/srv/irclogs.ubuntu.com/2016/08/05/#snappy.txt

mupBug #1610025 opened: snapd fails to start after installing snaps <Snappy:New> <https://launchpad.net/bugs/1610025>00:23
b-yeeziHi all. I'm trying to snappify an electron app that I'm a fan of. I'm following the SimpleNote example, but get an error01:28
b-yeezi~/.../parts/.../build/wrapper so such file.01:28
b-yeezino such file01:28
b-yeezimy wrapper file is in the $SNAP directory before I run snapcraft01:29
b-yeeziany suggestions?01:30
b-yeeziThe only difference is that I'm pulling the tar.gz from the internet instead of untarring it locally01:46
b-yeezihi01:47
=== chihchun_afk is now known as chihchun
=== chihchun is now known as chihchun_afk
ahoneybunjust did a popey and made a script for running snapcraft on a linode server03:54
dholbachhey hey05:13
morphiszyga: ping07:28
morphisdoes someone know how to fix this issue https://travis-ci.org/snapcore/snapd/jobs/149977843 with the spread tests running on linode?07:33
morphislooks like they broken with the now landed snapd 2.0.11 in xenial07:33
mupPR snapd#1638 opened: interfaces: add uefi-manager interface <Created by timchen119> <https://github.com/snapcore/snapd/pull/1638>08:14
popeyahoneybun: yay08:17
popeydholbach: lemme know if/when you get a chance to try my silly script :)08:19
dholbachpopey, probably not today :-/08:22
dholbachI looked at the team option already though and it looks like what we want :)08:23
popeywell that's good news!08:23
lucalarhi guys08:43
lucalarI would like to ask you something on IoT project development on Ubuntu Snappy08:44
lucalarif someone could answer I appreciate08:44
lucalarI'm a newbie on Ubuntu Snappy, and I have to develop a project using a gateway (where snappy is installed) and sensors connected to it08:46
lucalarwhich is the best way, the language that I have to use, etc.. ???08:47
dholbachyou can build your software whichever language you are most comfortable using08:48
dholbachsnapcraft (the tool to turn your software into a snap) has a lot of different build plugins, so building it should be easy08:48
dholbachhttp://snapcraft.io has more info about it08:49
lucalaryes, i've read something on snapcraft08:50
lucalarbut in this context, I would like to know if I can test the software during the developing08:50
lucalarI mean, my Ubuntu Snappy is installed on a gateway, so I have no GUI08:51
lucalarand I'm not sure if I can install snapcraft on it08:51
dholbachI'm not sure how you would debug or interact with your software - is it a service you can reach over the network?08:52
dholbachor do you mean building it on an ARM machine while you're on x86?08:52
lucalarnop08:52
lucalaryes, something like that08:53
lucalari have to build it for a different machine08:53
mupPR snapd#1639 opened: tests: allow-downgrades on upgrade test to prevent version errors <Created by fgimenez> <https://github.com/snapcore/snapd/pull/1639>08:53
dholbachI'm not quite sure what the best way to do this is... I'll leave the question for somebody else08:54
dholbachif nobody responds in time, maybe best send an email snapcraft@lists.snapcraft.io and explain your setup08:55
dholbachI'm sure you're not the only one looking for this :)08:55
lucalarthank you guys08:55
Odd_BlokeLaunchpad supports building snaps on multiple architectures; there are some restrictions on what architectures are generally available, so I don't know if that helps.08:55
dholbachah, nice one - of course08:56
* dholbach clearly needs some more mate tea08:56
Odd_BlokeAlternatively, you could try running snapcraft inside a $arch KVM, if you can get one running.08:56
lucalarI see08:57
Odd_BlokeI haven't actually done either of these things though (as I lead a blessedly amd64 life ;), so I can't promise they'll work for you. :)08:57
dholbachhttps://kyrofa.com/posts/building-your-snap-on-device-there-s-a-better-way08:59
dholbachlucalar, ^08:59
Odd_BlokeHmm, update-alternatives not running when you stage-packages is irritating.09:01
lucalarcool, I will give it a look ;)09:01
Odd_BlokeJust spent several iterations of snap/upload/install trying to work out why awk wasn't in my path after installing gawk. >.<09:01
lucalarwow, cool...launchpad is very interesting. Thanks a lot dholbach and Odd_Bloke09:12
mupPR snapd#1639 closed: tests: allow-downgrades on upgrade test to prevent version errors <Created by fgimenez> <Merged by chipaca> <https://github.com/snapcore/snapd/pull/1639>09:13
lucalaranother question, do you know the existance of a Java API to work with sensors on an OS Ubuntu Snappy installed on an architecture amd64?09:14
dholbachI don't, but I'd recommend just using the java api your sensors work with and bundling that in the snap (snapcraft will help you do that)09:18
beowulfOdd_Bloke: hey, did you figure out the browserify step?09:20
Odd_Blokebeowulf: I haven't, no.09:21
beowulfOdd_Bloke: let me know what you come up with :) I think using npm's package.json to define that steps pre and post installing some modules via snapcraft's node plugin is worth exploring, but i haven't had time09:25
Odd_Blokebeowulf: I don't really know enough about npm/node to really dig in to it; I was hoping it would Just Work (TM). ;)09:26
beowulfOdd_Bloke: let me try something simple and if it works it might help you :)09:27
mupBug #1610149 opened: writing to the "common" directory needs to have sudo right <Snappy:New> <https://launchpad.net/bugs/1610149>09:27
Odd_Blokebeowulf: :) Thanks!09:28
willcookeogra_, I assume the answer is yes, but.. does your Pi3 core image include drivers for BT and Wifi?09:28
ogra_willcooke, the answer is no currently09:28
ogra_:)09:29
ogra_sorry ... they will land soon09:29
willcookeogra_, ah :)  Glad I asked then.  What about wired ethernet?09:29
ogra_(it includes the drivers, but not the additional firmware)09:29
ogra_wired works fine09:29
willcookeperfect, thanks!09:29
* willcooke ponders netbooting a pi3 in to core09:29
ogra_unlikely to work ... but try it09:30
willcookewill try and carve out some time to play this afternoon09:30
ogra_(the initrd searches for labels on partitions for the whole system setup ... if the label isnt there or the snaps arent in the right place on the labeled partition it will fall flat on its face)09:31
willcookeAh, I see09:31
ogra_for netbooting we'd need to add some bits to the scriptery09:32
willcookeNot worth it atm I expect.09:33
ogra_well, there was some desire to do netbooting at some point, i thinnk lool worked on that ... though i also think that was via a special system that puts bits into place first09:33
loolI have not but I'd like it too  :-)09:34
loolin Heidelberg we noted it would be a quite desirable thing ot have09:35
willcookeIs this made any easier by the recent Pi annoncement of netbooting?09:35
ogra_nope09:35
willcookedarn09:36
ogra_in all cases you need an SD to boot the pi ...09:36
ogra_since we default to using uboot for booting, a generic solution would kick in on that level, not in the first stage bootloader09:36
ogra_i.e. you would have an SD with the binary blob plus the uboot binary and config09:37
ogra_(in general the pi isnt realyl a great target given you will always need an SD due to a missing eMMC boot)09:37
willcookeyeah09:38
ogra_(if you need an SD anyway, you could as well do a local boot)09:38
willcookeonly use case for netbooting I have is that SD cards don't like getting hot, so industrial applications might want to boot from SD card and load everything else over the network09:38
willcookeplus, people like me who like to play09:39
ogra_well, it is definitely a valid target ... (i guess also for cloud stuff)09:39
willcookeThis confuses me:  https://www.raspberrypi.org/documentation/hardware/raspberrypi/bootmodes/net.md09:41
willcookeIt says that the boot ROM is "One Time Programmable"09:42
willcookeand then it talks about setting bits in there09:42
willcookeBut does suggest that it might be possible to boot without an SD card09:43
ogra_ah, well, try it if you like09:44
willcookeI'll see what I can get working, and then bother you about it next time we meet09:45
loolwillcooke: prompted by your remark about netbooting, I landed on the exact same page and I have been diving into it; seems quite useful09:58
loolwillcooke: the OTP seems indeed to be write once; my understanding is that the firmware supports USB netboot and USB mass storage, but that's disabled by default because potentially buggy or unsecure09:58
loolso we flip a bit once to enable it forever09:58
loolcan't disable it09:58
loolHmm https://www.raspberrypi.org/documentation/hardware/raspberrypi/bootmodes/msd.md says if you remove it it's turned off09:59
willcookelool, I think there are a few typos in those docs.10:00
loolcan't find much about this flash except that it holds a bunch of device specific stuff like serial10:00
willcookehttps://www.raspberrypi.org/documentation/hardware/raspberrypi/bootmodes/net_tutorial.md10:02
loolhttp://www.elinux.org/RPI_vcgencmd_usage is where I found the info on the otp contents10:03
=== hikiko is now known as hikiko|ln
loolwillcooke: ah well the net tutorial page is consistent with the hardware behavior I suspect: program_usb_boot_mode=1 is only needed to be present once, and then it's enabled forever10:06
willcookelool, this page talks about getting involved in the beta of netbooting:  https://github.com/raspberrypi/documentation/blob/master/hardware/raspberrypi/bootmodes/README.md10:06
mupBug #1591664 changed: 'snap install' should support --beta, --candidate and --edge options <Snappy:Fix Released> <https://launchpad.net/bugs/1591664>10:06
willcookelool, @ program_usb_boot_mode - yeah, I think so too10:06
loolhttps://github.com/raspberrypi/documentation/blob/master/hardware/raspberrypi/bootmodes/bootflow.md is pretty nice10:07
* willcooke reads10:08
loolwillcooke: if I read the bottom correctly ("By default the USB device boot mode is enabled at manufacture time [...]"), once you switch to netboot you can't ever go back to device mode10:09
willcookeerk10:09
willcookemaybe you can change that with pulling the GPIOs up?10:10
willcookeor down10:10
ogra_or with pliers and a soldering iron :P10:10
willcooke:)10:10
mupBug #1602154 changed: "snap find" command cannot find ubuntu-calculator-app. However, it can be installed on 16.04 <Snappy:Fix Released by chipaca> <https://launchpad.net/bugs/1602154>10:18
mupBug #1605471 changed: Cannot refresh a devmode snap <Snappy:Fix Released by chipaca> <https://launchpad.net/bugs/1605471>10:21
mupBug #1606100 changed: "snap revert" command  cannot be found <Snappy:Fix Released> <https://launchpad.net/bugs/1606100>10:24
mupBug #1607717 changed: no snaps installed error <Snappy:Fix Committed by chipaca> <https://launchpad.net/bugs/1607717>10:36
beowulfOdd_Bloke: so, the nodejs plugin would probably need a few changes to make my suggestion work :(10:37
mupBug #1590704 changed: "snap interfaces" command doesn't filter by snap <verification-done> <Snappy:Fix Released by chipaca> <https://launchpad.net/bugs/1590704>10:39
=== hikiko|ln is now known as hikiko
=== LarreaMikel1 is now known as LarreaMikel
=== vrruiz_ is now known as rvr
cpaelzeron a minor note on http://snapcraft.io/create/ "... the two highlighted files ...", but there is only one highlighted - prime/command-hello-service.wrapper should be bold as well I think11:34
cpaelzerlink https://myapps.developer.ubuntu.com/dev/click-apps/register-name-dispute/ as referred by http://snapcraft.io/create/ is broken as well11:42
mupBug #1610211 opened: Interface to manage block devices <snapd-interface> <Snappy:New> <https://launchpad.net/bugs/1610211>11:43
=== LarreaMikel1 is now known as LarreaMikel
=== JanC is now known as Guest20161
=== JanC_ is now known as JanC
ali1234popey, didrocks: i am currently getting this exact error http://askubuntu.com/q/787258/1243512:16
ali1234even to the extent that one day later the error changed from failing on the package lists to the deb files12:17
popeyerk12:17
popeyi have no idea what I did to fix it12:18
popeyI think I nuked my lxd config and started again12:18
ali1234i started with a fresh lxd config12:18
didrocksI guess the issue is Err:5 http://archive.ubuntu.com/ubuntu xenial-updates/main Translation-en12:18
didrocks500  Internal Server Error12:18
popeyoh, also, I had an apt-cacher-ng which I removed12:18
ali1234installed it yesterday for this purpose12:18
popeyoh12:18
didrocksit can't update that repo12:18
ali1234no cachers here12:18
popeyok12:18
ali1234actually12:18
ali1234yesterday it failed on a en translation file12:19
ali1234today it didn't even try to download that12:19
ali1234http://paste.ubuntu.com/22306053/ is today's error12:19
ali1234didrocks: yes, yesterday that was the error. today the error is different ^12:20
ali1234i have changed nothing on my end. just gave up yesterday and went to bed...12:20
didrocksweird, and no issue from your host at all?12:20
ali1234apt works fine on the host afaik12:20
didrocksmaybe ask stgraber if there is some lxd cache?12:21
mupPR snapd#1640 opened: tests: add gsettings interface spread test <Created by fgimenez> <https://github.com/snapcore/snapd/pull/1640>12:50
mupPR snapd#1628 closed: store: refactor newRequest/doRequest to take requestOptions <Created by matiasb> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1628>13:21
jdstrandkyrofa: hey, now for me to ask you a couple questions :) 1) if I run 'snapcraft' which directory is mksquashfs run on? 2) Let's suppose that I stage-packages and all the debs are unpacked but I want to add/tweak something that was unpacked. is it possible to insert a command at sometime after unpack but before mksquash?13:23
morphisniemeyer: are you looking at https://github.com/snapcore/snapd/pull/1432 today? jhodapp is waiting already for some days13:42
mupPR snapd#1432: interfaces/builtin: improve pulseaudio interface <Reviewed> <Created by jhodapp> <https://github.com/snapcore/snapd/pull/1432>13:42
niemeyermorphis: I've been actively going through the queue in the last few days.. will get to it13:42
morphisaye13:43
jhodappthanks niemeyer13:43
niemeyerjhodapp: np, sorry for the delay.. it's obviously been a little hectic after the sprints13:45
jhodappniemeyer, yeah understood13:46
jhodappniemeyer, this PR has been reviewed many times, so it should just be ready to go...an easy merge13:47
niemeyerjhodapp: Yeah, this is an epic branch13:51
niemeyerjhodapp: What is that line 217 on manual-tests.md?13:51
jhodappniemeyer, that shouldn't be there...slipped through in my conflict resolution13:52
mupPR snapd#1641 opened: interfaces: implement systemd-control <Created by morphis> <https://github.com/snapcore/snapd/pull/1641>13:52
jhodappniemeyer, let me get rid of that quickly13:52
niemeyerjhodapp: Can you please also take this chance to fix the tab indentation on the yaml snippets?13:53
niemeyerjhodapp: It's being improperly tagged red there for good reasons.. yaml can't take tabs13:53
niemeyer(not your fault)13:53
niemeyerjhodapp: 4 spaces on all of them please13:53
niemeyerI mean, four spaces indents13:53
jhodappniemeyer, I can change it but those tabs are not from me13:53
jhodappoh you said that13:54
niemeyerjhodapp: You've marked it as yaml in the branch, though (correctly)13:54
jhodappsure I can fix that13:54
jhodappit was bugging me too13:54
niemeyerjhodapp: Thanks, the indentation is also pretty broken in that one snippet you touched at least.. it has 8 spaces and 4 spaces, interchangeably13:55
niemeyerand then next one has 2 spaces.. indentation party13:55
jhodappniemeyer, fixed that section13:58
niemeyerjhodapp: Why were the consts changed to vars on all snippets?14:01
jhodappniemeyer, at least pulseaudioConnectedPlugAppArmor is modified in the code later14:02
kgunnjdstrand: ok, i'm getting a seccomp denial for sendto and it's clearly in my connectedplug snippet14:03
niemeyerjhodapp: It's actually not, I think14:03
jdstrandkgunn: is it in the resulting policy in /var/lib/snapd/seccomp/snap.your.thing.that.is.failing14:05
jhodappniemeyer, oh you're right it isn't...sorry brand new to Go14:07
jhodappniemeyer, so am I able to just slap "const" back on the front of those?14:07
=== Tristit1a is now known as Tristitia
jhodappeven as byte slices14:07
niemeyerjhodapp: No, unfortunately not.. you'll need to move them back to being strings, and use []byte in place14:10
niemeyerjhodapp: I'd prefer that in general, as a guideline.. it means those strings are in unchangeable memory, and won't be mutated behind our back14:11
niemeyerjhodapp: A bit of paranoia, arguably, but not too crazy given the context14:11
jhodappniemeyer, using []byte in place is a cast, yes?14:11
niemeyerjhodapp: Type conversion, not a cast14:11
niemeyerjhodapp: Cast means something else if we're pedantic enough14:11
jhodappniemeyer, so it's not the same thing as in C/C++14:12
niemeyerjhodapp: No, it's not.. in those languages you can actually tell the compiler you want to look at that memory under different eyes, whethere that's correct or not14:12
niemeyerjhodapp: That's casting14:13
jhodappniemeyer, yeah ok, so this is safer14:13
niemeyerjhodapp: On b := []byte(s) you're allocating new memory, copying data over, and converting the type..14:14
jhodappyeah14:14
=== matiasb1 is now known as matiasb
kyrofaHey jdstrand!Sorry, I had to switch work locations14:20
kyrofajdstrand, (1) snapcraft (which defaults to snapcraft snap) runs mksquashfs on the prime/ directory14:20
mupPR snapd#1642 opened: many: pass device to store <Created by matiasb> <https://github.com/snapcore/snapd/pull/1642>14:22
kyrofajdstrand, (2) not by utilizing the default plugins, but you have a few options. You can either write your own plugin that does stuff right after the pull step, or write a Makefile that does stuff in the all: rule (which is run during build, right after pull14:23
kyrofajdstrand, you can ship a local plugin alongside the snapcraft.yaml14:25
jhodappniemeyer, fixed14:25
niemeyerjdstrand: This is an interesting point to keep an eye on for future reviews.. the snippets should ideally live as consts rather than var []byte14:27
liuxgkyrofa, ping14:28
kyrofaliuxg, pong14:31
liuxgkyrofa, if I want to write to the common directory, do I need to have the root previlege? thanks14:32
kyrofaliuxg, there are two common directories: SNAP_COMMON and SNAP_USER_COMMON. Yes, SNAP_COMMON (like SNAP_DATA) is owned by root14:33
jdstrandniemeyer: noted14:33
kyrofaSNAP_USER_COMMON though is owned by the user. Note however that it's not currently usable as nothing creates it. niemeyer, speaking of that, did you see the email thread about that?14:34
niemeyerjhodapp: Just waiting for it to go green14:34
jhodappniemeyer, cool14:34
liuxgkyrofa, I mean the directory SNAP_COMMON14:34
niemeyerkyrofa: Nope14:34
kyrofaliuxg, then yes14:34
jdstrandkyrofa: great, thanks!14:34
kyrofajdstrand, let me know what path you decide to follow and I can give you a few more hints14:34
liuxgkyrofa, do you mean it needs have the root previlege? it is like /home/<user_name>/snap/hello/common14:35
kyrofaliuxg, that's SNAP_USER_COMMON14:35
kyrofaliuxg, SNAP_COMMON is in /var/snap/<snapname>/common14:35
kyrofaBut yes14:35
niemeyerkyrofa: My vague memories are that with snap run creating that directory becomes trivial14:36
niemeyerkyrofa: Not sure what changed since we last discussed this, though14:36
kyrofaniemeyer, indeed, that's true. But snap run is taking a while to land and people are starting to get confused by the behavior of not creating them14:37
liuxgkyrofa, right. so, the one SNAP_USER_COMMON a user right is fine, right?14:37
kyrofaniemeyer, will that land soon you think? Or should we add that logic back to snap-confine?14:37
kyrofaliuxg, right14:37
liuxgkyrofa, thanks for your clarification. By the way, I have shared you a document about core, would you please help to review it, thanks.14:38
* kgunn has more fun with network14:38
kyrofakgunn, I share your pain14:38
kyrofaliuxg, sure!14:38
kgunnjdstrand: sorry had to re-run and yes it is listed in /var/lib/snapd/seccomp/profiles/snap.mir-client.client-start14:38
kgunnthe denial signature in syslog appears as14:39
kgunnAug  5 14:34:56 localhost kernel: [  267.421706] audit: type=1326 audit(1470407696.839:12): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1383 comm="clocks" exe="/snap/mir-client/x1/clocks" sig=31 arch=c000003e syscall=44 compat=0 ip=0x7fcdea268b7f code=0x014:39
niemeyerkyrofa: The only blocker for snap run is snap-confine, which I believe is now about to be in updates14:39
liuxgkyrofa, by the way, another developer yesterday met a same problem, and he confirmed it.. https://bugs.launchpad.net/snapcraft/+bug/160183414:39
mupBug #1601834: Error "[Errno 21] Is a directory" when building a snap package for a qmake project <Snapcraft:Confirmed> <https://launchpad.net/bugs/1601834>14:39
niemeyerkyrofa: So *maybe* next week14:40
kyrofaniemeyer, ah, good deal. Okay, we'll just live with it then14:43
jdstrandkgunn: is clocks running under snap.mir-client.client-start?14:43
jdstrandkgunn: and it this on amd64?14:43
niemeyerkyrofa: Did I miss something else in that conversation?14:44
kyrofaniemeyer, no, people seemed to think snap run was already used. I tried to clarify, but asked you and mvo about timeline. It would be great if you could quickly respond just to close the thread, if you have a minute14:45
ali1234what's snap run? test the current snap without installing it?14:50
niemeyerkyrofa: Where's the thread?14:51
mupPR snapd#1643 opened: many: support interactive payments in snapd, filter from command line <Created by pete-woods> <https://github.com/snapcore/snapd/pull/1643>14:51
niemeyerali1234: Any app may be run via "snap run snap[.app]"14:51
niemeyerali1234: Instead of /snap/bin/snap[.app]14:52
ali1234oh right, i was thinking of "snapcraft run"14:52
niemeyerali1234: The latter will become just a symlink to /usr/bin/snap14:52
niemeyerali1234: So it's a much nicer pipeline for how things get executed14:53
mupBug #1610149 changed: writing to the "common" directory needs to have sudo right <Snappy:Invalid> <https://launchpad.net/bugs/1610149>14:53
ali1234yeah, i see. i was thinking of something else entirely14:53
niemeyerali1234: It's coming for a while, but there were several moving parts, so it took a while to get to this point14:53
* ogra_ grumbles about not being able to use sidloaded kernel snaps anymore with latest u-d-f14:54
mupPR snapd#1625 closed: asserts: make account-key's `until` optional to represent a never-expiring key <Created by emgee> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1625>14:57
jhodappniemeyer, looks like CI completed successfully15:07
kgunnjdstrand: sorry, network killing me....not sure if you saw i do have sendto in the seccomp profile for the client15:12
jdstrandkgunn: is clocks running under snap.mir-client.client-start?15:13
jdstrandkgunn: and it this on amd64?15:13
jdstrandis*15:13
kgunnjdstrand: yes, this is on amd64 and clocks is the exe launched by client-start15:16
kgunnhttp://bazaar.launchpad.net/~mir-team/+junk/snapcraft-mir-client/view/head:/client-start15:16
jdstrandkgunn: and you are 100% sure that sendto is listed in /var/lib/snapd/seccomp/snap.mir-client.client-start ?15:17
jdstrandkgunn: grep sendto /var/lib/snapd/seccomp/snap.mir-client.client-start15:18
jdstrandkgunn: and you are seeing the denial by launching mir-client.client-start ?15:19
kgunnjdstrand: it is literally on line 469 of /var/lib/snapd/seccomp/profiles/snap.mir-client.client-start15:19
jdstrandkgunn: is the interface connected?15:19
kgunnjdstrand: the interface is connected manunally15:19
jdstrandmeh, if it is in there it should be15:19
kgunnjdstrand: so i put a sleep at the top of client-start, then manually connect15:20
jdstrandkgunn: can you tail -f /var/log/syslog in one terminal, then sudo systemctl stop your.unit ; sudo systemctl start your.unit15:21
jdstrandkgunn: then tell me if you see a new denial in syslog?15:21
kgunnjdstrand: sure will try15:22
kgunnjdstrand: when i call sysctl on snap.mir-client.client-start.service15:28
kgunnit fails with15:28
kgunnFailed to stop snap.mir-client.client-start.service: The name org.freedesktop.PolicyKit1 was not provided by any .service files15:28
kgunnSee system logs and 'systemctl status snap.mir-client.client-start.service' for details.15:28
jhodappniemeyer, are you still around?15:30
ysionneauhmm I have two snaps that must communicate through unix socket15:36
ysionneauwhere do I put the socket ?15:36
ysionneauin /tmp one won't be able to open it15:36
ysionneauin home, the home interface isn't autoplug I think ...15:37
ysionneau(and I guess I won't be in devmode since I install the snap through webdm)15:44
jdstrandkgunn: did you run that with sudo?15:45
kgunnjdstrand: i can try15:45
ysionneauso what's the way to communicate between two snaps via unix socket without devmode ?15:45
jdstrandkgunn: basically, I don't understand how the sendto denial is being logged. it shouldn't be. I think it is either an old denial or it happens on install before the connection. I'd like to see confirm that a sudo sysctemctl stop ... followed by start triggers it15:46
jdstrandkgunn: if it wasn't working, there would be people screaming left and right about it being broken...15:46
didrocksysionneau: I would recommend using SNAP_DATA if both are running as root, until we get a better answer from jdstrand or niemeyer :)15:50
ysionneauhmmm i'm running as root yes15:52
ysionneaubut I guess one snap does not have access to another snap's SNAP_DATA, right ?15:52
didrocksah, it's 2 snaps, sorry, I read 2 apps15:52
didrocksso, yeah, question for jdstrand & niemeyer in that case (maybe ask on the ML so that they can catch up later on?)15:53
ysionneauI have lool helping me out in fact at the moment :)15:54
ysionneauthanks !15:54
didrockslool: ysionneau: do you mind keep us posted on the ML? That would be interesting to quite a lot of people I think15:55
looldidrocks: at the moment it's a bit hackish with a devmode snap15:55
looldidrocks: the docker snap is a good example of how to do this properly, but it requires landing an interface in snapd15:55
looldidrocks: https://github.com/snapcore/snapd/pull/1619/files has the interface15:55
mupPR snapd#1619: Add initial "docker" interface based on some of 15.04's privileges <Created by tianon> <https://github.com/snapcore/snapd/pull/1619>15:55
loolyou can see it gives access to /run/docker.sock15:55
didrockslool: hard for 3rd party apps to land an interface for their specific socket though…15:56
ysionneauyep I would prefer to not have to modify snapd, for now at least, even if it's a bit hackish like reusing some interface15:56
looldidrocks: well it's the otherway around here15:56
looldidrocks: they have a first (devmode) snap with a socket somewhere, and another snap (confined) accessing it, I'm not sure which dir is accessible by default to all snaps though, checking default policy15:57
ysionneauyes it would be for out autopilot, that Parrot should land an interface to allow 3rd party apps to connect to our unix ocket15:57
ysionneausocket*15:57
loolysionneau: BTW I wanted to tell you about shm15:57
ysionneauah!15:57
loolysionneau: not sure if you saw the exchange on the ML, but shm is open by default with snap.XXX prefix15:57
loolysionneau: https://lists.ubuntu.com/archives/snapcraft/2016-August/000611.html15:57
lool  /{dev,run}/shm/snap.@{SNAP_NAME}.** mrwlkix,15:58
ysionneau!!15:58
ysionneauah this is for shm, ok thanks!15:58
loolysionneau: damn, I'm out of time, but I think this is the default policy: https://github.com/snapcore/snap-confine/blob/master/debian/usr.bin.snap-confine16:00
loolysionneau: I have to run to a meeting, perhaps you'll find a dir in there16:00
loolah no I still have :3016:01
ysionneauI have updated my fw btw16:02
ysionneauI'm using ubuntu-core_148.snap16:02
ysionneauusr.bin.ubuntu-core-launcher -> usr.lib.snapd.snap-confine16:03
ysionneauI'm not very fluent in apparmor profiles though, where to look for "unix socket rights"?16:03
kgunnjdstrand: sorry otp, but sudo systemctl stop/start worked...and now i get a different denial so that's good16:04
ysionneaudoes not seem to be any unix socket stuff related in the default profile :/16:04
loolysionneau: I think it's just about read on the socket16:04
loolysionneau: to do open()16:04
ysionneauhmmm no special rights for connect listen bind send recv sendmsg ?16:05
ysionneauhmm maybe I can use the shm related exception ?16:06
loolI think you get these from network16:06
loolwhich is autopluggable16:06
loolysionneau: https://github.com/snapcore/snapd/blob/master/interfaces/builtin/network.go16:06
loolysionneau: so16:06
loolysionneau: just say plugs: [network]16:06
ysionneauI already have it16:07
=== davidcalle is now known as davidcalle|afk
cholcombehey snappy peeps!  I'm looking at the snapcraft-daily ppa and it looks like it hasn't been built in a week16:11
cholcombei need the latest so i can try out the rust plugin16:11
ysionneaulool: question is, where do I put it (the socket :p)16:12
loolysionneau: ah I was wrong, the default perms are in https://github.com/snapcore/snapd/blob/master/interfaces/apparmor/template.go16:12
ysionneauthx16:13
loolysionneau: unfortunately the 3 rw locations seem to be /tmp which is diverted to a per snap tmp, shm, and ptmx16:13
loolysionneau: is this a rw socket you need?16:13
ysionneauhmmm16:14
loolwell you'll need to send messages I guess16:14
ysionneauyes16:14
ysionneausend and receive16:14
ysionneauboth sides are going to send/recv16:14
loolysionneau: so I guess your best bet is to use a snap specific location, but avoiding the version; perhaps /snap/<snap name>/common/foo.socket16:15
loolthat way the confined snap has rw access16:15
looland the dir wont be removed if you ever create it16:15
ysionneauhmm so, autopilot snap, would create the socket in /snap/facedetect/common/ so that facedetect snap can open it ?16:15
jdstranddidrocks, lool, ysionneau: different snaps aren't allowed to talk to each other. the canonical answer is that the snap that is providing a service should provide a slot implementation of a new interface, then the other snap plugs [ the-new-interface ]16:15
looljdstrand: right, this is just for doing a PoC without rebuilding snapd16:16
ysionneaujdstrand: that's the "clean" way, I agree with that (except that I'm not very happy to have to submit a pull request to snapd), but I would need a hackish temporary solution16:16
loolysionneau: that's what I was thinking, haven't tested16:16
ysionneaulool: ok let's try that16:16
didrockslool: I doubt the autopilot snap will be able to create in /snap/facedetect/common (confined), right?16:17
looldidrocks: autopilot isn't confined16:17
jdstrandysionneau, lool: I think it might be possible to use the content intreface to export a rw path and then use a named socket16:18
jdstrandin that path16:18
kyrofaelopio, is snapcraft not building daily?16:18
kyrofa(saw cholcombe's question above)16:18
jdstrandcaused named sockets don't need a unix rule, only a file rule, which is provided by the content interface16:18
looljdstrand: is there a pointer on using content interface and is it landed? I saw it in master but have never used it16:18
didrocksjdstrand: content inteface doesn't enable to expose anything which isn't in $SNAP if I'm right, though?16:18
kyrofaelopio, is that only snapd?16:19
didrockslool: I guess that's not going to fix it for you (as per ^)16:19
looldidrocks: not sure what you mean16:19
jdstrandlool: you need snapd 2.0.11 and snap-confine from xenial-proposed16:19
looldidrocks: sounds like exactly what we'd need: autopilot shares its socket as the contents to the facedetect snap16:19
didrocksyou can only expose /snap/<snap_name>/<version>/16:19
didrocksso the ro path16:19
jdstrandlool: this PR has doc updates that better document the content interface: https://github.com/snapcore/snapd/pull/1409/files16:20
mupPR snapd#1409: docs/interfaces.md: improve interfaces documentation <Created by jdstrand> <https://github.com/snapcore/snapd/pull/1409>16:20
ysionneauhmmm maybe I can create the socket in the $SNAP at build time16:20
didrocksno SNAP*_DATA or anything like this16:20
didrocksah, if you create it at build time, that could work16:20
jdstranddidrocks: the exported dir is bind mounted into one of the SNAP dirs16:20
didrocksjdstrand: indeed, but the snap exposing the content interface requires (from the examples I saw) a path under it's $SNAP/16:20
looljdstrand: +* Auto-Connect: yes for snaps from same publisher, no otherwise16:21
looljdstrand: will it work with a devmode local snap?16:21
jdstranddidrocks: suppose the service snap exports a rw path via content interface. that snap then creates a named socket in that rw path. then the plugging snap imports that rw path into its area and accessing that named socket16:22
jdstrandlool: I think you can force a manual connection. I didn't implement this feature, not sure without reading the code16:22
didrocksjdstrand: my point is that content interface only expose ro path (under it's $SNAP), you can't export rw path16:23
jdstrandno, you can16:23
didrocksthat's what zyga told though at the heidelberg sprint16:23
jdstrandwrite (slot): read-write paths from providing snap to expose to the consuming snap16:23
didrockshe was going to remove the write keyword as it didn't work16:23
jdstrandoh, well, this is pre-Heidelberg16:23
ysionneauhmmm not sure in fact a socket can be created at build time and bind() to at runtime :/16:24
ysionneaumaybe the server *has* to create it :/16:24
looljdstrand: so providing snap would say slot [content:write: [foo.socket]] and consumer [content:target: [foo.socket]]16:24
jdstrandif he couldn't get that to work then this technique won't work16:24
looljdstrand: how do you specify autoconnect to a fixed name snap?16:24
loolysionneau: you can probably ship a socket file in the squashfs of the snap and bind it at runtime16:25
ysionneauwell, that's the thing I'm not sure if it's possible16:25
jdstrandlool: I think it needs to be a dir, but yes, that is the idea. as for autoconnect, aiui it is part of snapd's interaction with the store-- if from same publisher it just does it16:25
ysionneauthere is high chance bind()ing an already existing socket file will say "address already in use"16:25
jdstrandlool: note that didrocks said that zyga said that 'write' doesn't work16:25
looljdstrand: but I dont see where one says which snap to connect to16:25
loolyeah, write is needed too16:25
jdstrandlool: you don't say what can connect, it just does it16:26
jdstrandie, I upload a content snap, so any plugging snap I upload will autoconnect. if you plugged my content, it would not16:26
looljdstrand: how do I say which content I want to autoconnect to?16:26
didrockslool: http://paste.ubuntu.com/22328522/16:26
pmplool: ysionneau: maybe related?! There seems to be a env-variable called $SNAP_USER_COMMON (which currently not working according to the mailing list's discussion)16:26
ysionneauok let's try the "autopilot creates the socket in /var/snap/facedetect/common" trick then16:26
didrocksfor a content slot example16:26
jdstrandyou get all the exports16:26
looldidrocks: ah great16:27
looljdstrand: got it with didrocks' example16:27
didrockslool: see that you only say "/foo", and this is intended as /snap/content-slot/current/foo (so relative to $SNAP)16:27
jdstrandok16:27
mupPR snapcraft#689 closed: kernel plugin: kernel targets depending on debarch <Created by sergiusens> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/689>16:27
jdstrandit's too bad that write doesn't work16:27
loolpmp: There's SNAP_COMMON as well; this is the one you want16:27
didrockslool: the other side is http://paste.ubuntu.com/22328645/16:27
loolpmp: USER_COMMON is per user (in home), a bit ugly IMO16:28
didrocks(you need to ship an empty import/ dir in $SNAP in that case ^)16:28
jdstrandI wonder what the issue would be. seems if you picked 'write' you'd look at the slotting snaps SNAP_DATA and if read the slotting snap's SNAP16:28
didrocksjdstrand: that's when I told him that all paths were related to $SNAP, and so, write won't work if you can't specify which env variable you want to be relative to that he told me write is going to be removed16:28
lool----(=    (..)-----16:29
didrocksbut yeah, write would be relative to SNAP_DATA (if it worked)16:29
jdstranddidrocks: sure, but I don't understand why all paths must be relative to SNAP. why not SNAP_DATA?16:29
didrocksjdstrand: that was my question to him when this discussion happened :)16:29
didrocksmaybe he or I was jetlag and there is a clear answer and write is going to work16:30
loolyeah, I think everything related to SNAP_DATA is more logical16:30
jdstranddidrocks: I mean, snapd could even be super smart and create the dir and everything...16:30
looleven read-only16:30
looldon't know if symlinks would work, but that's much more useful16:30
loole.g. to share read-only view on live files16:30
didrockslool: not really, read relative to SNAP is great for sharing libs16:30
loolyou can always expose static contents by copy or symlink16:30
looldidrocks: but you can still do it16:30
didrocksjdstrand: +1 (yeah, creating it in the mount namespace)16:30
loolfrom SNAP_DATA16:30
didrocksyeah, so rather read: [SNAP_DATA/foo, SNAP/bar]16:31
didrocksthat would be the best16:31
jdstrandmy takeaway is that today write is probably broken, but that it is probably supportable16:31
didrocksand same for write: (of course, relative to SNAP, that would fail…)16:31
didrocksthat would fix a lot of use case and avoid blocking on interface creation16:31
ysionneauarggggg16:32
ysionneauI forgot something16:32
jdstrandtyhicks: so, I think I may have discovered a bug16:32
ysionneauboxinit( autopilot snap) is sandboxed (chroot) ... it cannot easily create a socket in another snap's SNAP_DATA16:32
ysionneauwell, I can still create a mount bind before chrooting16:32
ysionneaugrrrrr16:32
jdstrandtyhicks: just so you have code to look at, https://code.launchpad.net/~jdstrand/+git/snap-userns-test16:33
jdstrandtyhicks: the issue is that I can't use clone(CLONE_NEWUSER) inside the sandbox. it doesn't seem related to nnp16:33
loolysionneau: just bind mount when starting your chroot16:33
loolysionneau: ah you've said that already16:33
jdstrandtyhicks: I get EPERM and no denials. I'm starting to think it might have something to do with the namespace patches16:34
loolysionneau: or use shm!   :-)16:34
ysionneaushm ?16:34
loolshm_open() etc.16:34
ysionneauI'm passing file descriptors via unix sockets etc16:34
loolI mean stop using real sockets and files16:34
ysionneauto do dmabuf (mmap)16:34
loolah yeah, dont think you can pass fds over shm16:34
jdstrandshm_open() paths are mediated between snaps16:34
ysionneauto send video buffers16:34
jdstrandit seems like you are trying to find a hole in the sandbox (which is great, but if you find it, I will plug it :)16:35
jdstrandsnaps are by definition isolated from each other except though defined interfaces16:36
pmpwith jdstrand supporting us like this we will need to do a real interface in snapd for our needs16:36
looljdstrand: one of them is unconfined here though16:36
jdstrandif all you need it a demo, then drop a rule in /var/lib/snapd/apparmor/profiles/... and run apparmor_parser -r on it after install16:36
loolpmp: I can hear you branching github.com/snapcore/snapd already16:36
jdstrandoh, well, if you use devmode your fine16:37
jdstrandyou're16:37
ysionneaujdstrand: so far I found no hole, I'm using the help of a devmode snap to create the hole =)16:37
pmpcouldn't we add an shared-files-interfaces, or shared unix-socket interfaces - where the providing snap defines a filename and users of this snap can get this filename somehow16:37
jdstrandput the file in SNAP_DATA on one and the then one in devmode can access it16:37
pmpan alternative for us would be to load the snap via the market in devmode16:38
jdstrandpmp: technically, sure, we could code that, however niemeyer won't approve generic interfaces like that because they are by definition not well-defined and interfaces should be well-defined16:39
pmpjdstrand: ack16:39
looljdstrand: yes, SNAP_DATA is exactly what I suggest, but with COMMON to have a stable nam16:39
loolname16:39
looland also a place you can use even if the snap is being removed/added16:40
kgunnjdstrand: any thots on why the sendto denial happens on the first start attempt?16:40
pmpjdstrand: another alternative would be to have snap implement/provide new interfaces16:41
pmpjdstrand: custom ones16:41
pmpjdstrand: but this won't help us for the POC16:41
jdstrandkgunn: presumably because the interface isn't connected yet16:41
pmpreally, can't we convince webdm to load all snaps with --devmode?16:42
jdstrandpmp: I'm curious what the service is-- is it public?16:42
jdstrandpmp: is it webdm?16:42
cholcombehow do you list which plugs are available?16:43
pmpjdstrand: for the poc it is just that we'd like to have a snap insert something into our gstreamer-video-pipeline16:43
jdstrandcholcombe: snap interfaces16:43
cholcombejdstrand, thanks.  i get no interfaces found :(16:43
pmpjdstrand: we decided to do a face-detection16:43
jdstrandpmp: this is for webdm?16:43
pmpjdstrand: no16:43
jdstrandhmm16:44
jdstrandinserting something into a gstreamer pipeline, that sounds tricky16:44
pmpso, ehm, yes, well, how to explain?...16:44
jdstrandanyway, for a demo, I think one in --devmode is your best shot16:45
pmpwe have 2 snaps, one which contains "everything" - including a video-processing-pipeline16:45
pmpwe want to install the second snap, which modifies the video-stream, via the market16:45
jdstrandthis is essentially the plugin problem16:46
pmpthe market installed is done via webdm and webdm is not installing snap in devmode16:46
pmpyes, I wasn't aware, but the "plugin-problem" sounds like it16:46
tyhicksjdstrand: does it work in devmode?16:47
jdstrandanyway, I don't mean to distract you. we won't solve the problem now16:47
jdstrandtyhicks: oh, it works if I launch directly but not in strict mode. let me try devmode (silly me)16:47
pmpjdstrand: every input is welcome16:47
pmpjust thinking, how is webdm installing snaps, if itself is a snap?16:48
jdstrandwell, I can promise you I will be a part of the conversation as these things are submitted :)16:48
jdstrandpmp: it has access to snapd-control16:48
jdstrandthe snapd-control interface16:49
pmpok, logic, could it request an install in devmode?16:49
jdstrandI don't see why not16:49
* jdstrand is not a webdm developer16:49
jdstrandtyhicks: huh, it doesn't seem to work in devmode either. let me test something. gimme a sec16:50
mupPR snapd#1644 opened: A gpio interface for os and gadget snap <Created by jocave> <https://github.com/snapcore/snapd/pull/1644>16:50
ysionneauok I made progress but it still does not work, I will have a look on monday, thanks guys for the help !16:50
ysionneausee you !16:50
ysionneausee you on monday pmp16:50
pmpysionneau: yep, bon week-end16:50
ysionneauthx16:51
tyhicksjdstrand: ok, I'm going to step away for a short bit and will check in when I get back16:52
jdstrandtyhicks: ok, I confirmed the security policy is in complain mode and it doesn't work16:53
jdstrandtyhicks: guessing it is something with snap-confine and the bind mounts then16:54
jdstrandtyhicks: let me play with it16:54
jdstrandtyhicks: thanks for that idea16:54
tyhicksjdstrand: sounds good but don't rule out the possibility of a bug that affects complain mode, as well16:58
jdstrandtyhicks: yes, but I don't want to distract you while I (dis)prove that17:02
mupPR snapd#1432 closed: interfaces/builtin: improve pulseaudio interface <Reviewed> <Created by jhodapp> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1432>17:03
mupPR snapd#1642 closed: many: pass device to store <Created by matiasb> <Closed by niemeyer> <https://github.com/snapcore/snapd/pull/1642>17:05
niemeyerjhodapp, morphis: ^^^17:06
morphisniemeyer: what a weekend present :-D17:06
niemeyermorphis: Just in time! ;)17:06
jhodappis it approved? :)17:07
morphisjhodapp: better, merged :-)17:08
cholcombesilly question but how do i give my snap a configuration file?  I'm looking through the docs and I don't see where that's mentioned17:24
kyrofacholcombe, what do you mean?17:27
cholcombekyrofa, i need to give my daemon a config file to start up properly.  where do i put that in that snap?17:27
sergiusenskyrofa I think cholcombe is talking about configuration hooks ;-)17:27
kyrofacholcombe, you mean how do you get a config file into the snap itself using snapcraft? Or provide it at runtime?17:27
* sergiusens goes for lunch17:28
kyrofacholcombe, does the config file need to be altered at runtime, or is it something you can distribute in the snap yourself?17:28
cholcombekyrofa, well ideally it should be user provided.  i don't know the credentials to their database, etc17:28
cholcombekyrofa, no i can't distribute it17:28
kyrofacholcombe, ah, indeed, then sergiusens is right17:28
cholcombekyrofa, are there docs for the config hooks? :)17:28
kyrofacholcombe, heh, they don't exist yet. I'm writing them right now :P17:29
cholcombehaha17:29
kyrofacholcombe, the hooks themselves, I mean17:29
kyrofacholcombe, but, you said something a little concerning17:29
cholcombeoh yeah?17:30
kyrofacholcombe, snaps are supposed to bundle their dependencies. But it sounds like you haven't-- what database are you connecting to?17:30
cholcombei'm connecting to influxdb17:30
cholcombei assume that will be provided by the end user17:30
cholcombeis that a bad thing to assume?17:30
cholcombei don't want influxdb to live on the same host as i'm installing this snap on17:30
kyrofacholcombe, no, that sounds reasonable17:31
cholcombethis snap i'm building collects metrics and sends them off17:31
elopiokyrofa: no, it seems we lost the daily snapcraft job in one of the reboots.17:32
kyrofacholcombe, actually, before we go anything further-- are you using 15.04, or the in-progress 16 series?17:32
elopiokyrofa: do you need it? It's really easy to set up.17:32
cholcombekyrofa, i'm on 16.0417:32
kyrofaelopio, cholcombe wanted to try out the rust plugin17:32
cholcombekyrofa, yeah the rust plugin works great17:32
cholcombethat's all fine.  i built snapcraft from the source tree and i'm using that17:32
cholcombeit's the config file business i'm stuck on now17:33
kyrofacholcombe, okay, so you know snapd is still being developed for 16, right? Obviously you're free to use it, but you'll run into this type of thing (e.g. config not being completed)17:33
kyrofacholcombe, if you're okay with that, you have a few options17:33
cholcombekyrofa, oh i didn't know that17:33
cholcombei mean i'm fine using whatever17:33
kyrofacholcombe, you're on the cutting edge!17:33
cholcombei can back off to 15.10.  that's no problem17:34
kyrofacholcombe, it's up to you. If you can deal with the current limitations you might be happier sticking with 16 since 15 is pretty much end-of-life17:34
cholcombekyrofa, i just thought 16.04 was the stable one to use.17:34
kyrofacholcombe, 16.04 desktop, definitely. But the snap side is still being developed17:35
cholcombekyrofa, that's fine17:35
kyrofaOkay, so here's what you can do17:35
cholcombei'm basically just kicking the tires here.17:35
kyrofaRather, let's talk about how this WILL work real quick17:35
cholcombesure17:36
kyrofacholcombe, when I'm done, your users will be able to call `snap set <yoursnap> username=<username> password=<password>`17:36
cholcombeinteresting17:36
kyrofaThat will end up calling an executable contained within your snap located at meta/hooks/apply-config17:36
kyrofaThat's all snapd will do for you. The apply-config executable you provide will need to handle those parameters and write them to the config file you intend17:37
cholcombeok that's no problem17:38
elopiohum, all the slaves died. How lucky.17:38
kyrofacholcombe, so: that doesn't exist yet. What I suggest you do is write something that fits similar logic though, and expose it via the apps: keyword like everything else17:38
cholcombekyrofa, ok17:38
kyrofaThen your users can just call it directly for the time-being, and once config hooks land, the amount of work you have to do is minimal17:38
cholcombekyrofa, cool.  that sounds fine17:39
kyrofacholcombe, remember the snap only has a few places it can write (I'm not sure how long you've been kicking the tires)17:40
cholcombekyrofa, for about a week :)17:40
kyrofacholcombe, so you know about SNAP_DATA, SNAP_USER_DATA, etc.?17:41
cholcombekyrofa, i do yeah17:41
kyrofacholcombe, you're set then. Let me know if I can help any more!17:42
cholcombekyrofa, thanks :)17:42
loologra_: do you have a reliable rpi3 classic image?17:42
loologra_: I used a community one a while back, but it had misinstalled .debs and such, and relied on a PPA17:42
ali1234lool: the official rpi2 classic image has misinstalled debs and relies on a ppa, so i doubt you'll find anything for the rpi317:45
loolali1234: oh wow really? I don't remember hitting this with our official rpi2 server image17:45
ali1234lool: yeah, it's broken17:46
ali1234lool: dist-upgrade breaks networking17:46
ali1234you can't use hats because the dt overlays are missing17:46
loolali1234: crap, is there a workaround for the dist-upgrade?17:46
ali1234and you need a ppa to do anything with opengl17:46
loolI dont care about hats that much17:46
loolnor opengl17:46
ali1234lool: yes, hack the /etc/netowkr/interfaces manually until it works17:47
ali1234the issue is systemd persistent interface names17:47
loolAh17:47
ali1234the base image expects that disabled. after dist-upgrade you cant disable them17:48
ali1234and yes i reported these bugs on launchpad17:48
elopiokyrofa: cholcombe: https://launchpad.net/~snappy-dev/+archive/ubuntu/snapcraft-daily it's enabled again.17:59
kyrofaThanks elopio!17:59
cholcombeelopio, nice :)18:00
JamesTaitI can't help thinking this is a question that must have been asked before, but I haven't found an answer: I'm pretty sure my (cuberite) snap is hitting some seccomp constraint when running confined which results in the process being killed. How can I trace the call that's causing that?18:00
jdstrandJamesTait: look in /var/log/syslog. easiest is to install snappy-debug then do: sudo /snap/bin/snappy-debug.security scanlog18:01
JamesTaitAh - I thought that only gave output for apparmor-related stuff?18:02
jdstrandJamesTait: if you look just in /var/log/syslog, you'll need to use scmp_sys_resolver NN to resolve the syscall number18:02
jdstrandJamesTait: nope, seccomp too (it will resolve syscalls for you)18:02
JamesTaitThen I think it's the fchown call, which I think comes from libsqlite3. 🙁18:02
JamesTaitBut armed with the knowledge, I'll have a more thorough dig into the problem this evening. Thanks jdstrand!18:03
jdstrandonce the snap-confine in xenial-proposed finally lands, I'll be able to make some changes to allow fchown to your own uid18:04
kgunnjdstrand: success! fully confined....will do final clean ups18:04
JamesTaitjdstrand, that sounds great, can't wait!18:05
jdstrandkgunn: nice!18:05
JamesTaitHave a great weekend, folks!18:05
* JamesTait waves18:05
tsimonq2sergiusens: when's the next release planned?18:35
sergiusenstsimonq2 almost today18:39
sergiusenswhy?18:39
tsimonq2just curious18:39
tsimonq2and what does almost mean?18:40
tsimonq2:P18:40
tsimonq2I guess my question is, do I have a chance of getting stuff in before the next release?18:40
ogra_ lool only a snappy one from yesterady, no classic ...18:42
ogra_lool, http://people.canonical.com/~ogra/snappy/all-snaps/all-snaps-pi3.img.xz in case that helps in any way ("sudo snap install classi --devmode --edge" works fine as well in case you need a classic env ... (use "sudo classic.create" and classic.shell with it )18:44
* ogra_ vanishes back into the hight18:45
kyrofaHight. Must be a German word18:46
ssweenypretty short for a German word18:46
kyrofatsimonq2, probably not18:46
kyrofassweeny, haha, no kidding!18:46
tsimonq2kyrofa: alright thanks18:47
tsimonq2kyrofa: nice catch re: bug 158642318:55
mupBug #1586423: File-based sources (.tar, .zip, etc.) should show a progress bar when downloading <Snapcraft:In Progress by tsimonq2> <https://launchpad.net/bugs/1586423>18:55
Guy1524how does snap contain programs?18:55
Guy1524nvm18:56
kgunnsergiusens: i just thot of an interesting feature for snap ...remove-all, or has someone already asked for this ?19:08
sergiusenskgunn I am totally out of context19:08
kgunnsergiusens: was just thinking, as developers may pull down a clean core...then install a bunch of snaps, they may want to take it back to a clean core19:09
kgunne.g. i've got 2 snaps...now and was just thinking it'd be nice to have one shot wipe them both19:09
kgunnand i suspect over time people will load more than 2 and have the same feelig19:09
kyrofakgunn, https://github.com/zyga/devtools/blob/master/reset-state ?19:13
kgunnkyrofa: ah nice...does that work with vm's? or just local19:15
kyrofakgunn, I've only run it local19:15
Guy1524I have a question, why does snap need to duplicate libraries, couldn't libraries be isolated separately from applications so duplicates of the same library version don't exist19:18
mupPR snapcraft#712 opened: New plugin: dump <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/712>19:36
kgunnjdstrand: just letting you know, i'm trying to go back through all the confinement one more time...i'm noticing there's a variety of denials that occur BUT i can still launch my app19:57
kgunnso i'm guessing those are errant19:57
mupPR snapd#1645 opened: interface: add transitional browser interface <Created by jdstrand> <https://github.com/snapcore/snapd/pull/1645>20:01
jdstrandkgunn: if you collect them in a paste, I can have a look20:04
niemeyerjdstrand: ping20:30
jdstrandniemeyer: hey20:34
niemeyerjdstrand: Heya20:34
niemeyerjdstrand: Trying to get to some quick agreements on the browser interface so we can land it20:34
jdstrandtyhicks: fyi, the CLONE_NEWUSER is resolved if I use the ubuntu-core-launcher in the archive. seems like a problem with snap-confine20:35
jdstrandniemeyer: ok20:35
niemeyerjdstrand: We need a new suffix for interfaces which say "this is what I need from the system to work"20:35
jdstrandyeah. it's weird cause that is kinda true for all of them20:35
jdstrandaccess... but that doesn't really cut it20:37
jdstrandtbh, I picked browser cause it was sorta like 'home'20:38
jdstrandin that it was a pure perm20:38
=== evanmeag_ is now known as evanmeagher
niemeyerYeah.. harness, although not quite.. hmm20:40
niemeyer-support!20:42
jdstrandoh20:42
jdstrandthat is pretty good20:42
jdstrandniemeyer: I think that is good20:43
niemeyerLet's do it20:44
jdstrandok20:44
niemeyerAbout hte sandbox option20:44
jdstrandniemeyer: thoughts on allow-browser-sandbox vs sandbox?20:44
jdstrandheh20:44
niemeyerjdstrand: How does chrome call the feature internally?20:44
niemeyerIs it "sandbox" simply?20:44
jdstrandsandbox20:44
jdstrandthey have different sandboxes20:44
jdstrandsetuid, usernamespace, seccomp20:45
jdstrandbut I didn't want to expose all that20:45
jdstrandfirefox also calls it a sandbox20:45
jdstranduse-internal-sandbox?20:45
niemeyerOk, so we can't avoid the term.. hmm20:45
niemeyerSeems too much like the sandbox is about snapd20:46
jdstrandyeah20:46
jdstranduse-browser-sandbox?20:46
jdstrandwe're pretty close to what I initially suggested :)20:46
jdstrandbrowser-sandbox?20:46
niemeyercan-sandbox feels okayish, I think20:47
niemeyerbrowser-support... can-sandbox..20:47
niemeyerallow-sandbox isn't bad either20:47
niemeyer(which was your first term suggestion)20:48
niemeyerAlternatively, we might break that down20:48
niemeyerjdstrand: How specific to browser are those bits?20:48
niemeyerjdstrand: Would sandbox-support make sense on its own?20:49
ahoneybunmm wonder about that dbus-bind20:49
niemeyerahoneybun: What are your wonders? :)20:49
jdstrandin this transitional interface, right this second, not very. but I'd like to use a child profile at some point that would be20:49
ahoneybunwhen it's coming20:50
niemeyerSoon!20:50
niemeyerahoneybun: What are your needs?20:50
ahoneybunPithos can't run without a service20:50
jdstrandniemeyer: so, I was trying to avoid a general sandbox-support right now, cause I don't yet understand how we can make it general20:50
jdstrandI know what the browsers need, right this second, so was trying to just do it all there with an attribute20:51
jdstrandof course, I guess there is nothing saying the attribute itself can't be 'sandbox-support'20:51
ahoneybunniemeyer: http://pastebin.ubuntu.com/21338511/20:51
jdstrandthat would look slightly weird20:52
jdstrandniemeyer: I could just use 'sandbox: true' and handle it in the documentation20:52
camakotrying to run 'snapcraft cleanbuild' on my snap, but I'm getting "500  Internal Server Error"... here's the log ---> http://pastebin.ubuntu.com/22354532/20:52
niemeyerjdstrand: If browsers need it and we know they need it, why is it behind an attribute, considering the only purpose of said interface is the browsers who need it?20:52
jdstrandthis is really only meant for the major vendors in the short-medium term, not everyone in the world and not forever20:52
jdstrandniemeyer: well, not all browsers need it. did you see my rather long description?20:53
camakomy lxd otherwise appears sane... anyone have an idea?20:53
jdstrandeg, electron doesn't need that20:53
jdstrandniemeyer: in other words, I expect only google and mozilla to use (and be able to use) sandbox: true. people just embedding webviews don't need it20:55
niemeyerjdstrand: I see.. let met review the sandbox-specific code once more20:55
jdstrandniemeyer: do read my (I know its lengthy) description though-- it gives justification for the implementation, talks about the store, etc20:56
niemeyerjdstrand: I skimmed through it all, but need to re-read enough to understand it20:57
jdstrandniemeyer: this also isn't the 'forever interface'. this is the 'today interface'. as we implement more and more we can move stuff out of the browser-support interface into non-transitional interfaces. I suspect one of those is user-namespace-support20:58
jdstrand(for example)20:58
niemeyerjdstrand: I have a feeling we'll live with this interface for a long time :)20:58
jdstrandbut I was asked to unblock all this with a transitional interface20:58
jdstrandeh20:59
niemeyerjdstrand: It's responable, not complaining.. just being realistic20:59
jdstrandI don't know. we can get rid of all but oom_score_adj in the medium term for 'sandbox: false'. then most of sandbox: true is in 'user-namespace-support'20:59
niemeyerreasonable21:00
niemeyerjdstrand: Reading through the code, I'm not sure.. it feels like there's a lot of stuff that is there just because the browser happens to do it rather than being specific to sandboxes21:00
jdstrandyes21:00
jdstrandbut we can fix that with various things21:00
jdstrandlike the preload library21:01
niemeyerjdstrand: It seems better to be honest and have a wildcard browser interface that fixes the problem at hand than to generalize it poorly with unclear settings21:01
jdstrandor a kernel patch to allow safe use of ptrace21:01
niemeyer(which is exactly what you're doing there)21:01
niemeyer(the being honest part :)21:01
niemeyerjdstrand: Okay, let's go with browser-support + allow-sandbox21:02
jdstrandright, I didn't want to generalize poorly, which is why user-namespace-support is not a thing yet21:02
jdstrandok21:02
niemeyerjdstrand: Hold fire, let me add a couple more comments and we can try to merge the next push21:04
jdstrandniemeyer: note that zyga once dinged my for your suggestion of 'allowSandbox, _ := plug.Attrs["allow-sandbox"].(bool)'21:12
jdstrands/my/me/21:12
jdstrandniemeyer: he said I should use the method I am since I want to test for the presence of the attribute first and then test if the bool or not21:12
jdstrandwell21:12
jdstrandI already did that in SanitizePlug21:12
jdstrandniemeyer: ok, nm21:12
niemeyerjdstrand: Ok, done21:13
niemeyerjdstrand: Just trivials..21:14
jdstrandniemeyer: the unity7 change was in fact needed for chrome. do you want another PR?21:21
niemeyerjdstrand: If it's related it's fine21:21
niemeyerjdstrand: Let me know when you're done21:21
jdstrandjust running ./run-tests21:22
jdstrandgithub has a much nicer way of showing the changes after a git mv than 'git show'21:24
jdstrandok, pushed but let me double check twith real snaps21:28
niemeyerjdstrand: Thanks!21:31
niemeyerjdstrand: renames in git are a bit weird21:31
niemeyerjdstrand: It's all detection based21:31
niemeyerSometimes github shows really awkward "renames", when files are too small.. it thinks it's a move as the license header remains the same21:32
niemeyerjdstrand: One of the trivial code improvement suggestions didn't land.. no biggie though21:34
mupPR snapd#1637 closed: cmd/snap,cmd/snap-exec: support hooks again <Created by kyrofa> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1637>21:37
niemeyerahoneybun: Sorry for the trouble there.. will try to get the dbus iface in sooner rather than later21:39
niemeyerjdstrand: On those topics, we need to find a good name for that general dbus interface21:40
* jdstrand notes running 5 snapcraft's in parallel on big snaps is probably not the best idea21:42
kyrofajdstrand, pshh. Half the time is pulling anyway21:44
kyrofajdstrand, perhaps you should start them staggered, though21:45
jdstrandnot on these snaps :)21:45
kyrofaOh :P21:45
kyrofajdstrand, what is a big snap that doesn't involve pulling?21:45
kyrofajdstrand, also, why aren't you using launchpad to build them?21:46
jdstrandit involves pulling21:46
jdstrandit is just the other bits take a long time too21:46
sergiusensjdstrand snap try!21:46
jdstrandchrome, chromium, firefox, electron and vscode all in parallel21:46
jdstrandno, I needed real snaps21:46
jdstrandanyway21:46
kyrofaAh, very nice21:46
jdstrandit's done21:47
jdstrandniemeyer: ok, I pushed the simplification. things are good on my end21:47
niemeyerjdstrand: Cool, will just wait for tests21:53
niemeyerjdstrand: dbus-object is an interesting candidate for that other interface21:53
jdstrandniemeyer: hmm, it is. I've got a hard stop in 4 minutes. I'll think about that and maybe we can pick up on Monday?21:57
* jdstrand used dbus-app since it had mild acceptance on the list, but is happy to change it21:57
niemeyerjdstrand: Yeah, let's talk on Monday21:58
niemeyerjdstrand: Have a good weekend22:01
jdstrandniemeyer: have a nice weekend :)22:01
jdstrandheh22:01
niemeyer!22:01
niemeyer:)22:01
niemeyerThanks22:01
jdstrandniemeyer: something with freedesktop in the name might be interesting too (it is  af.d.o spec)22:01
jdstrandthank you22:01
jdstrandtoo :)22:01
jdstrandgotta run! :)22:01
mupPR snapd#1636 closed: snap: don't load unsupported implicit hooks <Created by kyrofa> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1636>22:19
mupPR snapd#1645 closed: interface: add transitional browser-support interface <Created by jdstrand> <Merged by niemeyer> <https://github.com/snapcore/snapd/pull/1645>22:24
mupPR snapd#1646 opened: cmd/snap,overlord/hookstate: support hook data transfer <Created by kyrofa> <https://github.com/snapcore/snapd/pull/1646>23:38

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!