/srv/irclogs.ubuntu.com/2016/09/16/#snappy.txt

mupPR snapcraft#800 closed: LP: #1623509 nodejs: fix to install dev-deps in build phase <Created by jonathon-love> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/800>01:47
=== chihchun_afk is now known as chihchun
=== drizztbsd is now known as timothy
pbekogra_: I just wanted to report that the snap updates for QOwnNotes now work automatically after Launchpad published them to the Ubuntu Store, thanks a lot. I released 16.09.8 this morning...05:54
Sid_Is there a way to automatically create a snap from a launchpad build recipie ... At the moment it's asking me to build the yaml ...I guess the information is there in the control file and make lists...06:21
mupPR snapd#1931 opened: patch: fix patch4 transition <Created by mvo5> <https://github.com/snapcore/snapd/pull/1931>07:01
mupPR snapd#1932 opened: add HACKING.md and move content from README.md over <Created by mvo5> <https://github.com/snapcore/snapd/pull/1932>07:09
mupBug #1571497 changed: snapd crashes on slot disconnection <Snappy:Fix Released by zyga> <https://launchpad.net/bugs/1571497>07:18
mupBug #1571497 opened: snapd crashes on slot disconnection <Snappy:In Progress by zyga> <https://launchpad.net/bugs/1571497>07:42
mupPR snapd#1931 closed: patch: fix patch4 transition <Created by mvo5> <Merged by chipaca> <https://github.com/snapcore/snapd/pull/1931>08:00
=== test is now known as Guest38976
=== john-mca` is now known as john-mcaleely
mupBug #1624265 opened: Ubuntu Core pi3 image booting up hang at 4 icons <Snappy:New> <https://launchpad.net/bugs/1624265>08:27
ogra_mvo, so what about that release ? want me to do it ? we cant do a new ubuntu-core promotion anyway until console-conf behaves, so i guess waiting for the ARU wont get us much further anyway09:02
ogra_s/ARU/SRU/09:02
mvoogra_: sru happend this morning09:04
ogra_mvo, yes, but how would that help ?09:04
mvoogra_: new snapd 2.15 is in the ppa, so this part is ready09:04
mvoogra_: what is the issue with console-conf?09:04
ogra_it doesnt generate a network config at all on the pi3 currently09:05
ogra_(well, it does, but after reboot it is gone)09:05
mvoogra_: is that a regression?09:05
ogra_well, it is there since wifi support was added09:05
ogra_so yes and no09:05
mvohm, tricky09:05
ogra_(regression in new feature)09:06
mvoso with the old console-conf it was possible to get working wired networking on the pi3?09:06
ogra_you get all the wifi stuff in the UI and it behaves just fine, but after reboot the config is gone09:06
mvoif so and the new one does not manage that then I think its a regression and thats bad :/09:06
ogra_yes09:06
mvoso even wired network does not work on the pi3? or will that part work?09:07
mvoogra_: do you know what the status of that is? is mwhudson working on it?09:07
mvo(or someone else?)09:07
ogra_i have to check with todays edge, but i think its bogus all the way09:07
mvohm hm09:07
mwhudsonthe non-persistence should be fixed with new snapd09:08
ogra_he is looking into various wifi issues (last screen doesnt show teh IP for ssh)09:08
mvomwhudson: aha, cool09:08
ogra_(some issue with SSIDs)09:08
mwhudsonhttps://github.com/CanonicalLtd/subiquity/pulls <- some fixes here09:08
ogra_(and the persistence)09:08
mwhudsoni wanted cyphermox to review and land and do a release09:08
mwhudsonbut if there's some urgency i can merge them anyway...09:08
mvoogra_: I would love to make a new beta image based on snapd 2.15 and with a new snapweb (that actually starts at boot), lool made some really nice fixes here09:09
ogra_so the new snapd in the PPA should fix the persistence ? i'll do a quick image test ...09:09
mvoogra_: uploaded only some minutes ago, not sure if its published in the ppa yet09:09
mwhudsonogra_: if it has https://github.com/snapcore/snapd/pull/1901 in it09:09
mupPR snapd#1901: firstboot: do not overwrite any existing netplan config <Created by mwhudson> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/1901>09:09
mvoogra_: but please do and let me know, I go and work on snapweb now for a bit to see if I can make it releasable09:09
ogra_ok09:10
mvomwhudson: that is in09:10
mwhudsonok09:10
ogra_mwhudson, what abotu the last screen not showing the login data09:10
mwhudsonogra_: i think that's fixed by accident by https://github.com/CanonicalLtd/subiquity/pull/16209:10
mupPR CanonicalLtd/subiquity#162: Indicate if a wired interface is connected or not <Created by mwhudson> <https://github.com/CanonicalLtd/subiquity/pull/162>09:10
mwhudsonogra_: my theory is that console-conf doesn't re-probe to get the new addresses properly09:11
ogra_hmm, ok09:11
ogra_i guess thast not in the PPA package yet ?09:11
ogra_heh, i didnt get tzo read bugmail yet ... i see you answered on all my bugs :)09:13
mwhudsonyeah, not in ppa yet09:13
mupPR snapd#1933 opened: store: add "ready to buy" method <Created by pete-woods> <https://github.com/snapcore/snapd/pull/1933>09:20
ogra_mvo, snapd just published in the PPA ... i triggered a new ubuntu-core ...09:24
om26erHi! where does pip and npm fall in the snappy world, can I install pip packages today on a Ubuntu Core system ?09:25
ogra_both are used by snapcraft when building a snap AFAIK09:26
popeystgraber: broke lxc again... error: not found (not a fingerprint, partial fingerprint (first 12 chars) or valid alias)09:27
ogra_you really need to stop beating it with a club all the time :)09:31
popey:(09:32
ckinghi, I've got 3 snaps been waiting for review for ~1 week, eventstat, forkstat and powerstat, can they be looked at for me? thanks09:52
ogra_if they went to review something is surely wrong ?09:53
ckingogra_, like they exist in the main repo, so I have a name clash09:53
ckings/repo/archive/09:53
ogra_you mean you didnt claim the names before uploading ?09:54
ckingogra_, I've claimed the names and it's now marked "pending review"09:54
ogra_you mean the name request ?09:55
ogra_weird09:55
ckingi'm even the upstream developer, so it should be easy to claim stuff I own and package ;-)09:55
* cking just keen to get the latest crack out09:56
ogra_mvo, mwhudson, very weird, i dont get wlan offered at all on the pi3 with the latest edge image09:58
mupPR snapd#1934 opened: many: refresh all snap decls <Created by pedronis> <https://github.com/snapcore/snapd/pull/1934>10:01
ogra_hmm, and no credentials even for wired now ...10:03
ogra_thats bad10:03
* ogra_ tries again 10:03
ogra_same on the dragonboard ... no credentials on last screen10:08
ogra_pi3 shows them on second try10:09
cjwatson~/wg 5410:09
cjwatsonsorry10:09
ckingogra_, so I assume I just wait until somebody eventually allows me to upload my snaps oneday?!10:24
ogra_well, i havent seen such issues with name registration ... and i dont knwo who our contact for EU timezone in the store team is10:25
ckingah, OK :-/10:25
ogra_i guess you need a store person ... are you actualyl sure the name isnt actually registered for you already ? if you try to register twice that might cause an issue10:26
ckingpretty sure I've not registered twice, well, it's not a big rush, just a nice to snap kinda thing10:28
ogra_well, if you did, it would show that on the store page for your upload at the bottom i think10:29
ogra_(teh store UI is really good hiding things at the bottom ... scrolled off the screen)10:29
* cking has a look10:29
ckingnah, it's not got a link to it, it's black, no link and "Pending review", so kinda stuck at that10:30
popeycking: approved10:30
ckingpopey, woot, my here10:30
cking*hero10:30
cking\o/10:31
ogra_mvo, so there seems to be a race with console-conf on the pi3 now ... it doesnt show wlan0 at all ... another thing is, if you reset the board hard before console-conf did write anything, firestboot goes all mad and you can throw away the image10:31
ogra_(wlan shows up in 7proc/net/dev after i configured wired network and rebooted)10:31
mupBug #1624322 opened: console-conf wlan race on pi3 <Snappy:New> <subiquity (Ubuntu):New> <https://launchpad.net/bugs/1624322>10:49
ogra_mvo, so bug 1623119 seems fixed at least ...10:50
mupBug #1623119: wlan setup done by console-conf not persistent <Snappy:Invalid> <nplan (Ubuntu):Invalid> <subiquity (Ubuntu):Invalid> <https://launchpad.net/bugs/1623119>10:50
ogra_mvo, but bug 1623120 hits hard on the dragonboard10:51
mupBug #1623120: console-conf does not show ssh credentials on last page when wlan is involved <Snappy:New> <subiquity (Ubuntu):New> <https://launchpad.net/bugs/1623120>10:51
ogra_mvo, and bug 1624322 on the pi3 ... but here we can resort to recommend to only use wired networking10:51
mupBug #1624322: console-conf wlan race on pi3 <Snappy:New> <subiquity (Ubuntu):New> <https://launchpad.net/bugs/1624322>10:51
mupBug #1624329 opened: snapd firstboot setup fails constantly when rebooting before console-conf has finished <Snappy:New> <snapd (Ubuntu):New> <subiquity (Ubuntu):New> <https://launchpad.net/bugs/1624329>10:58
ogra_mvo, so i'd say we can release but with a big fat hint that wifi config is still pretty much broken ... and with pointers to all these bugs above11:07
ogra_OH !11:08
ogra_thats a new one11:09
ogra_ogra@pi3:~$ sudo snap install classic --devmode --edge11:09
ogra_error: cannot install "classic": cannot get nonce from store: Post https://myapps.developer.ubuntu.com/identity/api/v1/nonces: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers11:09
ogra_eeek ... seems there is no resolver set up :/11:09
ogra_woah ... and i have two default routes ... thats gross11:10
* ogra_ takes a break11:20
mupPR snapcraft#805 opened: Refresh discharge macaroon if necessary <Created by cjwatson> <https://github.com/snapcore/snapcraft/pull/805>11:51
mvoogra_: if core is build, I would like to promote it to "beta"11:53
mvoogra_: any concerns aobut this?11:53
ogra_mvo, well, see my babbling in the last hour above :P11:53
ogra_there are three serious bugs ... that we should mention in the announcement ... beyond that i think we are fine11:54
ogra_and i think none of them affect an already installed system, so updates shoould be fine too11:54
mvoogra_: aha, so all wireless broken but the rest is ok(ish)?11:55
mvoogra_: I think thats ok, its still a beta (or even pre-beta) but it looks encouraging11:55
ogra_well, wireless is semi broken ... on the dragonboard it works just fine but console-conf doesnt show the IP ....11:55
ogra_on the pi3 there is some weird race between console-conf and the wlan device coming up11:55
ogra_which makes everything else weird11:56
mvoogra_: ok11:56
ogra_but yeah, i think we are good, but should mention the issues11:56
mvoogra_: if you have a running system, could you please "sudo snap refresh --edge snapweb" and reboot and check if snapweb:4200 comes up?11:58
mvoogra_: ++11:58
ogra_mvo, btw, bug 1624329 is a really bad one ... it actually forces you to do a fresh dd if console-conf doesnt finish11:58
mupBug #1624329: snapd firstboot setup fails constantly when rebooting before console-conf has finished <Snappy:New> <snapd (Ubuntu):New> <subiquity (Ubuntu):New> <https://launchpad.net/bugs/1624329>11:58
mvoogra_: oh, fun, I can only promote ubuntu-core to beta now, not stable, is there something with confinement: devmode somewhere?11:58
ogra_sadly hard to debug without being able to log in11:58
ogra_i dont have a running system from the last image, but i can snap install snapweb quickly ...11:59
mvoogra_: ta, I will also test11:59
ogra_comes up right after install12:00
* ogra_ reboots to see if it comes up on boot too12:00
ogra_uuh ... snapweb UI still allows me to remove the kernel12:01
mvoogra_: do we set "grade: devel" somewhere?12:02
ogra_mvo, looks good ...12:02
mvoogra_: \o/12:02
ogra_i have to check what we set in ubuntu-core ...12:02
ogra_yeah12:03
ogra_ubuntu-core has garde:devel atm12:03
mvoogra_: I think we want to not set this, we want ubuntu-core to be able to get to stable12:03
mvoogra_: not important right now, but probably soon(ish)12:03
ogra_well, i can change it right now ... next build will ppick it up12:03
ogra_we dont set grade at all for the kernels ... so whatever snapcraft puts in place is used there12:04
ogra_mvo, long term we need to stop using the PPA built ubunt-core for anything else but the stable channel anyway ... we'll have multiple builds once i killed the PPA12:05
ogra_err12:05
ogra_for anything else but the edge channel ... indeed12:05
ogra_the build coming only from the archvive will then be grade: stable12:05
mvoogra_: yeah12:07
qenghoI kept SSH running to my RPi3 last night so I could discover why it's dark and dead after many hours. I thought it was crashing somehow. But it's not. Last night I got a new "ubuntu-core" (634) from edge, and it set a 10-minute reboot timer, and then shut down. It never recovered. Network and console are dead until I unplug and re-plug.12:11
ogra_mvo, snapweb on arm64 looks good too12:12
ogra_qengho, file a bug (worked here)12:13
qenghoogra_: file a bug on what?12:13
qenghoubuntu-core?12:13
ogra_qengho, dunno, snappy in general for a start12:13
qenghoOkay.12:14
ogra_i.e. see topic :)12:14
qenghoI guess we don't have a bug tracker for snaps themselves. I wonder if we will.12:14
ogra_well, having one for ubuntu-core would be nonsense ...12:15
ogra_and others can define their bugtracker in the store12:15
ogra_there is a "support url" you can set up12:16
ogra_uappexplorer actually exposes it as a clickable link ... i hope one day snapweb will too12:16
mupPR snapcraft#806 opened: Remove snapcraft.storeapi.common <Created by cjwatson> <https://github.com/snapcore/snapcraft/pull/806>12:18
ogra_qengho, btw, an rpi without serial cable is useless ... get one and you can actually debug such issues ... ssh wont help12:20
ogra_(it really needs to become company policy that people getting *any* devboard also get a matching serial cable)12:21
qenghoCanonical didn't pay for this. I'm just nice.12:21
ogra_ah12:21
qenghoI have a keyboard and HDMI display directly attached.12:22
ogra_yeah, wont help wither12:22
ogra_*either12:22
qenghoEven after setting boot params?12:22
ogra_embedded boards need serial if you want to do proper debugging ... they are ... well ... embedded ... and usually used headless ... even if people start abusing them in other ways (like running desktops)12:23
qenghoI guess so. I hadn't considered my retail Pi3 to be a development board.12:24
ogra_on the pi the prob is that the console suspends at some point ... regardless ... so the above reboot prob can only really be debugged with serial attached ... unless you are sitting next to the board while it does the auto-reboot12:27
=== chihchun is now known as chihchun_afk
mupBug #1624371 opened: pi3 never recovers from ubuntu-core refresh <Snappy:New> <https://launchpad.net/bugs/1624371>12:38
ogra_qengho, oooh ... you used an ancient all-snaps image ... yeah, thats not expected to work at all12:39
qenghoDang.12:40
qenghoOkay, getting the ~mvo 10-day-old one.12:41
ogra_qengho, no, wait a bit12:43
ogra_we're in the middle of doing a release12:43
ogra_(especially since we had to pull back the last pi3 one due to xz corruption)12:44
mupBug #1624265 changed: Ubuntu Core pi3 image booting up hang at 4 icons <Snappy:Invalid> <https://launchpad.net/bugs/1624265>12:44
mupBug #1624371 changed: pi3 never recovers from ubuntu-core refresh <Snappy:Invalid> <https://launchpad.net/bugs/1624371>12:44
mupPR snapcraft#807 opened: Fix parts integration tests <Created by cjwatson> <https://github.com/snapcore/snapcraft/pull/807>12:45
sitterI am having trouble with content sharing. I am trying to get my content interface under /kf5 in the consuming snap but have a permission error: cannot mount /snap/kde-frameworks-5/x8 at /snap/yomo/x13/kf5 with options bind,ro. errmsg: Permission denied12:58
sitterhttps://paste.kde.org/pd8l5excq content interface https://paste.kde.org/puxumufie app12:59
=== matteo` is now known as matteo
mupPR snapcraft#808 opened: Don't litter /tmp with test artifacts <Created by josepht> <https://github.com/snapcore/snapcraft/pull/808>13:24
zygajdstrand: hey13:27
zygajdstrand: around by any chance? :)13:27
jgdxdo I need to set XDG_DATA_DIRS manually to e.g. $SNAP/usr/share or does this happen automaticall?13:27
jdstrandzyga: I am13:27
zygajdstrand: I'm chasing that kernel bug, I feel I get an idea what this may be about13:27
zygajdstrand: I'll know after the next reboot13:27
jdstrandoh13:27
zygajdstrand: the tracking bug is https://bugs.launchpad.net/snap-confine/+bug/162430013:28
mupBug #1624300: Cannot open /proc/self/ns/net <Snappy Launcher:Triaged> <https://launchpad.net/bugs/1624300>13:28
jdstrandthat's curious13:28
zygajdstrand: I'll update it with my findings13:28
jdstrandyes, I saw your bug13:28
zyga(I had a crash course in kernel development last night)13:28
jdstrandnice :)13:28
zygajdstrand: the thing I know for sure is that this is *not* related to nsfs13:29
zygabut to fs permissions actually13:29
zygawell, more data after next reboot13:29
zygaI got into the devel feedback cycle now13:29
jdstrandif it is the kernel, I'm going to immediately wonder why it ever worked and why downgrading didn't help, but I'm definitely all ears13:31
zygajdstrand: that I cannot answer yet13:32
kyrofasitter, hey, have you tried sharing sub-directories rather than the entire snap? Do you get the same error?13:46
sitterhm13:51
sitterkyrofa: no error if I use expose read: [usr] rather than /13:52
zygakyrofa: there was a bug in older snap-confine13:52
zygakyrofa: use a subdirectory please13:52
sitterzyga: can I wildcard instead?13:53
zygasitter: no13:53
sittermeh13:53
zygadpb, jdstrand, mvo: https://github.com/snapcore/snapd/pull/193513:53
mupPR snapd#1935: interfaces/apparmor: allow reading /etc/environment <Created by zyga> <https://github.com/snapcore/snapd/pull/1935>13:53
sittermhall119: http://mhall119.com/2016/09/sharing-is-caring-with-snaps/ you may want to update that given exposing / doesn't work anymore :)13:53
zygasitter: I personally fixed that bug13:54
mupPR snapd#1935 opened: interfaces/apparmor: allow reading /etc/environment <Created by zyga> <https://github.com/snapcore/snapd/pull/1935>13:54
zygasitter: I don't know if the fix got SRUd13:54
zygasitter: but it is fixed in master for sure13:54
zygasitter: or maybe it is another thing13:54
zygasitter: do you have a denial/error message or anything I can look at?13:54
sitterall I get is permission error: cannot mount /snap/kde-frameworks-5/x8 at /snap/yomo/x13/kf5 with options bind,ro. errmsg: Permission denied13:55
sitterI can get you more output if you tell me how ;)13:55
mhall119sitter: can you link to your snapcraft.yaml for both?13:56
zygasitter: which version of snap-confine do you have?13:56
mhall119sitter: it was fixed for the way I was using it13:56
sitterzyga: Version: 1.0.38-0ubuntu0.16.04.813:56
zygasitter: and look at dmesg/journalctl for the interesting apparmor denial13:56
ogra_mhall119, see above, he pastebinned it already13:57
* mhall119 scrolls13:57
zygajdstrand: can you please review and merge https://github.com/snapcore/snapd/pull/193513:58
mupPR snapd#1935: interfaces/apparmor: allow reading /etc/environment <Created by zyga> <https://github.com/snapcore/snapd/pull/1935>13:58
mhall119sitter: can you pastebin /etc/apparmor.d/usr.lib.snapd.snap-confine13:58
sitterzyga: Sep 16 15:59:01 smith kernel: audit: type=1400 audit(1474034341.962:76): apparmor="DENIED" operation="mount" info="failed srcname match" error=-13 profile="/usr/lib/snapd/snap-confine" name="/snap/yomo/x20/kf5/" pid=27361 comm="ubuntu-core-lau" srcname="/snap/kde-frameworks-5/x10/" flags="rw, bind"13:59
sittermhall119: https://paste.kde.org/pgou4aa9l14:00
mhall119sitter: ah, you don't have that fix14:01
* sitter shakes fist14:01
mhall119zyga: https://paste.kde.org/pgou4aa9l#line-120 he still has the older mount permissions that didn't work with a snap's root14:01
zygamhall119: correct14:02
zygasitter: you can fix this locally with a simple patch and one command run14:03
* zyga gets back to debugging the kernel14:03
mhall119zyga: don't be a tease, tell him the patch and command :-P14:05
* mhall119 remembers the patch, but not the commant14:05
sitterwell. I'd rather have a fix :P14:05
sitterI can't really sell a patch to my fellow lazydevs ^^14:05
zygasitter: use a subdirectory (even dummy) for now, I'll ensure the update is released14:06
mhall119true, zyga do you know if there's an SRU in the works?14:06
zygamhall119: no, because I'm debugging kernel to make it releaseble14:06
sitterI have another question though... http://snapcraft.io/docs/reference/interfaces suggests that the read property of the slot would be an array. the target property of the plug is a string though?14:06
zygasitter: they are both strings for now14:07
zygawell14:07
zygaeach one is14:07
zygawell, let me just look14:07
sitter:)14:07
zygathey are both arrays14:07
zygasorry for the confusion14:08
sitterso the documentation probably needs a fix to indicate that :)14:08
mupPR snapd#1936 opened: asserts: revert change that made the account-key's name mandatory <Created by emgee> <https://github.com/snapcore/snapd/pull/1936>14:08
sitterI am going to roll with subdirs for now. thanks14:08
mupPR snapd#1937 opened: image: ensure local snaps are put last in seed.yaml  <Created by mvo5> <https://github.com/snapcore/snapd/pull/1937>14:28
=== chihchun_afk is now known as chihchun
mupPR snapd#1935 closed: interfaces/apparmor: allow reading /etc/environment <Created by zyga> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/1935>14:30
mthaddoncan anyone point me at a place to track support for snaps on trusty?14:51
* ogra_ hands mthaddon a cable with a plug to tvoss' brain interface14:51
mthaddonhaha - I was meaning is there a bug or feature request somewhere on it?14:52
tvossmthaddon: not really, we have a trello card but I do not know if that's publicly available14:53
mthaddonok thanks - is do you have a rough idea of when it might happen? Would it be worth me filing a bug about it?14:54
tvossmthaddon: I'm proposing required changes to snapd as we speak14:54
mthaddonsweet14:54
tvossmthaddon: the ppa I'm using for testing purposes is here: https://launchpad.net/~thomas-voss/+archive/ubuntu/trusty14:55
mthaddonthx muchly14:55
zygaogra_: ohh, brain interface14:55
zygaI must connect that one next time I'm debugging things14:55
tvosszyga: bit painful in the beginning, but hey14:57
tvossmthaddon: http://pastebin.ubuntu.com/23186546/ should get you off the ground14:58
ogra_:D14:58
zygatvoss: that looks like something snap-confine could do to test in soread14:58
zygaspread*14:58
mthaddonthx14:59
tvosszyga: wow, snap-confine can test brain interfaces? ;)14:59
zygatvoss: the test may fail on Friday though14:59
xnox$ sudo snap install appx15:03
xnoxsudo: unable to resolve host repackappx15:03
xnox74.93 MB / 74.93 MB [===============================================================] 100.00 % 4.42 MB/s15:03
xnoxerror: cannot perform the following tasks:15:03
xnox- Mount snap "ubuntu-core" (423) ([start snap-ubuntu\x2dcore-423.mount] failed with exit status 1: Job for snap-ubuntu\x2dcore-423.mount failed. See "systemctl status "snap-ubuntu\\x2dcore-423.mount"" and "journalctl -xe" for details.15:03
xnox)15:03
xnox..15:03
xnoxi can't install snaps inside a lxd container?15:03
SamYaplejdstrand: has there been anymore developments behind https://bugs.launchpad.net/snapcraft/+bug/1577514 ?15:03
mupBug #1577514: Support preloading to make snaps feel at home <snapd-interface> <Snapcraft:Triaged by sergiusens> <https://launchpad.net/bugs/1577514>15:04
tvossxnox it certainly fails in chroot, systemd refuses to play along nicely15:04
tvosszyga: would certainly fail over here15:04
jdstrandSamYaple: not to my knowledge. I think people have been focusing on GA (but I'm not assigned to it or doing the assigning)15:05
zygajdstrand: I traced the error we're seeing to apparmor15:06
SamYaplejdstrand: thats about to be a real blocker to me in packaging openstack, do you know someone I could reach out to to have a chat about it?15:06
zygasforshee: o/15:06
sforsheezyga: o/15:06
zygajdstrand, sforshee: so I think I wrapped my head around the bug now, I guess I'll need you and tyhicks to guide me further15:06
zygathe root cause is apparmor and this ALLOWED (but really not) message:15:07
zygaSep 16 17:01:45 xenial-server audit[5944]: AVC apparmor="ALLOWED" operation="open" info="Failed name lookup - disconnected path" error=-13 profile="snap.snapd-hacker-toolbelt.busybox//null-/home/zyga2/snap-confine/spread-tests/xfail/lp-1623400/bug" name="" pid=5944 comm="bug" requested_mask="r" denied_mask="r" fsuid=1000 ouid=015:07
zygathis is allowed but we really see -13, aka EACCES15:07
mupPR snapd#1934 closed: many: refresh all snap decls <Created by pedronis> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/1934>15:07
zygato confirm this you can use devmode snapd-hacker-toolbelt, run it with sudo and switch the profile to unconfined with aa-exec15:08
zygaso I see two things here that are odd:15:08
zyga1) apparmor is in complain mode and says ALLOWED but we still get -1315:08
jdstrandI wonder if it has something to do with nnp15:08
zyga2) how do we not get the disconnected path, I suspect I messed up pivot_root somehow15:08
zygannp?15:08
jdstrandNO_NEW_PRIVS15:08
zygammm15:09
zygahow can I quickly check that? is that in snap-confine's aa profile15:09
* zyga looks15:09
jdstrandfyi, on 15.04 snappy vm I am able to open the file15:09
zygajdstrand: I'll try with snap-confine master15:10
zygato see if this is a new issue15:10
jdstrandit shouldn't be new15:10
zygajdstrand: I'd love to get some advice as to where to look in apparmor kernel sources to see why issue 1) may happen (if my theory is right)15:10
jdstrandie, not introduced in the recent pr, but sure15:10
jdstrandzyga: would needs tyhicks or jjohansen15:11
zygajdstrand: master is affected the same way15:12
zygajdstrand: I'll check back before we did pivot_root15:12
jdstrandok15:13
jdstrandif I add 'file,' to the complain mode profile, it works15:13
zygahmm?15:14
zygaI don't understand what that means, can you explain please15:14
tyhicksit means there's probably a file access rule that needs to be added to the profile15:14
jdstrandzyga: install hello-world snap in devmode. add to /var/lib/snapd/apparmor/profiles/snap.hello-world.sh 'file,'. apparmor_parser -r ... ; hello-world.sh, then ip netns list15:15
jdstrandtyhicks: well, it is complain mode15:15
tyhicksjdstrand: the attach-disconnected flag is already present on the profile?15:16
jdstrandyes15:16
jdstrandprofile "snap.devmode.sh" (attach_disconnected,complain) {15:16
zygajdstrand: what is the meaning of the 'file,' rule?15:16
jdstrandif I remove 'file,' and reload, ir fails. if I add it and load, it works15:16
jdstrandzyga: allow all file access15:17
zygahmmm15:17
zygawell, that's a big cannon15:17
jdstrandwell, sure15:17
jdstrandthe point is, I just narrowed it down to file rules in complain mode15:17
jdstrandwell, we did15:17
zygaok, I see now15:17
zygaso what do you think we should do next,15:18
zygaI'd like to understand why apparmor runs into this error, why is /proc disconnected15:18
mupPR snapd#1936 closed: asserts: revert change that made the account-key's name mandatory <Created by emgee> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/1936>15:18
zyga(and is it /proc/self/ns/net or everything in proc/self/ns)15:18
tyhickshow do you know that it is /proc?15:18
zygatyhicks: nothing else seems to fail, it just affects open() on that file15:19
tyhickszyga: ah, I misunderstood - what's the full path? /proc/self/ns/net?15:20
zygatyhicks: https://bugs.launchpad.net/snap-confine/+bug/162430015:21
mupBug #1624300: Cannot open /proc/self/ns/net <Snappy Launcher:Triaged> <https://launchpad.net/bugs/1624300>15:21
jdstrand/proc/** does not allow it15:21
tyhickszyga: ok, so /proc/ is probably not disconnected but the target of the ns symlink is15:22
tyhickszyga: which is some virtual "ns:[NNN]" reference15:23
zygatyhicks: snap-confine doesn't touch that15:23
zygatyhicks: and it happens even without the recent work towards namespace sharing15:23
jdstrandwe aren't getting good logging15:23
tyhicksjdstrand: there's not much to log, unfortunately15:24
zygajdstrand: I printk'd my way around procfs, it is nothing there15:24
tyhicksjdstrand: apparmor is asking the vfs to look up this path and the vfs is saying that it can't15:24
zygajdstrand: I'd like to look at apparmor next15:24
jdstrandoh weird15:25
sforsheetyhicks: in what sense? The kernel can resolve the path to an inode in nsfs15:25
jdstrand /** ix, allows it15:25
tvossmthaddon: let me know how it goes, I will grab dinner now but I'll be around later15:25
tyhickssforshee: I can't claim to know all the technical details of apparmor's disconnected path issues - we'll have to have jj here for that :/15:26
tyhickssforshee: it happens in aa_path_name() -> d_namespace_path()15:26
zygajjohansen: ^^15:26
mthaddontvoss: I won't have time to test just yet, but will let you know if I find time next week - thx15:26
zygajjohansen: if you are around we could use a hand15:26
tyhickszyga: he pulled an all nighter - he won't be around for a while15:26
sforsheetyhicks: thx, I'll take a look15:27
zygaI know the feeling15:27
jdstrand/{bin,sbin}/ip ix,15:27
jdstrandthat allows it ^15:27
zygaoh?15:27
tyhickswut15:27
zygajdstrand: so might it be that15:27
zygait is not the namespace15:27
zygait is the executable?15:27
zygawat?15:27
jdstrandthat also answers why the reporter had it working-- he was connecting the network-control interface even though it was in complain mode15:27
jdstrandok, that part of the mystery is solved15:27
zygabut how come it fails for a simple reproducing C program?15:28
zygajdstrand: I still don't get it can you tell me how allowing ip fixes it?15:28
jdstrandit has to do with the exec transition15:28
jdstrandif we don't have the ix rule for the binary that is accessing /proc/self/ns/net, then it fails even in complain mode15:29
zygajdstrand: (I just checked that it doesn't fix it if another program, say "bug", compiled from bug.c somewhere in home tries to access it15:29
tyhicksI have to step away for a little bit15:29
zygatyhicks: o/15:29
jdstrandzyga: sure. add an ix rule for your bug program15:29
jdstrandI'll do so now. I bet it will work15:29
zygajdstrand: sure but why does that fix it? is it becasue aa cannot find /home somehow?15:29
* zyga tries15:29
jdstrandwell, again, that is the mystery and the bug15:30
jdstrandI'm just trying to narrow this down15:30
zygajdstrand: yes, confirmed!15:30
zygaah, ok, I thought you cracked that one :)15:30
zygaok15:30
zygaso I think there are two consequences:15:30
jdstrand@{HOME}/Desktop/open-proc-self-ns-net ix,15:30
nothaljdstrand: No such command!15:31
zyga1) we can merge ns sharing without thinking it breaks something15:31
jdstrandif I add that ^, it works. if I don't, it doesn't15:31
zyga2) we have to look at apparmor deeper to figure out what is broken15:31
jdstrandzyga: do one '1'15:31
jdstranderr15:31
jdstranddo '1'15:31
zyga:-)15:32
zygayep, that will be my pleasure15:32
jdstrandwe can say in the LP bug on namespace sharing that there is an apparmor bug which requires people to use and connect network-control even in --devmode15:32
zygajdstrand: btw, I managed to crash the stock xenial kernel with a few bind mounts yesterday, ran out of memory looping on something15:32
jdstrandcool :)15:32
zygajdstrand: I'll look at /media sharing next so I'll try to reproduce and report it15:32
zygajdstrand: if you give me your blessing on https://github.com/snapcore/snap-confine/pull/146 I'll do a release15:33
mupPR snap-confine#146: Use sanity timeouts around blocking operations <Created by zyga> <https://github.com/snapcore/snap-confine/pull/146>15:33
jdstrandzyga, tyhicks: I'll file a bug on the exec transition issue, with a reduced test case15:33
zygajdstrand: thank you, please dupe the bug I reported15:34
tyhicksok, I'm back15:35
jdstrandzyga: thank you for looking into this so much. that was a really weird bug. I'm glad that I thought to try on 15.04. cause 15.04 doesn't have devmode, I just added a bunch of rules (like 'file,') and saw it worked. then I was like-- "huh-- I wonder if it is just one of those..." :)15:36
zygajdstrand: there's only one thing left worrying me:15:37
tyhicksjdstrand: I'm glad we have a workaround but, boy, I'm confused about it15:37
zygahttps://github.com/snapcore/snap-confine/pull/13315:37
mupPR snap-confine#133: Adjust apparmor policy for compatibility with snap-exec <Created by zyga> <https://github.com/snapcore/snap-confine/pull/133>15:37
zygathis doesn't fail for me in qemu (for sanity I just started another run)15:37
zygabut fails all the time in linode15:37
zygaand we cannot release without it as snapd now uses snap-run/snap-exec15:38
jdstrandtyhicks: hopefully with the reduced test case it will get people to zero in quickly on the problematic code15:38
tyhickszyga: are we sure that the linode environment has an up-to-date Ubuntu xenial kernel and apparmor package?15:39
jdstrandzyga: you are saying that on linode, if you unapply 133 that the tests pass with no problem, but when you apply it the fail undeterministically?15:40
zygatyhicks: great question, I bet it doesn't15:40
zygajdstrand: yes15:40
jdstrandI bet some of the nodes are up to date and some aren't15:40
zygajdstrand: though test still "pass" because the snapd there is not using snap-run/exec I suspect15:40
zygajdstrand: they all share one image15:40
zygajdstrand: and my qemu image is 3 days old15:40
zygajdstrand: I'll see if I can get gustavo to refresh that next week15:41
zygaif it works in qemu again I'll merge it with a note describing this15:41
tyhicksthe unsafe stuff requires apparmor 2.10.95-0ubuntu2.2 and it'll also behave differently from kernels prior to xenial to xenial kernels15:41
jdstrandzyga: I can't explain why if what you are saying is correct (every node has the same kernel and apparmor) why it would sometimes pass15:42
zygajdstrand: no, it never passes15:42
zygajdstrand: it always fails in linode15:42
jdstrandah15:42
jdstrandok15:42
mupPR snapcraft#807 closed: Fix parts integration tests <Created by cjwatson> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/807>15:42
zygajdstrand: and always works in qemu15:42
jdstrandyes, make sure those images are up to date15:42
jdstrandthat makes a lot more sense then15:42
zygatyhicks: I'll update dependency in the packaging15:42
tyhickssomething doesn't sound right about the linode env15:42
tyhickszyga: ok, let me double check that version before you do so15:43
zygathank you15:43
tyhickszyga: you should depend on 2.10.95-0ubuntu2.2 or newer15:44
qenghojdstrand: refresh to get GPUness.15:45
jdstrand\o/15:45
zygajdstrand: quick question, do we need to add anything to snapd's interfaces or base profile to unblock "ip netns" to work/15:46
zygamvo: did you do the 2nd release today yet?15:46
qenghojdstrand: You know much about the "personality" syscall? I have a C-compiled regular snap that uses it (and thus gets an mightly slaying) on ARMHF only, and I don't know why, and I'm trying to decide if there's something wrong or if compiling differently would avoid it.15:47
jdstrandzyga: I don't think so. network-control already use the ix rule for ip15:47
jdstrandI'me going to double check that though15:47
mvozyga: no, still waiting for final tests15:47
zygamvo: ok, I think we're good :)15:48
zygajdstrand: I just confirmed too, woot15:51
zygawhat a fantastic way to finish the week friends :)15:52
jdstrandyeah15:52
jdstrandwhat a weird bug15:52
jdstrandI'm really glad we figured out why it worked on the mailing list too. that was a very puzzling mystery15:52
zygabtw, this is still a bug in apparmor, regardless of the disconnected path thing15:53
jdstrandI literally couldn't stop thinking about how to get the original test case to work again15:53
jdstrandoh yes15:53
jdstrandtotally15:53
zygaas EACCES bleeds through apparmor complain mode15:53
jdstrandand we can fix it15:53
zygaI'll have a stab at this over weekend, maybe my printk-based deduction will lead me to it ;-)15:54
jdstrandbut much of the mystery is gone and we have a workaround that is fairly natural15:54
zygaindeed, it's surprising it didn't hit us earlier though15:54
jdstrandwell, not really15:54
zygaand I still don't understand how the location of the executable influences the problem15:54
jdstrandno one is using namespaces within snaps much15:54
jdstrandwell, lxd15:54
jdstrandhmm15:54
zygafor instance it worked in python3 because that had the workaround you found naturally in the base template15:54
jdstrandoh, they have a bare file rule15:54
jdstrandand docker I think has the ip command15:55
zygabut is it *just* for nsfs or is it a general issue?15:55
jdstrandseems just nsfs15:55
jdstrandI mean, you can open regular files all day long in complain mode15:55
jdstrandthat we would have definitely heard about15:55
zygawell, still some mystery as to what is going on there :)15:55
jdstrandwell, perhaps it is a proc thing15:55
zyganext week I'll work on media sharing and, perhaps, on live namespace updates15:56
jdstrandno, not just proc. it does seem nsfs15:56
jdstrandanyhoo15:56
zygafeels great to move on :)15:56
jdstranda little bit, but jj will be able to see the problem I bet pretty quickly15:56
jdstrandzyga: indeed! :)15:56
jdstrandzyga: wrt 146, I was surprised about the alarm surronding the flock()s (not saying it is wrong). can you explain your thinking there>15:57
jdstrand?15:57
mupBug #1611444 changed: Cannot share a namespaces created with 'ip netns' between apps in a devmode SNAP <Snappy Launcher:Fix Committed by zyga> <Snappy:Invalid by zyga> <https://launchpad.net/bugs/1611444>15:57
zygayes, if the child process survives the parent for any reason15:58
zygait may lurk around forever holding the flock alive15:58
zygathis just ensures that, for *whaever* reason, if there are bugs an the child doesn't die15:58
zygawe don't hang forever but die15:59
zygaI suspect we could just keep the timers in the child15:59
zygawith the same effect15:59
jdstrandI looked at 146 only a little bit the other day and had that question and thought I'd ask. I'll take a closer look16:00
plarsI asked on #juju but also asking here as I'm not sure if this is a juju or snapd problem, but I'm getting stuck deploying an instance on xenial. It appears it's stuck in the upgrade of snapd because it hasn't finished running 'snap booted' after a very long time.16:00
zygahmm, interesting, the unsafe transitions don't fail as before16:00
zygabut now I see this:16:00
plarsIs there some known problem with this?16:00
zygacannot change apparmor hat of the support process for mount namespace capture. errmsg: Operation not permitted16:00
zygasupport process for mount namespace capture exited abnormally16:00
zygaplars: I think mvo is the person you want16:01
zygaplars: I think it might be16:01
jdstrandzyga: there should be a denial for that16:01
zygajdstrand: I'm still mid way my run in qemu16:01
zygait hasn't reached that point yet16:01
zygajdstrand: do I need any unsafe transition markers for the child and the hat?16:02
mvoplars: I think this is https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/162133616:02
mupBug #1621336: snapd.boot-ok.service hangs eternally on cloud image upgrades <oil> <verification-needed> <cloud-init (Ubuntu):Fix Released> <snapd (Ubuntu):Triaged> <cloud-init (Ubuntu Xenial):Fix Committed> <snapd (Ubuntu Xenial):In Progress> <https://launchpad.net/bugs/1621336>16:02
jdstrandhave to see the log entry16:02
zygajdstrand: spread run in lindoe didn't have it, I hope qemu will16:03
plarsmvo: that looks like exactly what I'm seeing :(16:04
mvoplars: looks like xenial-proposed has a fixed cloud-init16:05
zygaok, key test running now16:10
zygajdstrand: it's good in qemu, I'll ignore it and work on upgrading the linode kernels16:10
=== JanC is now known as Guest68752
=== JanC_ is now known as JanC
jdstrandzyga: ok, cool16:13
zygaok16:14
zygaI've merged everything but the timer16:14
zygaI *need* a break now16:14
zygaI will work on packaging and downstream testing to see if we're missing anything16:15
zygaand if it all goes green I'll release it upstream tomorrow16:15
zygaand start pushing updates to debian, ubuntu, arch, fedora and gentoo16:15
* zyga EODs (for once, on time)16:15
zygasforshee, jdstrand, tyhicks: thank you for your help!16:16
jdstrandzyga: enjoy your weekend and go see your family! :)16:16
zyga:-(16:16
zygaI won't see them till november16:16
jdstrandoh gosh16:16
jdstrandI thought they were in the next roomn16:17
zygathey are in spain and I stayed to sprint almost all october16:17
* jdstrand hugs zyga 16:17
jdstrandgo video chat with them then :)16:17
zygaI'll go out and see some friends though16:17
zygaI need to see real people, faces, not walls of my office16:17
jdstrandzyga: have some fun! you deserve it :)16:25
mupPR snapcraft#806 closed: Remove snapcraft.storeapi.common <Created by cjwatson> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/806>17:24
mupBug #1624490 opened: Snap access to /dev/uinput <hardware> <snapd-interface> <uinput> <Snappy:New> <https://launchpad.net/bugs/1624490>17:46
argeshi. I just upgraded snapd to 2.15, and installed a snap and got: cmd_run.go:179: WARNING: cannot create user data directory: cannot create "/home/ubuntu/snap17:50
argesafter this I tried upgrading ubuntu-core-launcher and then things worked correctly. So is this a known issue? Should snapd depend on a certain version of ubuntu-core-launcher?17:51
mupPR snapcraft#804 closed: Adjust login to conform to UX specification <Created by cjwatson> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/804>17:57
=== drizztbsd is now known as timothy
jdstrandtyhicks (cc zyga and jjohansen): https://bugs.launchpad.net/apparmor/+bug/162449718:08
mupBug #1624497: complain mode blocks access to nsfs (/proc/self/ns/*) without exec rule <AppArmor:New> <https://launchpad.net/bugs/1624497>18:08
tyhicksjdstrand: thanks for the nice writeup18:18
tyhicksjdstrand: jjohansen has some urgent work on his plate today so this is something that he'll probably have to wait until next week to triage18:19
jdstrandtyhicks: thanks. totally understood. I tried to make it clear in the bug that there is a workaround available. also, the new snap-confine that fixes bug #1611444 (ie, the ns sharing pr) won't land in xenial til next week or so anyway18:27
mupBug #1611444: Cannot share a namespaces created with 'ip netns' between apps in a devmode SNAP <Snappy Launcher:Fix Committed by zyga> <Snappy:Invalid by zyga> <https://launchpad.net/bugs/1611444>18:27
mcphailHi. What plug do I give a snap for sound? I have tried "audio" and "sound". Would it be "alsa"?20:17
mcphailThat doesn't seem to work either. Is there a list of interfaces somewhere?20:19
lpotteryou can get a list of available interfaces that are on your system by doing snap interfaces20:20
mcphaillpotter: thanks! I'll try "pulseaudio" :)20:21
mupBug #1624533 opened: app can't reach USB smart-card device <snapd-interface> <Snappy:New> <https://launchpad.net/bugs/1624533>20:35
mupPR snapd#1938 opened: asserts: check that validation assertions are signed by the publisher of the gating snap <Created by pedronis> <https://github.com/snapcore/snapd/pull/1938>20:35
loologra_: you wouldn't happen to have a recent image for rpi2?   O:-)20:38
ogra_lool, gimme a bit ...20:43
ogra_mvo wanted to release a set today, not sure why he didnt20:43
* mcphail has just packaged tombraider as a snap! If only it could be released to the store...20:45
loologra_: last minute snapd bug preventing it20:46
loologra_: fix is submitted20:46
loologra_: IIUC, interfaces are not well connected on first boot20:46
ogra_ah20:46
loolso bad user experinece20:46
loolI wouldn't care about it though20:46
ogra_so ont image related20:46
ogra_*not20:47
ogra_i'm pushing to http://people.canonical.com/~ogra/snappy/all-snaps/ ... give it 5min20:48
loolawesome20:49
ogra_done ... enjoy20:51
* ogra_ is afk again ... 20:51
loolmwhudson: FYI https://drive.google.com/a/canonical.com/file/d/0B5RxJIi-SaMdTVB3emo4SjNGUHM/view?usp=sharing when waiting for too long before entering email  :-)20:54
loologra_: thanks a ton man!20:55
loologra_: you rock  :)20:55
mhall119is there a snappy ubuntu core image for the raspberry pi 3? I know the image for the rpi2 will work, but I'd like to get one that will get the wifi and bluetooth working ootb21:24
mhall119actually, can anbody confirm that the rpi2 image works on the 3?21:31
loolmhall119: yes, there's a pi3 image22:08
loolmhall119: no the pi2 image shouldnt work there22:09
loolmhall119: http://people.canonical.com/~ogra/snappy/all-snaps/ is best you can get until monday where beta images will be rerolled22:09
mhall119thanks lool22:11

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!