorry [08:21] sabgenton: not everyone is twb :) just because someone stuffs it into a repo doesn't magically make it better. [08:21] sabgenton: this is a deb *you* made? [08:21] greppy: better for the end users than gdebi, which will ignore Recommends and generally make a mess of things. [08:22] greppy: but sure, putting it in apt won't make it better, but hopefully someone who knows how to do that, also knows how to use things like lintian [08:23] no I didn't make the .deb [08:24] and I don't really want to talk about one .deb because I have had countless times where there's something I want to install that is a .deb but not in a repo [08:24] greppy: Is PPA the only way to make apt happy [08:24] ? [08:24] only decent way [08:25] You shouldn't install such things because they're very likely to be crap quality and mess up your system [08:25] webmin would be a textbook example; its deb has three critical errors and hundreds of minor errors [08:26] twb: even the deb in the ubuntu repos? [08:26] (webmins in the repos right) [08:26] !webmin [08:26] webmin is no longer supported in Debian and Ubuntu. It is not compatible with the way that Ubuntu packages handle configuration files, and is likely to cause unexpected issues with your system. [08:26] heh ok [08:27] interesting did not know that [08:27] twb: so say I do make my own private package then [08:28] And I don't want to upload it to ubuntus repo [08:29] whats the best way to get it working with apt's dependency knowlage? [08:29] Probably sbuild or pdebuild and reprepro [08:30] twb: ok, which is more preferable out of the two [08:30] I haven't used sbuild before. [08:31] I think pbuilder is "good enough"; sbuild is better but harder to get started with [08:31] wait do those tools just make .deb's [08:31] ? [08:31] I'm asking how to make apt aware of them [08:34] That's what reprorepo does. You upload .changes files to it using dcmd and it builds an apt repo [08:34] oh see [08:35] (sbuild or pdebuild) and reprepro [08:35] so the ones in paren's just make the package [08:35] In a deterministic clean environment, yes. [08:37] twb: so with reprorepo I would make a repository on my localhost then just point /etc/apt/sources.list to it? [08:38] Yes. [08:40] ok I guess I'll look at that [08:41] spose I was hoping there was an easy way to just make apt see a .dep in some sort of already made default repo on localhost [08:54] twb: thx for the help [09:26] morning o/ [11:28] Daviey: rabbitmq [11:29] jamespage: that's all needed to nag Daviey nowadays? :) [11:29] lynxman:yep [12:05] jamespage: yes, yes.. will do it today [12:05] Sorry for being crap [12:11] Daviey: no problemo [12:11] Daviey, in all likelyhood I'm not sure its needs a FFe [12:12] and we don't have to MIR the new packages... [12:12] Looking for a lightweight monitoring ( preferably with history ) tool for a linux system. Don't want to use cactai/nagios etc. I want something that is quick and can monitor things like ( CPU, Memory, IO, Network ). Suggestion ? [12:13] ghatak, we use zabbix for this [12:13] right let me checkzz thanks [12:13] just run a small agent on the remote host and let zabbix poll it. it stores historical data [12:13] we monitor about 40 hosts with it. [12:13] rightoo === bladernr_ is now known as bladernr_afk [12:25] Got my eye on a hifn hardware raid card for my server... would it benefit ubuntu server though? [12:26] bencer_, all the zentyal source packages have now been accepted - they are just working their way through the binary NEW queue now [12:27] jamespage: so the only thing needed to have them included is waiting the builders finish their work? :) [12:27] bencer_, they have build but the new binary packages need to be accepted by the archive-admin's as well [12:28] aha ok, cool [12:28] bencer_, https://launchpad.net/ubuntu/precise/+queue [12:28] jamespage: onces they hit the archive we should request the removal of ebox packages, right? [12:29] bencer_, yes - I have a bug raised for that [12:29] * jamespage digs it out [12:30] bencer_, bug 957109 [12:30] hmm - no bot today [12:30] bencer_, https://bugs.launchpad.net/ubuntu/+source/ebox/+bug/957109 [12:31] jamespage: ok perfect === Jasonn is now known as juicy [12:32] Launchpad bug 957109 in ebox "Please remove libebox, ebox and ebox-* packages from the precise archive" [Undecided,Incomplete] https://launchpad.net/bugs/957109 [12:32] Launchpad bug 957109 in ebox "Please remove libebox, ebox and ebox-* packages from the precise archive" [Undecided,Incomplete] [12:41] New bug: #960144 in lxc (universe) "lxc-start failing to setup mounts" [Undecided,New] https://launchpad.net/bugs/960144 === fenris is now known as Guest87935 [13:35] Daviey: can we rethink the nova console patch...its causes the testsuite to fail because the fifo stuff doesnt exist in the buildd [13:49] zul: that is new? [13:49] Daviey: no [13:49] Daviey: just frustrating === bladernr_afk is now known as bladernr_ [13:55] zul: I heard something about the Debian openstack team adding dbconfig-common support to nova and glance, do you know where that code lives? Or if it exists? [13:56] pabelanger: http://anonscm.debian.org/gitweb/?p=openstack/$proj.git [13:56] not swift though [13:58] Is the pkg-openstack team considered upstream for packaging or is ubuntu? [14:02] pabelanger: for ubuntu we do our own packaging and we are kind of upstream as well [14:02] zul: I see, so we would never sync openstack from debian, is that safe to say? [14:04] pabelanger: yes we had the packging done before them [14:05] zul: okay, I only ask because I have 2 reviews up for dbconfig-common support, but Debian has already added support. The patches take 2 different approaches, so I'll just wait and see how we want to move forward [14:06] pabelanger: yeah i just got back from vacation so its in the queue im not so sure about adding dbconfig-common support to nova at this late in the cycle though [14:09] Understood, I was likely to late to the game to get it merged upstream. However, it does help with automated deployments. Worst case I'll have to package it locally [14:10] pabelanger: ack [14:42] zul: do you have any examples that uses debconf questions for a 'select'? [14:43] roaksoax: what do you mean? [14:43] zul: debconf questions that are of the type 'select' [14:43] roaksoax: not off the top of my head [14:43] postfix [14:44] zul: cool thanks [14:50] New bug: #960262 in lxc (universe) "include an option to use aufs instead of overlayfs in lxc-start-ephemeral" [Undecided,New] https://launchpad.net/bugs/960262 [15:02] jamespage: does the rabbitmq requested upload have a PPA? [15:02] i'd ike to point it to another upstream project to validate it. [15:06] New bug: #960276 in nova (main) "a bad AMI can hang an entire compute node" [Undecided,New] https://launchpad.net/bugs/960276 [15:28] Daviey: no - but it can have one [15:36] jamespage: whats the situation on rabbitmq? I know 2.7.1 regressed the start/stop behavior.. anything else? Did I hear that there was a FFE needed for something? [15:36] SpamapS, lynxman did some work to fold in the current plugin packages that are universe to rabbitmq-core [15:37] it creates NEW binary packages from rabbitmq-server source [15:37] I fixed up the start/stop behaviour [15:37] but thats about it [15:39] Ah ok [15:39] SpamapS: in hope of getting it in today, if it works out ok [15:39] jamespage: does it have Breaks / Replaces? [15:40] Daviey: it does :) [15:40] Daviey, yes it does [15:42] lynxman: cool [15:47] jamespage: how long do you think will take zentyal hit the archive? the seems that from the docs team doesn't want to merge the doc until the packages are not in the archive... [15:48] bencer_, they should land in the next day or so - the AA's review periodically [15:48] ok thanks [15:49] gary_poster: do you prefer I use the old aufs option ('-t|--type'), or ('-U|--union') ? [16:06] New bug: #960336 in cloud-init (main) "grub-legacy-ec2 missing dependency: ucf" [Undecided,New] https://launchpad.net/bugs/960336 [16:09] SpamapS: meeting? [16:09] utlemming: meeting? [16:13] hallyn, sorry was lunching. If -U does not take an argument, that makes sense to me. [16:13] -t is more future proof though, I suppose [16:15] IOW, hallyn, I don't have a string opinion. I guess at this instant in time, I'd lean towards -t, preferring the future-proof argument. [16:20] -U would take aufs or overlayfs [16:20] just as -t did [16:21] -U just seems to be more obvious :) i was just wodnerng if anyone would be using -t in a script (from oneiric) [16:23] gary_poster: ^ [16:31] hallyn...not us, and this is a new script, so go with the more obvious choice [16:31] ok [16:36] i have a hyper-v server with a "synthetic" interface and a "legacy" interface i can't get the synthetic interface to show up [16:36] any idea where to start ? [16:36] supposedly this kernel has this driver [16:42] jjohansen: to make /etc/apparmor.d/lxc/lxc-default be loaded at reboot, what should i do? [16:42] (i'd have thought all files under /etc/apparmor.d just get loaded?) [16:43] hallyn: it should be unless its disabled. Is there a link in /etc/apparmor.d/disabled ? [16:43] nope [16:43] hallyn: you can test what gets auto load with /etc/init.d/apparmor restart [16:43] even if it's under a subdir? [16:44] hallyn: oh. no subdirs aren't auto-loaded [16:44] ah [16:44] so what shall i do? [16:44] can i make a list somewhere? [16:45] hrmmm, jdstrand^ what do you think the best way to approach is [16:46] gary_poster: d'oh, my test kernel doesn't have aufs. But I *think* lp:~serge-hallyn/ubuntu/precise/lxc/lxc-shutdownv2 should be enabling aufs for lxc-start-ephemeral. (and at least doesn't break overlayfs ones) [16:46] hallyn: sorry when it comes to packaging and ubuntu init I still find stuff that surprises me, jdstrand and kees handled most of that stuff [16:46] jjohansen: thanks [16:47] hallyn, cool, getting and looking [16:47] hallyn: there are a couple things that can be done that I can think of. Drop a symlink in the top dir, drop an include dir in another profile file === duckydan_ is now known as duckydan [16:48] hallyn: is lxc-start in the main dir? [16:48] yes [16:48] you could drop an include at the end of the file [16:48] just include the directory [16:48] jjohansen: i suppose i can just leave them in the main dir. I just wanted to not pollute it too much [16:48] ? [16:48] any file in the directory would get included [16:49] so you can drop files in as you want [16:49] #include "lxc/" ? [16:49] yep [16:49] thanks will try [16:49] make sure the include is outside of the profile, just stick it at the end of the file [16:50] oh, hrmm that may mean modifying the included profile file [16:50] slightly so that it doesn't include the global abstraction stuff again, that has been on my list to fix for awhile but has been low priority [16:51] hi [16:51] jjohansen: yeah i just noticed it's complaining about redefs [16:51] redefinitions [16:52] yeah [16:52] just made it a new empty file with only the #include :) [16:52] thanks, i'll stop taking your time (cause i want that getcon fix :) [16:52] that will work [16:52] :) [16:55] hallyn, looks good, and I confirmed that it works with -U aufs here. The only issue I saw was because I already had another ephemeral running (because of the one-at-a-time aspect of lxc-wait). I'll run it through some more tests later, but +1 from me. Thank you! [16:56] gary_poster: I may write a lxc-wait script to replace that [16:56] I think I have to [16:56] that would be great, if sad that you have to do that [17:00] hallyn: sorry, did you get your question about policy loading during init answered? [17:01] after i install ubuntu-desktop how do i remote into the gui? [17:03] hallyn: well, in case not, if you are shipping an upstart job, you can look at avahi-daemon.conf for inspiration. eg add something like: [17:03] pre-start script [17:03] /lib/init/apparmor-profile-load / [17:03] end script [17:04] (note '/' should not have '/etc/apparmor.d/' prepended [17:04] ) [17:09] jdstrand: what i'm doing right now is shipping a /etc/apparmor.d/lxc-containers which just has '#include '. It's working [17:09] utlemming, if you poke at the locale stuff... i think profile.d could be made usable. [17:09] jdstrand: if that's deemed less desirable, i'll change it, but it's working [17:09] smoser: I've tested that profile.d code and it works [17:10] smoser: even with the bash-isms, but yeah, I'll get that implement this week [17:10] hallyn: that would certainly work. it is a little odd in some ways, but is also nice in that anything else that gets dropped into /etc/apparmor.d/lxc will magically get loaded [17:10] jdstrand: right - cool, thanks. [17:11] hallyn: can you paste the output of 'sudo aa-status' after having done that? [17:11] utlemming, well of course it will work in bash with bashisms. [17:11] but not if your shell is /bin/sh or zsh [17:11] profile.d probably has to be posix shell pure [17:11] jdstrand: http://paste.ubuntu.com/892472/ [17:12] hallyn: what are the contents of your /etc/apparmor.d/lxc directory? [17:13] jdstrand: just /etc/apparmor.d/lxc/lxc-default right now [17:13] (shipped with the package) [17:13] hallyn: and that has 'profile lxc-container-default ... {...}'? [17:13] Recommendation in server guide will be to drop per-container profiles there if desired and manually load [17:13] yes [17:14] hallyn: ok, so this will work. keep in mind that if containers start before the apparmor initscript is loaded, then things won't be confined [17:14] jdstrand: actually they refuse to start then [17:14] hallyn: this is where the upstart job change would help [17:15] jdstrand: lxc-start fails aa_change_profile() and bails [17:15] hallyn: ok, fair enough-- you might get a bug report about things failing to start [17:15] i installed the package ubuntu-desktop … how can i remote access the gui? [17:15] on server [17:15] can i make it startx remotely? [17:15] jdstrand: could be. I'm open to changing it to try and autoload, but i don't want to complicate it at this stage [17:16] jdstrand: i'm not sure where upstart job would help with new profiles... [17:16] hallyn: you could fix that condition by adjust lxc-start to load the policy (like we discussed before), or use the upstart snippet I gave above to load /etc/apparmor.d/lxc-containers [17:16] hallyn: (which would use your #include lxc trick) [17:17] jdstrand: I've missed something [17:17] hallyn: ok, the upstart job has: [17:17] pre-start script [17:17] /lib/init/apparmor-profile-load lxc-containers [17:17] end script [17:17] /etc/apparmor.d/lxc-containers contains: [17:18] #include [17:18] but lxc-containers gets loaded at start anyway... what does it gain to have it in upstart job? [17:18] (being dense, not on purpose) [17:18] this has the benefit of loading whatever is in /etc/apparmor.d/lxc (like now), and you can make sure in the job that it gets started before something that uses lxc-start [17:19] oh, cause there's no guarantee when /etc/init.d/apparmor runs? [17:19] hallyn: yes [17:19] got it, thanks [17:19] it runs in rc 2 [17:20] hallyn: anyhoo, food for thought. I'll let you decide what you want to do with all this info :) [17:20] jdstrand: thanks. I'll do that. And like I say I do want to add attempts to laod policy if transition fails, but only after getcon issues are fixed. [17:20] jdstrand: thanks, ttyl [17:21] hallyn: oh, one last thing: I suggest adding a clear comment in /etc/apparmor.d/lxc-containers as to what it is doing and why, so people know what is happening and aren't tempted to edit it [17:22] good point. will do [17:23] i installed ubuntu server but cant get a gui working [17:23] i apt-get'ed gnome-shell [17:28] newbchessplayer: you probably also want a DM etc. [17:29] and Xorg, of course [17:29]