=== benfrancis5 is now known as benfrancis [05:19] morning [05:34] PR snapd#8874 opened: spread: use find rather than recursive ls, skip mounted snaps [05:39] PR snapd#8875 opened: tests/main/sudo-env: check snap path under sudo [06:37] heh, debian sets secure_path too [06:58] wierd things happening in google:centos-8-64:tests/main/selinux-clean [06:59] Good morning [06:59] Hey Maciek [06:59] PR snapd#8859 closed: tests: enable snap-auto-mount test on core20 [06:59] Ha, is the spread test immediately useful? [07:00] I just took meds, should be able to work in 30 minutes [07:02] zyga: there's some denials coming from systemd-logind trying to read 'linger' file (whcih we created?) [07:02] trying to make sure it's not us doing something wrong [07:04] morning [07:06] Heh [07:06] Linger is tests.session [07:07] It is a systemd feature [07:07] But probably underused and missing in selinux profiles [07:08] pstolowski: hello sir [07:08] Hey Paweł :-) [07:21] zyga: hm i'm seeing this: [07:21] type=SYSCALL msg=audit(1592291609.858:541): arch=c000003e syscall=257 success=yes exit=3 a0=ffffff9c a1=55ce2c1a6420 a2=f0000 a3=0 items=0 ppid=1 pid=39430 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(d-logind)" exe="/usr/lib/systemd/systemd" subj=system_u:system_r:init_t:s0 key=(null) [07:21] type=AVC msg=audit(1592291609.858:541): avc: denied { read } for pid=39430 comm="(d-logind)" name="linger" dev="sda2" ino=17559683 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:systemd_logind_var_lib_t:s0 tclass=dir permissive=1 [07:21] H [07:22] which os is this? [07:23] which seems fine, because /var/lib/systemd/linger is labeled as systemd_logind_var_lib_t (correct & confimed with semanage fcontext), the pid is systemd-logind, which has systemd_logind_t and policy allows modifing that location [07:23] zyga: centos-8 [07:23] zyga: so for some short while, init_t (systemd itself?) tries to read the linger directory [07:23] hmmmm [07:24] afair yesterday centos 8.2 was released, and looking at dnf log, the test pulled in a bunch of upgrades [07:24] 9 | -y --refresh install /us | 2020-06-16 07:03 | I, U | 35 EE [07:24] 8 | -y --refresh install --s | 2020-06-16 07:01 | I, U | 278 EE [07:24] perhaps the policy changed, and we just need to update the image [07:25] grep for linger in systemd shows only logind and related things [07:25] and the selinux-policy package got updated too [07:25] though [07:26] login also uses it [07:26] hm i'll try adding daemon-reexec in test prepare [07:26] not surem, maybe it just is used in init itself too [07:28] zyga: btw. debian uses sudo secure_path [07:28] mborzecki: commented on https://github.com/snapcore/snapd/pull/8875/files [07:28] PR #8875: tests/main/sudo-env: check snap path under sudo [07:29] su -l is nearly always dangerous [07:29] zyga: ha, ok will fix that [07:34] PR snapd#8872 closed: tests/lib/prepare-restore.sh: if we failed to purge snapd deb, ls /var/lib/snapd [07:34] PR snapd#8873 closed: interfaces: misc small interface updates [07:34] PR snapd#8874 closed: spread: use find rather than recursive ls, skip mounted snaps [07:34] mborzecki: should we close or try to land #7414 ? it seems ok to me, one question is whether should we purge packages or just remove them? [07:34] PR #7414: tests: keep track of installed packages and restore the state after the test [07:37] mborzecki: I commented in it directly [07:37] pedronis: thanks, will chekc in a minute [07:39] PR snapd#8871 closed: tests/prepare-restore.sh: reset-failed systemd-journald before restarting [07:40] mvo is on a merging spree :) [07:43] zyga: I was shocked to see 80(!) open PRs when I woke up [07:43] zyga: and figured I need to do something :) [07:43] :D [07:44] PR snapd#7417 closed: interfaces/wayland: on classic systems only consider the OS slot for auto-connect <⛔ Blocked> [07:44] PR snapd#8789 closed: interfaces/docker: use implicitOnClassic: true <⛔ Blocked> [07:56] zyga: hm this looks like a bug in the policy or our setup, what happens is that we set StateDirectory=systemd/linger, then systemd tries to set up (create?) that directory for systemd-logind, but gets blocked by the policy [07:56] pedronis: in 8870 the interface name "gconf" is uncontroversial I assume? or is that something you want to review ? [07:56] hmm [07:56] mborzecki: up-to-date systemd has StateDirecty=systemd/linger [07:57] maybe centos-8 is just too old [07:57] it works fine on fedora [07:57] pedronis: other than the name 8870 is ready to get merged [07:57] I mean, the policy is probably too old [07:57] mvo: I probably need to double check it [07:58] pedronis: sure thing, added the label [08:01] zyga: I updated 8865, it's a bit annoying that we can't use a pre-canned action but it should be simple enough, hopefully the comment explains enough [08:01] thanks, I'll check it in a moment [08:01] digging into some kernel bit for uinput [08:01] pedronis: I assume you also want to double check 8867 (uinput) ? if so I will add the label [08:01] zyga: oh, nice [08:02] mvo: yes [08:08] a second review for 8857 would be great, should be quick and an easy win [08:21] mvo: added some comments there [08:21] * zyga small break [08:26] heh, so one of the tests moves xdg-open aside [08:27] zyga: and for now i have no clear solution for that selinux problem, feels like a policy bug, maybe if i can procure the ame state on rhel8 i could file a bug [08:28] zyga: nice, thanks! [08:30] PR snapd#8855 closed: cmd,many: move Version and bits related to snapd tools to snapdtool, merge cmdutil [08:36] zyga: do i need tests.session {prepare,restore} if i don't need anything or can i just tests.session exec in the test? [08:37] I would do it just in case [08:37] you probably just want restore [08:37] as using test.session without prepare still gives you a session [08:37] just makes it die briefly [08:37] I found it more reliably with prepare restore [08:37] as otherwise stuff starts and stops and may overrun [08:41] Gah thinkpad died again [08:41] i think i see the problem with xdg-open disappearing [08:41] I will use this as an excuse to eat breakfast [08:41] Hmmm? [08:43] zyga: xdg-open-compat overwrites /usr/bin/xdg-open, and then removes it [08:49] Ahhh [08:49] Nice catch! [08:54] i know we're not supposed to open new PRs but this one is super simple and fixes the problem ijohnson found https://github.com/snapcore/snapd/pull/8876 [08:54] PR #8876: tests/main/xdg-open-compat: backup and restore original xdg-open [08:55] zyga: mvo: ^^ [08:55] PR snapd#8876 opened: tests/main/xdg-open-compat: backup and restore original xdg-open [08:56] mborzecki: thanks [08:58] Looking [09:00] PR snapd#8846 closed: tests: move update-related tests to snapstate_update_test.go [09:00] mvo: thank you! 🙏 [09:01] pstolowski: thank you! [09:02] pstolowski: I'm looking at it to, it needs a follow up [09:05] pedronis: thank you. it's quite possible i overlooked something, or some tests can be re-ordered [09:06] pstolowski: https://github.com/snapcore/snapd/pull/8846#issuecomment-644637199 [09:06] PR #8846: tests: move update-related tests to snapstate_update_test.go [09:07] pstolowski: yes, the order is a bit weird of some tests, but not sure is the main worry at this point [09:07] pedronis: right, i was pondering about sequence tests in the PR description [09:07] pedronis: will prep a followup [09:08] thank you [09:10] pstolowski: once we have split more we can consider if reordering is worth it, I agree is a bit strange that for example TestInstallTasks or TestUpdateTasks are not among the first tests one encouters in those files, same more the main run through ones [09:11] more of an issue for people reading these for the first tiem [09:13] sounds good [09:16] I will work on existing PRs and reviews today [09:16] Need to relocate to another room though === ricab__ is now known as ricab [09:33] zyga: i've updated https://github.com/snapcore/snapd/pull/8875 [09:33] PR #8875: tests/main/sudo-env: check snap path under sudo [09:33] ack [09:35] PR snapd#8814 closed: sanity: check for unsynchronized real time clock <⛔ Blocked> [09:35] hmm [09:36] hm? [09:38] mborzecki: commented [09:38] I missed that you are running sudo to become root, not the test user [09:38] lets merge it [09:38] and if it shows up in any scans we can react [09:39] we MIGHT enable disable linger for root [09:39] but tests.session -u root restore does not do the same as it does for test user [09:39] so the protection is weaker [09:39] zyga: mhm, fwiw it needs to be run via sudo, otherwise that part of the test does not make sense [09:40] yeah, I understand [09:52] zyga: sorry for being pushy but a quick look at 8865 would be appreciated [09:52] sure [09:53] done [09:53] I think this is fine for now, we can look for how to support this better but it is not high priority [09:54] zyga: \o/ [09:55] PR snapd#8865 closed: workflow: test PR title as part of the static checks again [09:55] PR snapd#8876 closed: tests/main/xdg-open-compat: backup and restore original xdg-open [09:58] yay [10:14] degville: hi [10:17] degville: I wasn't sure how to covey this otherwise [10:17] zyga: unexpected failure in the PR with sudo env: https://paste.ubuntu.com/p/85m38SNbGm/ idk if it's related though [10:17] there are three new pull requests that add interfaces [10:17] I "assigned" them to you to make sure you are at least aware [10:17] mborzecki: looking [10:19] mborzecki: interesting, let me try [10:20] zyga: yes, I saw - and did a little +1 on your comments to let you know. I think it's a great idea and I'll make sure they're documented when they land. [10:29] mborzecki: checking some more [10:39] sigh [10:42] zyga: hm? [10:45] wifi range [10:45] I don't know what's in the walls here [10:45] but feels like tinfoiil [10:51] zyga: lots of reinforced concrete maybe? [10:51] I think so [10:51] so [10:51] I managed to get a debug shell [10:51] I started simple [10:51] tests.session -u prepare [10:52] then tests.session -u test exec id [10:52] then [10:52] tests.session -u test exec sudo id [10:52] so that all worked [10:52] I wonder if the OS matters, I picked xenial [10:52] I also tried sudo env [10:52] what was broken was sudo -l, right? [10:53] hmm [10:53] and that gave odd output [10:53] it just printed /usr/bin/id (I ran sudo -l id) [10:53] zyga: no it failed in a different test [10:53] zyga: but that sudo-env PR nonetheless [10:53] hmm? [10:54] can you remind me please [10:54] mborzecki: but sudo --login works [10:54] sudo -l doesn't [10:54] WTH? [10:54] zyga: thoght you're looking into https://paste.ubuntu.com/p/85m38SNbGm/ in the context of that sudo-env pr [10:55] zyga: sudo --login != sudo -d [10:55] pff -l [10:55] sudo --login == sudo -i :) [10:55] ah [10:55] stupid font [10:55] sorry! [10:56] I didn't notice [10:57] mborzecki: sorry, I was confused, i see what you mean now [11:11] we should land https://github.com/snapcore/snapd/pull/8761 once it's green [11:11] PR #8761: add msteams url support [11:25] PR snapd#8877 opened: tests: move a few more tests to snapstate_update_test.go [11:26] pedronis: ^ i'll handle sequence tests separately [11:27] pstolowski: yes, should probably wait until we have closed more PRs [11:27] 👍 [11:35] Heh, debugged my x240 shutdown problem [11:35] There is a “emergency reset hole” on the bottom [11:36] Which instantly powers of the unit [11:36] With a physical button [11:36] Those tiny clicker type [11:36] Squeezing the unit close to the right hinge just puts enough pressure to press it [11:37] Let me see about that [11:37] And I didn’t invent the name https://support.lenovo.com/us/en/solutions/pd029569 [11:41] i will be around shortly, my wife is removing that button [11:51] done [11:51] no more emergency reset hole [11:51] no more annoying shutdowns [11:51] just popped that button off the motherboard [11:51] sorry, mborzecki back to your review [11:53] second review for 8857 would be nice, should be an easy win, thanks to mborzecki for the tweaks [11:54] mvo: in a moment [11:56] mvo: added a comment [11:56] but LGTm [11:57] back to https://github.com/snapcore/snapd/pull/7414 [11:57] PR #7414: tests: keep track of installed packages and restore the state after the test [12:09] morning folks [12:09] in the interest of merging small PR's, could I get a review on https://github.com/snapcore/snapd/pull/8519 ? [12:09] PR #8519: tests/special-home-can-run-classic-snaps: re-enable <⚠ Critical> [12:10] the only test failure there is the current ongoing one about not being able to prepare uc20 systems due to failure to cleanup after snapd [12:11] mborzecki: added comments to 7414 that I think should be changed, I'll review the rest so please hold on :) [12:14] * zyga needs painkillers, brb [12:16] mvo: 8519 is ready for a sudo git merge and will take us back to the 60's (in terms of open PR's, time travel side effects are unknown) [12:25] hi ijohnson ! [12:26] o/ pstolowski [12:26] I updated the install hook spread test PR btw [12:26] please have a look when you have a chance [12:29] +1 [12:41] PR snapd#7982 closed: o/snapstate, wrappers: enable services on start <⛔ Blocked> [12:50] pstolowski: I looked again at #8812, and I have a few more questions there [12:50] PR #8812: o/snapstate: service-control task handler (4/N) [12:54] pedronis: ty [12:56] PR snapd#8519 closed: tests/special-home-can-run-classic-snaps: re-enable <⚠ Critical> [13:02] PR snapcraft#3169 closed: package-repositories: allow empty component list [13:06] PR snapd#8878 opened: tests: fix how gadget pc is detected when the snap does not exist and ls fails [13:11] zyga: looks like deskto portal activation is failing quite consistently now in 18.04 https://github.com/snapcore/snapd/pull/8875/checks?check_run_id=776173782 [13:11] PR #8875: tests/main/sudo-env: check snap path under sudo [13:11] mborzecki: looking [13:13] mborzecki: I think we should silence that line, it's just a fact that we kill dbus-monitor from awk when we see the stuff we care about [13:13] mborzecki: wonder how it didn't show up before [13:18] * zyga lunch [13:41] PR snapd#7414 closed: tests: keep track of installed packages and restore the state after the test [13:41] PR snapd#8857 closed: tests/lib/prepare: increase the size of the uc16/uc18 partitions [13:46] PR snapd#8366 closed: cmd/snap-bootstrap/initramfs-mounts: verify the seed snap matches bootloader env <⛔ Blocked> [13:57] mvo: shall we land https://github.com/snapcore/snapd/pull/8761 or do we need more input from jdstrand? [13:57] PR #8761: usersession/userd: add msteams url support [14:01] PR snapd#8856 closed: [RFC] tests/main/install-fontconfig-cache-gen: for bionic, focal use broken font [14:06] mborzecki: fyi, I'd like jamesh to comment on https://github.com/snapcore/snapd/pull/8761#issuecomment-639674545 for the xdg-desktop-portal code since he was involved in PR 8269's review [14:06] PR #8761: usersession/userd: add msteams url support [14:06] PR #8269: apparmor: use rw for uuidd request to default and remove from elsewhere [14:06] mborzecki: but aside from that PR 8761 has a LGTM for allowedURLSchemes so it doesn't need to wait on me [14:07] jdstrand: got it [14:07] also, do we expect centos-8-64 to pass atm? [14:08] I keep mashing retry but that one doesn't seem to pass [14:08] jdstrand: I think centos 8 has some selinux problems right now [14:08] ok, I'll stop mashing retry then :) === pedronis_ is now known as pedronis [14:11] jdstrand: there's some pending updates on centos, and the recent batch of package updates they pushed broke systemd/systemd-logind/selinux-policy [14:12] mborzecki: yikes [14:12] jdstrand: i hope that when cachio updates the image this may go away, but from what i could tell going through selinux policy and systemd it's bug [14:13] mborzecki, when I update the image the test still fails [14:13] mborzecki, this is the error I see https://paste.ubuntu.com/p/Z9KRsbh7vG/ [14:14] cachio: ok, let's push the image image then, and i'll try to make the test smarter [14:14] mborzecki, sure, thanks [14:14] cachio: thank you! === dennwc_ is now known as dennwc === niemeyer_ is now known as niemeyer === nniehoff_ is now known as nniehoff === cjp256_ is now known as cjp256 === joedborg_ is now known as joedborg === zyga_ is now known as zyga [14:16] time to run some errands === genii_ is now known as genii [14:36] mborzecki, image updated [14:36] zyga, hmm, cn layouts live in /run ? [14:36] File: /run/utmp (read) [14:36] Suggestions: [14:36] * adjust program to use $SNAP_DATA [14:36] * adjust program to use /run/shm/snap.$SNAP_NAME.* [14:36] * adjust program to use /run/snap.$SNAP_NAME.* [14:36]