=== zexcriz is now known as Guest88976 === stiv2k_ is now known as stiv2k === peter is now known as Guest5090 === Guest88976 is now known as zexcriz [02:41] how do i set multiple ipv6 addresses on the same interface === HisaoNakai_ is now known as HisaoNakai [03:36] how can I install ubuntu server 13.04 on a HP proliant ML310? I have problems with the iSCSI raid configuration [04:51] sudo apt-get install git. how do i access once it has dl'd [04:57] Is 01-mail-stack-delivery.conf an ubuntu/debian-specific dovecot config file? [05:50] how can I install ubuntu server 13.04 on a HP proliant ML310? I have problems with the iSCSI raid configuration === HisaoNakai_ is now known as HisaoNakai [05:59] Paulus68_1: elaborate? [06:27] raub: I have a sata raid enabled through bios [06:28] raub: during install I get the notification that it found sata raid and if I wan to activate [06:29] raub: then I get the question to configure ISCSI volumes and on the next tab I need to enter and IP and port for source and target and there I don't know what to enter especially when both drives are inside the server [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] a [06:36] Index: stop that [06:36] hahha [06:37] i am indo haxor [06:37] u here? http://irclogs.ubuntu.com/2013/10/07/%23ubuntu-server.txt [06:41] !ops [06:41] Help! Channel emergency! soren, lamont, mathiaz, Pici, Daviey, Tm_T or pmatulis [06:41] Paulus68_1: er, why? [06:41] Myrtti: Index is hacking here [06:42] that's not hacking, just ignore it [06:42] Myrtti: and flooding without any reason [06:42] http://irclogs.ubuntu.com/2013/10/07/%23ubuntu-server.txt [06:42] yes, and I can't see either [06:43] Myrtti: it was a few minutes before you joined [06:43] probably was [06:43] thanks anyways [06:43] but since I joined nothing has happened and now there's several ops awake, so I fail to see why the need to call ops again... [06:44] anyway, going back to work [06:44] like I said thanks anyway [06:45] http://www.regiohits.com/ina.php [06:46] http://zone-h.org/archive/notifier=Index%20Php list hacked :) [06:47] Index: do you have a support question or are you here just to paste links? [07:19] He's here to be a waste of the global ipv4 address space === psivaa-afk is now known as psivaa [09:35] how can I install ubuntu server 13.04 on a HP proliant ML310? I have problems with the iSCSI raid configuration === freeflying_away is now known as freeflying [10:14] i have to deploy 20 ubuntu machines in my college lab, which is the best way to implement such that, 1. no user can chroot that machine and access the root access. 2. only necessary application's like firefox and terminal runs. [10:15] i thought of controlling this machine use one server which controls all the 20 machines. [10:20] any rough idea which will be the correct thing to do ? [10:21] zexcriz_: Sounds like a job for Puppet, Chef, Salt and the like [10:25] TJ-, the main prob is that students chroot in and get the root access how can i prevent them ? [10:27] zexcriz_: Sounds like you have a severe permissions problem then, if regular unprivileged user accounts can gain root [10:30] TJ-, what they do is use a live cd chroot into the current installation [10:32] and change config files [10:36] zexcriz_: So block the use of the liveCD in the system BIOS/firmware by enabling adminstrator password and locking down what regular users can do, or else use LUKS encrypted systems that either require manual entry of the pass-phrase by a sysadmin (and an automatic penalty for any student rebooting the PC) or dropbear in the initrd to get the pass-phrase from a remote server and log the reboot(s) [10:46] TJ-, nice info reading it multiple times to understand clearly. [10:48] TJ-, i can [10:49] TJ-, i can't understand this line " dropbear in the initrd to get the pass-phrase from a remote server and log the reboot(s) " [10:50] zexcriz_: "https://matt.ucc.asn.au/dropbear/dropbear.html [10:51] zexcriz_: But your simplest route is to use the Motherboard BIOS/Firmware security options to prevent boot from CD or USB or even PXE [10:51] disabling USB would not be possible as they require to copy their programs on the the USB drives. [10:51] so the USB ports are enabled. [10:52] zexcriz_: Protect against PXE else students could simply move the ethernet cable to a device they control that provides BOOTP/TFTP services [10:52] zexcriz_: You can often have the disabled in BIOS but Linux will still find/use them when it has loaded [10:52] nice point. [10:53] zexcriz_: Your best weapon is severe penalties, clearly explained, to each student [10:53] zexcriz_: With good logging to a remote syslogd and active scripts monitoring those logs for systems going offline unexpectedly [10:53] implementing SElinux would help ? [10:53] zexcriz_: How? [10:54] zexcriz_: Your problem is not with Linux... your problem is *before* the operating system even loads [10:54] yeah correct [10:54] zexcriz_: Have you secured the power and reset buttons? made them non-operational? [10:55] no i have not done anything to power and reset button, can i make then non-operational ? i was not knowing this before. [10:55] zexcriz_: As I said, you can spend a lot of time trying to come up with technical measures to prevent this, or your institution can set clear rules with penalties for anyone breaking them, and then all you need is good active monitoring to catch reboots as they occur. [10:57] i can manage those machines from a server, and boot the machines when the period is there and shutdown as it get's over, this is one thing i can do by setting power and reset button non-operational. [10:58] hey guys what is the reason there are 3 php ini files on ubuntu server one for apache one for php and a 3rd for php-fpm if you use that sort of setup? [11:00] TJ-, thanks for the guidance :) [11:01] how can I install ubuntu server 13.04 on a HP proliant ML310? I have problems with the on board iSCSI raid configuration [12:07] i have an upstart question, if i make a script that looks like this: http://askubuntu.com/a/251581 [12:07] and i have an init.d script to make sure a process loads on boot up will they still conflict? === psivaa is now known as psivaa-afk [12:21] AntelopeSalad: yes. You should either have an init.d script, or use an upstart script to both start a service on boot and to respawn it. You shouldn't have both. [12:21] there are 20 machines in a local area network and all machines are installed with ubuntu 12.04, now i want to access the current users screen graphically how can i get connect and they too need to work at same time [12:22] Once you have an upstart script, symlink /etc/init.d/your-service to /lib/init/upstart-job (debhelper does this automatically). [12:22] rbasak: i can't just remove the init.d script? [12:23] babinlonston: try #ubuntu for desktop questions. This is a server channel. [12:23] or will the symlink carry over when i update the package? [12:23] rbasak: i asked there same issue and they said me to come here .. so what came here sir [12:25] babinlonston: sorry you're being messed around. If you can't get help in #ubuntu, see http://www.ubuntu.com/support/community for other community support options. [12:25] ok [12:25] hi all [12:33] hallyn: so +1 for libvirt === psivaa-afk is now known as psivaa === gary_poster|away is now known as gary_poster [12:51] zul: yeah, i guess. except for the lateness factor, and the proliferation of CVEs for the first month or two of recent releases [12:52] i can't believe how complicated upstart is haha [12:52] even huge tools don't have upstart scripts available [12:54] AntelopeSalad: really? I find upstart scripts remarkably simple to write. Especially compared to init.d scripts. [12:54] AntelopeSalad: in what way are they complicated? [12:54] i've spent close to 7 hours trying to figure out how to get process monitoring [12:54] and i got no where [12:54] Define "process monitoring" [12:54] redis, postgres, elasticsearch -- none of these things have upstart scripts available [12:55] upstart keeps track of whether the service is running. [12:55] they have non-official gists that are untested [12:55] i simply want 2 things to happen with a few processes [12:55] 1. start when the machine boots , 2. reload if the process crashes for unknown reasons [12:55] That's pretty much built in. Write an upstart script and "respawn" will work with it. [12:56] AntelopeSalad: that's what upstart does pretty much by default [12:56] hallyn: yeah hmmm.. [12:56] yeah but those 3 tools i have do not have upstart scripts available to download [12:56] and i'm in position to write one with zero knowledge [12:56] *no position [12:56] In what way is that a problem with upstart? [12:56] because i thought it was some widely used tool [12:56] And how does that make upstart "complicated"? [12:56] http://upstart.ubuntu.com/cookbook/ is a great guide [12:56] every single vendor seems to use the other version [12:56] the init.d ver [12:57] zul: i'm hoping this morning to figure out the virsh add-device problem... would like that fixed before release! [12:57] Well that's fine. Ubuntu works with init.d scripts too. [12:57] Just use the init.d script then. [12:57] yeah but init.d won't do the reloading right? [12:57] No it won't. [12:57] the reloading part is most important to me [12:58] Sounds like "every single vendor" isn't making that feature available to you then. [12:58] hallyn: thats cool im fixing ftbfses this morning (yay!) [12:58] glamorous :) [12:58] yeah which makes me think upstart has no traction and is unused [12:59] postgres, redis and elasticsearch are pretty popular tools, yet none of them have a conf available [12:59] That's because upstart works fine with init.d scripts [12:59] People tend to write upstart scripts when they need some functionality that upstart provides; otherwise the init.d script suffices fine on an upstart-using system. [13:00] It sounds like nobody is using service supervision on your specific tools. [13:00] AntelopeSalad: upstart is used by RHEL6 and by Ubuntu...both combined represents a pretty big market share :P [13:00] Or else they do it themselves and don't share their config. [13:01] i guess they don't share their configs [13:01] are there other alternatives? [13:02] An upstart job for a well-behaved daemon is about five lines. Perhaps they consider so trivial that they don't think it's worth sharing? [13:02] it would likely be available somewhere [13:02] if i search for upstart scripts for all 3 of those tools there's very little coverage [13:03] there's a couple of gists where people say it doesn't work, or it has issues, etc. [13:03] in elasticsearch's case i couldn't even find a single one [13:03] just a random newsgroup post where the guy says up front it doesn't work [13:05] AntelopeSalad: I recommend reading this http://jtimberman.housepub.org/blog/2012/12/29/process-supervision-solved-problem/ [13:07] AntelopeSalad: Also, "apt-cache show runit" and read the documentation [13:08] TJ-: does runit have wide vendor support? [13:09] AntelopeSalad: You need to ask the vendor's. runit is a solution for process supervision that can run alongside sysv init scripts. [13:10] at this point it seems easier to just forget using monitoring === gary_poster is now known as gary_poster|away [13:11] I fail to understand the real need for this. Need HA? Do proper HA. Need to fix things when they're broken? Monitor your actual service (rather than just a process) and redeploy your instance. [13:12] redeploy your instance? [13:12] Yes. You do have your deployment automated, right? [13:12] it seems really common to me that something like postgres might crash out of the blue [13:13] it seems really reasonable to me to have a script setup to detect and fix that without me having to ssh to the server and manually restart it [13:13] If it does then I suggest that you have bigger problems. Hiding it under the carpet doesn't really solve anything. Have you actually had postgres crash out of the blue? I never have. [13:13] automated deployment in what sense? i use git to push code to the server [13:14] setting up the server instance from scratch wasn't automated, i just have a million things written down that i planned to move into puppet or something else later on [13:14] In the sense that your entire deployment (server, services, scripts) deploys automatically. [13:14] If you really have a process crashing problem your process will continue to crash and be restarted and you'll just have a less reliable service, instead of actually fixing it. [13:15] it's never crashed randomly for me but it didn't seem impossible [13:15] I suggest you focus on automating your deployments first, and worry about process crashes later. [13:15] i've had ES occasionally lockup [13:15] what's your definition of automated deployment? [13:15] Google "devops". [13:15] i mean, i type "git push production master" and it gets deployed [13:16] heroku style! <3 [13:16] but that really involved almost nothing to setup and it's still very simple [13:16] Your server gets stolen / your service provider goes bust / whatever. What do you do? [13:16] well [13:16] One command = devops. [13:16] if my ec2 instance gets stolen then i expect amazon to do something about it [13:16] Ha ha [13:17] if ec2 goes out then i'm SOL i guess [13:17] EC2 instances are defined to have an expectation of doing away at any time. [13:17] and since this is my first project, i haven't looked into setting up the actual server automatically, that was next on my list after i got everything setup [13:17] and they do, even if you don't run your own chaos monkey [13:17] I suggest you defer worrying about process crashes then. [13:18] Just use the init.d scripts for now. [13:18] that feels really wrong but i'll take your advice and forget about it [13:18] user-data with cloud-config can get you a long way. [13:19] it feels like flying blind with no monitoring [13:19] I suggest you set up external monitoring instead. [13:19] Check that the actual service works, rather than some process. [13:19] it's not so much the monitoring, it's having to fix the problem manually [13:19] Worry about automation of fixing *after* you've had to fix the same thing a few times manually. [13:19] Otherwise you waste effort on fixing things that never go wrong anyway. [13:20] i just incorrectly assumed upstart was widely used and ridiculously easy to setup for common services [13:20] It is. [13:20] google says otherwise haha [13:21] the manual is really good. [13:21] if you searched for terms like "restart postgres automatically ubuntu" you'll find dozens of people having issues and no real good solutions [13:22] That's because the people really using postgres in production don't have that problem. [13:22] They monitor whole instances. [13:22] They implement real HA. [13:22] so you think all of those people asking the questions are newbies like myself who think they need it but actually don't? [13:22] They don't implement band-aid solutions. [13:23] at the very least i should set it up for my application [13:23] why would you want to restart postgres automatically? [13:23] Yes, or they've implemented something themselves (daemontools, upstart's "respawn", whatever) without further comment. [13:23] i could easily see a node or rails app dying but then working fine if it gets restarted [13:23] Or they fix the root cause of postgres crashing. [13:24] postgres crashes? [13:24] we've had instance run for years. [13:24] If postgres really is crashing, and you're using it in real production, then you'll fix the root cause, or have a support contract with someone else to fix the root cause. [13:24] so the moral of the story is trust vendors that their software is rock solid? [13:25] hahahaha [13:25] at least the popular ones like nginx/postgres/redis/etc. [13:25] The moral of the story is to monitor your actual service, and fix problems that really happen, rather than theoretical ones that never do. [13:25] AntelopeSalad: no, 1000x no. also, none of those things are vendors. they are open source projects. [13:25] For real production use, you bring in people with experience, or have support contracts with people who have real experience, who can tell you what to focus on. [13:26] For a newbie, worrying about postgres crashing is not one of them. [13:26] (unless it actually is crashing) [13:26] Anyway, I have work to do... [13:26] jrwren: sure but the end result is the same, they are widely used services that are supposedly battle hardened [13:27] AntelopeSalad: i'm not sure where you get those impressions and suppositions. [13:27] it's easy to get caught up in monitoring because if you google on the topic there's many different tools/etc. [13:27] widely used compared to what? certainly NOT widely used compared to apache/mysql/php/memcached [13:28] i don't have a usage chart handy [13:28] monitoring is great. I say yes to monitoring. If someone tells you that you don't need monitoring, tell htem, yes, and they don't NEED coffee, but it is great to have. [13:29] a quick stat check says nginx is being used on about 22 million sites [13:29] AntelopeSalad: getting back to nginx/postgres/redis, I've use the first two quite a bit. The reason I don't monitor them directly is that in my experience, they don't go down. I monitor my apps which use them. [13:30] what does popularity have to do with stability? [13:30] so you have absolutely nothing in place for those tools? === gary_poster|away is now known as gary_poster [13:30] AntelopeSalad: monitoring that your web site is up indirectly monitors nginx. There's no need to monitor it specifically. [13:30] that is right, absolutely nothing. I've also never had an outage where monitoring those would have helped. [13:30] patdk-wk: if ~20 million people are actively using something there's a very good chance all parts of the code gets stressed, bugs emerge and get fixed, etc. [13:30] What matters is that your web site is working. Not whether nginx is running or not. [13:31] AntelopeSalad, not true [13:31] compare that to a home grown web server that you wrote in a weekend , chances are it will be less stable than nginx [13:31] AntelopeSalad: you'd think there is a very good chance, but then see java, windows, adobe flash, other common zero day attack vectors. [13:31] even in high usage, I doubt 50% of it's capabilities are used [13:32] less stable? so lets say I did write a web server in a weekend, I built it off libevent's evhttp and I put some sane limits on request size. What would make it less stable? [13:32] jrwren: could you prove that it's equally as stable as a widely used server? [13:33] prove? [13:33] heh [13:33] I have seen extreemly stable software in high usage, crash horrible on idle servers [13:33] proof of code correctness is not something I'm interested in, nor willing to spend time doing. I respect others who do it. It is not for me. [13:34] only took me 2 years, for them to agree it was a bug that should be fixed [13:34] jrwren: btw are you using upstart scripts for your actual application or something else? [13:35] an upstart configuration, yes. [13:35] +1 for this converstation. It made me realize I should probably figure out how to use it with respawn. [13:35] or wait, no. I think I'm using an older style init.d script. [13:36] its just a trivial uwsgi config. I've not spent time investigating how to start it with upstart, because I have not needed it. [13:37] I have moved all my stuff to upstart awhile ago [13:37] AntelopeSalad: all of the above opinions stated, you should consider your goals and your values. If your organizational values are to solve these kind of problems first, in favor of a feature release time, then by all means, follow those values. Do the monitoring. [13:37] patdk-wk: uwsgi configs to upstart? can you share how you did it? [13:38] AntelopeSalad: and then, when you do have some monitoring in place for all of it, share it with the rest of us :) [13:38] uwsgi? dunno what that is [13:39] jrwren: that's a fun topic in itself because i spent about 15 hours total setting up this machine [13:39] it could have been better spent [13:39] AntelopeSalad: if it could have been better spent, sounds like its not mixing with your values. [13:40] working on features, etc. but i didn't treat this as something to compared vs an hourly wage, i wanted to be able to provision an ec2/vps instance and learning has an expense [13:40] with the best payoff, IMO [13:40] i don't mind spending time on certain things but i really did get hung up for a silly amount of time on the topic of monitoring [13:40] installing everything was really straight forward with no problems [13:41] i'm curious, is this based on past experience? or something else? [13:41] no, all of this is happening right now [13:41] if i already had a solution and things were smooth i wouldn't be in this channel [13:42] I mean to ask, do you know what caused you to get hung up for a silly amount of time on the topic of monitoring? [13:42] why did you even think about it? [13:42] oh, i was just reading general information on system deployment [13:42] and i like automating things, it seemed like a good idea to make sure my web server could self heal [13:43] i didn't want to have that feeling that i need to keep checking in on it [13:43] Can you share what you were reading? I'm just curious. [13:43] or checking my inbox all the time for errors that my app sent [13:45] jrwren: i spent a while over a few days just generally googling for deployment for xyz runtimes [13:45] i don't have a specific link [13:51] I'd guess that it was a lot of trade rag and academic stuff. [13:53] jrwren: mostly just blog posts [13:53] the other bits came from sites like SO [13:54] i started with the highest level topics like deploying a server to ec2 and they introduced tools like upstart/etc. [14:03] jdstrand: zul: so fwiw, virsh attach-device runs virt-aa-helper differently in saucy than raring: http://paste.ubuntu.com/6205041/ [14:09] jamespage: https://code.launchpad.net/~zulcss/glance/precise-ftbfs-rc1/+merge/189613 [14:22] Greetings! I have a server which I've upgraded from 10.04LTS to 12.04LTS. Upon doing so, the server now kicks me to the busybox shell on boot. The old kernel still boots fine. When kicked to the busybox prompt, I can simply mount the RFS without a problem. How can I debug this issue? [14:22] jamespage: just rebuilding libvirt now [14:23] zul, great [14:24] no, false alarm. that doesn't appear to be the problem [14:24] i guess i can try the raring apparmor userspace package [14:34] jamespage/hallyn: builds fine [14:34] zul, good-oh [14:35] zul, I'm not comfortable with skipping that glance test [14:35] I'm concerned its pointing at something wrong [14:35] jamespage: thinking about it im not either [14:35] jamespage: lemme just fix libvirt and ill poke at it again [14:35] adam_g, roaksoax: I just hit a nasty bug in the glance charm [14:35] two contexts both using the 'ceph' interface naming [14:36] I fixed it to specialize the glance CephContext -> CephGlanceContext with a new interface name ceph-glance [14:40] hallyn: virt-aa-helper is being called wrong [14:40] hallyn: /usr/lib/libvirt/virt-aa-helper -h [14:40] -f | --add-file add file to profile [14:40] hallyn: the apparmor userspace won't make a difference [14:41] hallyn: some commit made it so libvirt doesn't recognize that it needs to pass -f === freeflying is now known as freeflying_away [14:48] jdstrand: the thing is when I install the libvirt package from raring into saucy, it still doesn't do the right thing [14:48] and when i isntall saucy's pkg on raring, it does [14:50] jdstrand: my paste was wrong. -f /tmp/d.img *is* being added with sauc's package [14:50] (there are 3 calls, one with -f /tmp/d.img) [15:03] hallyn: that is... weird [15:04] hallyn: are there any denials? "grep DEN /var/log/syslog" [15:09] I have a server which I've upgraded from 10.04LTS to 12.04LTS. Upon doing so, the new kernel image now kicks me to the busybox shell on boot. The old kernel still boots fine. When kicked to the busybox prompt, I can simply mount the RFS without a problem. How can I debug this issue? I've run fsck. The SW RAID driver (RAID0) mdadm shows the array as healthy. [15:11] garrettkajmowicz: That could be caused by several issues. What have you checked so far? [15:12] TJ-: The health of the RAID device, the health of the filesystem. Everything mounts fine. I don't know why I'm being dumped to the busybox prompt. [15:13] garrettkajmowicz: How is the rootfs specified in the GRUB config? By UUID, device mapper name? [15:13] garrettkajmowicz: "cat /proc/cmdline" should help there [15:13] jdstrand: not for virt-aa-helper or apparmor_parser. [15:14] jdstrand: I just got apparmor_parser to stop before actually laoding the profile; and /tmp/d.img rw *is* in the libvirt-$uuid.files file [15:14] TJ-: root=/dev/md0 ro [15:14] hallyn: are there any denials related to libvirt? [15:15] hallyn: also, remind me what the exact problem is? [15:15] jdstrand: http://paste.ubuntu.com/6205324/ [15:16] just a sec [15:16] hallyn: oh [15:16] yeah so that is the root of the problem :) [15:16] hallyn: can you paste /etc/apparmor.d/libvirt/libvirt-7d781722-69b7-8801-fe96-caf37b7a8969.files? [15:16] garrettkajmowicz: OK, so mdadm should have a config in the initrd, in "/conf/conf.d/" I seem to recall, which gets there via an update-initramfs hook [15:16] http://paste.ubuntu.com/6205337/ [15:16] jdstrand: ^ [15:17] I didn't create that by hand [15:17] hallyn: oh, that is the wrong file-- apparmor_parser shouldn't run on that [15:18] hallyn: /etc/apparmor.d/libvirt/libvirt-7d781722-69b7-8801-fe96-caf37b7a8969 is the file [15:18] oh yeah :) [15:18] hallyn: so, I assume apparmor_parser -r /etc/apparmor.d/libvirt/libvirt-7d781722-69b7-8801-fe96-caf37b7a8969 works? [15:18] jdstrand: it does. BUT! [15:19] then when I add the file I'm attaching explicitly, and reload, I still can't attach-device [15:19] hm. it removed it [15:19] can you restate the problem-- I'm confused [15:19] jdstrand: ok, sorry, so here is the problem [15:20] I'm just doing the attach-device test (from qa-regression-tests) by hand. [15:20] I define a vm; create a img file in /tmp/ to attach; say virsh attach-device qatest-i386 d.xml [15:20] it updates the .files; loads a new profile; but libvirt gets denials (logged in syslog) opening the .img file either r or rw [15:21] adam_g/jamespage: libvirt first [15:21] I've verified that apparmor_aprser is being called, and it does seem to have the new .img in the .files at that point [15:21] adam_g/jamespage: libvirt fixed even [15:21] hallyn: can you paste those denials? [15:21] TJ-: The file does exist at /etc/initramfs-tools/conf.d/mdadm. There are pretty much no contents, though, other than BOOT_DEGRADED=true [15:21] http://paste.ubuntu.com/6205364/ [15:22] hallyn: http://paste.ubuntu.com/6205337/ doesn't have /tmp/d.img [15:23] jdstrand: correct. it gets added only for the attempt; then libvirt immediately removes it [15:23] auto-cleanup code is not a debugger's friend [15:23] garrettkajmowicz: The hooks and scripts from the mdadm package are installed at /usr/share/initramfs-tools/{hooks,scripts}. If you've got it mounted and booted right now, I'd suggest doing "sudo update-initramfs-tools -vuk all" to rebuild the initrd images [15:26] hallyn: virt-aa-helper seems to be doing the right thing: http://paste.ubuntu.com/6205377/ (using a vm of my own) [15:26] jdstrand: I agree. that's why I think it's apparmor userspace or kernel bug [15:27] we would have widespread breakage if it was [15:28] it seems more like the access is happening before the profile is reloaded [15:28] jdstrand: well [15:28] "/tmp/d.img" rw, [15:28] is in the *.files [15:28] so I just dont' know what's goin gon [15:28] biam [15:29] TJ-: I performed a sytem update the other day and installed a newer kernel. That built a new initramfs image. That didn't boot either. [15:29] hallyn: did upstream refactor the attach code? they could have moved something so that the lsm hook is wrong at the wrong time. it would (maybe) work on selinux because of file labelling [15:30] s/is wrong/is run/ [15:30] hallyn: when developing the driver, some stuff had to be moved around for things like that [15:30] garrettkajmowicz: OK, crack open the initrd image and figure out why it isn't starting and mounting the array [15:31] after entering this command ln -s /home/UbuntuMirror /var/www/ubuntu , on my apache server i am only getting parent directory displayed nothing else. [15:36] TJ-: I can crack open the image somewhere. But how do I figure out why it's breaking. I think I managed to save a copy of the output of dmesg somewhere, though it didn't look like it provided anything useful. [15:38] solved the prob :) [15:39] garrettkajmowicz: I had a server I had to do similar to last week due to various broken RAID arrays on it. my procedure was "mkdir /tmp/initrd; cd /tmp/initrd' zcat /boot/initrd.img-`uname -r` | cpio -id" at which point you've got the root of the initrd in the current working directory, and can poke about without the limitations of being in the busybox environment [15:47] TJ-: I don't think it's a broken RAID array simply because a previous kernel still boots flawlessly. In any case, I've opened up the image. The mdadm binary is there, as is the mdadm config file. The mdadm config file has notably: [15:47] ARRAY /dev/md0 level=raid1 metadata=0.90 num-devices=2 UUID=5c92f0d9:9cf5be95:03611c5e:a540b92f and DEVICE partitions [15:48] jdstrand: here was my experiment. Wrote a program which does sleep 100; try to open /tmp/a for reading. [15:49] start it in a profile which denies read of /tmp/*; open is denied [15:49] start it in that profile; update the profile to allow those reads while it is sleeping; open is still denied [15:49] garrettkajmowicz: I wasn't implying the array is broken, but that something in the scripts/config is not doing what it ought to. [15:49] is that expected? If so, then how does a running libvirt get updated so as to be able to open the new image file? [15:49] garrettkajmowicz: Does that config match the one from the initd of the known-working kernel? Be a good idea to crack open the working intrd in another directory and compare [15:53] TJ-: I wanted to make sure we didn't go down the 'broken RAID' rat hole. I just compared the config files and they have nearly identical contents. The older one doesn't have the parameter "metadata=0.90" in it. [15:53] hallyn: can you give me the test program and profile? [15:54] TJ-: However that matches the metadata version of the array. [15:57] jdstrand: heh, it's not very sophisticated. program is http://paste.ubuntu.com/6205500/ [15:57] policies are http://paste.ubuntu.com/6205501/ and http://paste.ubuntu.com/6205502/ [15:58] uh, sed -i 's/sleep(100)/getchar()/' to make it more usable i guess [15:58] hiii guys anyone can tell me how to unset ETags on ubuntu server.. each time im creating a file in conf.d or add the header unset.. there is an error when restarting apache2.. any hints please with etags.. thnkxx [16:01] in the previous ubuntu server, the etag file.conf can be added.. but not in this one.. i dont understand where is the issue about configuration of etags [16:01] hiii guys anyone can tell me how to unset ETags on ubuntu server.. each time im creating a file in conf.d or add the header unset.. there is an error when restarting apache2.. any hints please with etags.. thnkxx [16:01] Ruetobas has left IRC () [16:01] 20:01 darkXploit [16:01] in the previous ubuntu server, the etag file.conf can be added.. but not in this one.. i dont understand where is the issue about configuration of etags [16:02] garrettkajmowicz: That sounds right - the newer version of mdadm supports a newer metadata format so that is needed. My checks now would be on the scripts that handle the root device. The root device name is being passed on the kernel command-line, and is extracted to an env. variable I think via the /init script. Then the scripts/* are called in turn... mdadm has a script there. I'd be checking it is in place reading it to see if there is as way to get it [16:02] to report debug info of some sort to help when it fails so you know where it has got to and what it is seeing [16:02] jdstrand: ok, yes i get different behavior on precise. So I guess I can formalize the testcase and open a bug. [16:02] [16:02] (that's a sob, not 's.o.b' :) [16:05] hallyn: your test program fails without confinement [16:05] $ ./a.out [16:05] failed [16:06] hallyn: "r" is for reading. /tmp/ab doesn't exist [16:06] TJ-: In the non-working image I have ./mdadm-functions ./local-premount/mdadm ./init-premount/mdadm. The working image has only ./init-premount/mdadm [16:06] sudo rm -rf / [16:06] tru this guys [16:06] try [16:07] jdstrand: so create it :) [16:07] hallyn: adjusting to 'w', then I get: [16:07] $ aa-exec -p /usr/bin/serge -- ./a.out [16:07] jdstrand: like i said i'll create an actual test tarball that does the work for you [16:07] success [16:07] don't aa-exec [16:07] copy the profile into /etc/apparmor.d/usr.bin.serge [16:08] start the program; switch the profile; continue the program (by hitting a key) [16:08] before saucy, it'll continue with the new profile [16:08] as of saucy, it continues with the old [16:08] hallyn: hit a key? what you gave me doesn't look at user input [16:09] jdstrand: I said to 'sed -i 's/sleep(100)/getchar()/' :) [16:09] like i said lemme get it fully automated [16:09] I missed that [16:11] garrettkajmowicz: I'm not sure why there are two, probably some difference in local versus possible NFS rootfs [16:12] hallyn: I can confirm [16:12]