/srv/irclogs.ubuntu.com/2020/08/24/#snappy.txt

mborzeckimorning05:11
zygagood morning06:26
mupPR snapd#9198 closed: features: add HiddenSnapFolder feature flag <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/9198>06:30
mborzeckizyga: hey06:36
zygahey :)06:36
zygafinally some cold air, eh?06:36
mborzeckiyeah, much cooler (and nicer)06:36
mborzeckilater summer/early autumn, cold mornings/evening, warm during the day06:37
mborzeckis/later/late/06:37
mborzeckierrand, back ~1106:39
mborzeckimvo: hey06:39
zygairc, eh,...06:39
mvogood morning mborzecki and zyga06:39
mborzeckineed to run an errand, back ~11 hopefully06:40
zygagood morning mvo06:40
zygamborzecki o/06:40
* zyga waits for Lucy to wake up06:40
* zyga goes to squash merge https://github.com/snapcore/snapd/pull/782506:41
mupPR #7825: many: use transient scope for tracking apps and hooks <Security-High> <Squash-merge> <Created by zyga> <https://github.com/snapcore/snapd/pull/7825>06:41
zygajust need to think of a proper commit message06:41
zygais anyone else using "git reflog" like the recent call lists on pre-smartphones?06:43
mupPR snapd#9204 opened: sandbox: track applications unconditionally <Created by zyga> <https://github.com/snapcore/snapd/pull/9204>06:45
zyga^ this is not yet ready for review06:46
zygaI want to see how it affects our tests06:46
zygaI'll go do some reviews06:57
zygaand then break to handle lucy being awake06:57
zygaand should then return for 1:1 and remaining work06:57
mupPR snapd#7825 closed: many: use transient scope for tracking apps and hooks <Security-High> <Squash-merge> <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/7825>07:00
pstolowskimorning07:03
zygagood morning Pawel07:03
mvogood morning pstolowski07:41
pstolowskio/07:42
mvojust fyi (all) 8982 needs reviews, samuele is happy with it on a high level but did not do a full review (not urgent though)07:48
pstolowskiack08:12
pstolowskimborzecki: hey, i've updated selinux profile in #9084, can you take a look (last commit)?08:36
mupPR #9084: o/snapstate: check disk space before creating automatic snapshot on remove (3/N) <Disk space awareness> <Created by stolowski> <https://github.com/snapcore/snapd/pull/9084>08:36
zygaIn the office08:53
zygamborzecki hey09:08
zygamborzecki I've proposed a draft that attempts systemd-based app tracking by default09:08
zygaand I got a few denials for selinux09:08
zyga1) type=AVC msg=audit(08/24/20 07:27:34.527:12644) : avc:  denied  { getattr } for  pid=78926 comm=snap path=/run/user/0/bus dev="tmpfs" ino=22956 scontext=system_u:system_r:snappy_cli_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=109:08
zyga2) type=AVC msg=audit(08/24/20 07:27:34.528:12645) : avc:  denied  { write } for  pid=78926 comm=snap name=bus dev="tmpfs" ino=22956 scontext=system_u:system_r:snappy_cli_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=109:09
zyga3) type=AVC msg=audit(08/24/20 07:27:34.529:12646) : avc:  denied  { connectto } for  pid=78926 comm=snap path=/run/user/0/bus scontext=system_u:system_r:snappy_cli_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=109:09
zygaI would appreciate some ideas on how to tackle that09:09
zygathose are from fedora 3209:10
zygamborzecki I've added a comment on https://github.com/snapcore/snapd/pull/9204 with the same information09:12
mupPR #9204: sandbox: track applications unconditionally <Created by zyga> <https://github.com/snapcore/snapd/pull/9204>09:12
mborzeckire09:23
pedronismborzecki: hi, I did a pass on #920109:27
mupPR #9201: [RFC] boot: observe update & rollback of trusted assets <UC20> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/9201>09:27
mborzeckipedronis: thanks, would have some time for a chat later?09:31
pedronismborzecki: before the standup09:31
mborzeckipedronis: sounds good09:31
mborzeckilet me add something09:31
mborzeckizyga: looks like this should be covered by dbus chat interfaces09:35
mborzeckizyga: let me see if there's something for chattign with systemd specifically09:35
zygathank you!09:35
mborzeckizyga: there's a bunch of systemd_dbus_chat in refpolicy but those seem to cover logind, timedated, machined, resolved09:40
zygado we need a new interface or is there a better way out?09:40
mborzeckizyga: hm but it's user_tmp_t, can you try adding userdom_write_user_tmp_sockets(snappy_cli_t) to the policy, reload and see what happens?09:43
zygamborzecki sure, I'll try09:45
pstolowskimborzecki: heh, my selinux fix worked everywhere except for centos 8. although there i see "type=AVC msg=audit(1598261418.464:4691): avc:  denied  { getattr } for  pid=133098 comm="snapd" path="/var/snap/lxd/common/ns/shmounts"09:49
mborzeckipstolowski: why is snapd looking there?09:50
zygamborzecki: probably because "du"09:50
zygato estimate size of the data09:50
pstolowskiyes exactly09:50
zygain a way we need one-file-system that really means ignore-magic-filesystems09:50
mborzeckipstolowski: zyga: there's --one-file-system switch to du09:53
zygabut we don't really want that09:53
zygawe want to allow people to have other file systems mounted on /var/snap/blargh09:53
zygawhat we want is to filter out nsfs09:53
zygaor procfs09:54
mborzeckizyga: should those other filesystems count towards snapshot size?09:54
pstolowskithat's interesting. i wonder what happens when we do actual snapshot09:54
zygait probably archives an empty file09:55
zygait's a permissive profile09:55
zygait's a bind mount of /proc/PID/ns/mnt to an empty file09:56
zygaso the archiver will just see the empty file09:56
pstolowskiyeah but what about the rest of proc\10:03
zygapstolowski is all of proc mounted in SNAP_DATA?10:03
pstolowskizyga: i don't know, re-running to see what happens (it's a lxd snap_10:03
pstolowski)10:03
zygapstolowski I think you will only find nsfs10:03
zygathe rest of the filesystems are mounted inside that thing10:04
zygait's like a chest for more mounts10:04
zygamborzecki I have one deny left10:07
zygamborzecki I have one deny left10:07
zygatype=AVC msg=audit(08/24/20 10:05:41.032:928) : avc:  denied  { connectto } for  pid=29450 comm=snap path=/run/user/0/bus scontext=system_u:system_r:snappy_cli_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=110:08
zygabrb10:09
mborzeckizyga: ok, so you probably need unconfined_dbus_chat(snappy_cli_t) now10:09
ijohnsonmorning folks10:09
zygahey ijohnson :)10:09
zygamborzecki trying10:09
mvogood morning ijohnson10:09
ijohnsono/10:09
ijohnsonmmm have we not had a new snapd edge since 8-22 ?10:09
mborzeckizyga: and maybe unconfined_dbus_connect(snappy_clit_t) too10:09
mborzeckiijohnson: hey10:09
ijohnsonor 22-8 for y'all europeans :-)10:10
pstolowskihi ijohnson !10:10
ijohnsonhey pstolowski10:10
zygaijohnson looking10:10
zygayeah10:10
zygait seems so10:10
ijohnsonsmells odd10:11
zygaijohnson snapd had a long weekend? :D10:11
ijohnsonhaha maybe10:11
zygaeither stuck in moderation or the publish pipeline got blocked somewhere10:11
mvoijohnson: probably no changes in edge since 22 ?10:15
ijohnsonmvo: ah actually you're right there were a couple commits this morning but nothing over the weekend10:16
ijohnsonI'm just so used to seeing the snapd snap update every day10:16
zygare10:22
zygaha, does it mean we had a long weekend instead?10:24
zygaas in two days without patches10:24
zygaijohnson https://listed.zygoon.pl/17659/introduction-to-bashunit-unit-testing-for-bash-scripts :)10:25
ijohnsondo we hijack the post-refresh hook for the core* snaps as well as the configure hook ?10:39
ijohnsonzyga: very cool stuff! that's really nice to see it all come together like that, one thing I wonder though is that in the failure output you have for bashunit you don't see what the actual output of `hello_world` function is before the grep fails, so it's a bit difficult to debug10:42
ijohnsonzyga: that's probably intristic to using bash however so probably not worth looking into, but I wonder if it would be helpful to have some kind of test util command you can use in the unit test file that saves the output inside pipes only to be displayed on test failure10:43
ijohnsonzyga: something like `hello_world | echo_on_fail | grep -qFx 'Hello world'`10:43
ijohnsonjust a thought10:43
ijohnsonI've wanted something like that _so_ many times when looking at spread failures10:44
* zyga-x240 switches devices10:48
zyga-x240mvo: 2.46 branches are red, do you want to merge master or cherry pick all the fixes back>10:51
mvozyga-x240: will merge master to it today10:51
zyga-x240ok10:52
zyga-x240do 2.46 jamie branches make sense to review then?10:52
mvozyga-x240: no, please not10:56
mvozyga-x240: in a meeting now10:56
zyga-x240ok10:56
mvozyga-x240: we can close them10:56
zyga-x240mvo: ack, doing that now11:16
mvota11:16
mupPR # closed: snapd#9192, snapd#9193, snapd#9194, snapd#919511:21
ijohnsonreal simple uc20 PR: https://github.com/snapcore/snapd/pull/920511:25
mupPR #9205: boot/initramfs_test.go: reset boot vars on the bootloader for each iteration <Simple 😃> <Test Robustness> <UC20> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/9205>11:25
mupPR snapd#9205 opened: boot/initramfs_test.go: reset boot vars on the bootloader for each iteration <Simple 😃> <Test Robustness> <UC20> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/9205>11:26
zyga-x240is shell surprising? https://paste.ubuntu.com/p/FGYyvVXmm8/11:26
zyga-x240our || true pattern is dangerous11:28
ijohnsonwow just wow11:28
ijohnsonhow can such fundamental things in bash be so broken11:28
zyga-x240ijohnson: it's documented :)11:28
zyga-x240it's a feature11:28
zyga-x240just ill-designed IMO11:28
zyga-x240I think we can do something like "not"11:28
ijohnsondidn't we have a NOT in spread ?11:29
zyga-x240we have "not" in snapd11:29
zyga-x240it's really exactly the same feature in bash that requires it11:29
diddledanyes. it's surprising :-) (not what I expect with `set -e`)11:30
zyga-x240diddledan: it's just another case of https://listed.zygoon.pl/17629/broken-composition-or-the-tale-of-bash-and-set-e11:30
diddledanI guess you need to add set -e inside the function?11:30
zyga-x240diddledan: but just seeing the code behave this way is shocking11:31
zyga-x240diddledan: no :)11:31
zyga-x240diddledan: try that11:31
zyga-x240it's ignored11:31
diddledangah11:31
zyga-x240the link I referenced explains why11:31
* diddledan reads it11:31
* zyga-x240 reviews nested.sh11:31
diddledanit's the same with /bin/sh (which in Ubuntu 20.04 is dash, right?)11:32
zyga-x240yes11:32
zyga-x240it's a very old feature11:32
diddledanthe `do-something && do-something-on-success || do-something-on-fail` is a common pattern that I've seen all over the interweb11:33
zyga-x240diddledan: it all depends on what those are11:35
zyga-x240diddledan: also, remove the echo that says "surprising" and it's well, also documented but more surprising11:35
diddledangosh, there's a lot of strange interactions you've highlighted11:37
zyga-x240mvo: shellcheck issue (reported in early 2019) https://github.com/koalaman/shellcheck/issues/148411:42
zyga-x240cachio: how much work would it take to make nested.sh a non-sourced script?11:44
ijohnsonmorning cachio11:44
cachiozyga-x240, hi, I already did something like that a time ago11:45
cachioijohnson, hi11:45
zyga-x240cachio: oh? where?11:45
cachiogood morning11:45
cachiozyga-x240, I closed that a time ago11:45
zyga-x240why?11:45
cachioI need to open it again11:45
cachiobecause there were too many changes11:46
zyga-x240I'm reading https://github.com/snapcore/snapd/pull/9098 and I'm very worried about bugs11:46
mupPR #9098: tests: new organization for nested tests <Run nested> <Created by sergiocazzolato> <https://github.com/snapcore/snapd/pull/9098>11:46
zyga-x240well, we can start small11:46
cachioIand I decided to create a new change to address that11:46
zyga-x240but I think we must go that way11:46
cachioI could make it again11:47
zyga-x240please start small11:47
cachioit could be a tool11:47
zyga-x240prepare/restore + execute11:47
zyga-x240yeah, I think sourcing is a no-go11:47
zyga-x240port a single test (keep nested.sh as-is)11:48
zyga-x240over time it will replace the other11:48
cachiozyga-x240, ok, makes sense11:49
zyga-x240cachio: why is execute remote using "$*"?11:49
zyga-x240https://github.com/snapcore/snapd/pull/9098/files#diff-3af5dfa44ec70d885e9485dbb117f52fR84411:49
mupPR #9098: tests: new organization for nested tests <Run nested> <Created by sergiocazzolato> <https://github.com/snapcore/snapd/pull/9098>11:49
cachiozyga-x240, it is very old11:51
cachiozyga-x240, I think federico created that11:51
zyga-x240I think that's wrong11:51
cachioand nobody updated that11:51
zyga-x240and I suspect it's broken with regards to quoting11:51
zyga-x240cachio: I did a quick pass over https://github.com/snapcore/snapd/pull/9098#pullrequestreview-47337413311:52
mupPR #9098: tests: new organization for nested tests <Run nested> <Created by sergiocazzolato> <https://github.com/snapcore/snapd/pull/9098>11:52
cachiozyga-x240, nice, thanks11:52
cachioI'll take a look11:52
zyga-x240cachio: let me know if anything I said there is unreasonable please11:53
zyga-x240cachio: please look through all the functions, they should not create new globals unless that's exactly desired11:54
zyga-x240e.g. start_nested_classic_vm defines a dozen or so new globals11:54
cachiozyga-x240, ok, np, I'll update that11:55
zyga-x240cachio: wait_for_ssh defines retry as a global11:55
zyga-x240please go through the entire file11:55
cachiozyga-x240, ok, I'ldd11:56
cachioI'll do11:56
zyga-x240thanks,11:57
zyga-x240the more we learn about shell the more we need to be careful11:57
cachiozyga-x240, yes hehehe11:58
pstolowskimborzecki: pondering what to do about that second denial on centos8 only; is "allow snappy_t unconfined_service_t:file getattr;" too terrible?12:25
mborzeckipstolowski: wouldn't that only mask the issue?12:25
pstolowskimborzecki: fwtw these files appear empty, and are included in actual snapshot12:27
zyga-x240pstolowski: they are empty12:30
zyga-x240pstolowski: they are mount points to contain nsfs objects12:31
mupPR snapcraft#3260 opened: tools: update setuptools in environment-setup <Created by cjp256> <https://github.com/snapcore/snapcraft/pull/3260>12:32
* zyga-x240 -> lunch12:34
mupPR snapd#9160 closed: boot, o/devicestate: observe existing recovery bootloader trusted boot assets <UC20> <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/9160>12:46
pstolowskidegville: hi, welcome back! it seems you made a nice shot of milky way but unfortunately for some reason i see very pixelated/blurry pictures, something wrong with google photos here i suspect12:50
ijohnsonzyga-x240: what's your take on passing function names to a bash function? I want to inject any function to be called during the execution of another function, but only sometimes, something like passing a func() as a param in Go12:52
ijohnsonzyga-x240: does my idea seem terrible given your current experiences ?12:52
ijohnsonI could just add all the functions I need inside the main function and just use a silly named option/switch to the function when I call it12:53
zyga-x240ijohnson: re12:55
zyga-x240ijohnson: let me read backlog12:55
ijohnsonzyga-x240: sure no rush12:55
zyga-x240ijohnson: no, not really12:55
zyga-x240ijohnson: there's even a way to do "pointers" in bash if you need to12:55
zyga-x240ijohnson: the more important detail is exactly how is the function called12:56
zyga-x240ijohnson: I think that disabling set -e, calling the function, recording $? and re-enabling set -e is probably correct, to the best of my understanding12:56
zyga-x240ijohnson: some simpler functions are also correct in more generic cases, those that involve a single command12:56
ijohnsonzyga-x240: the function I need to call is very simple, but it needs to be called at a very specific point in time12:57
zyga-x240ijohnson: I'm happy to review and suggest improvements12:58
ijohnsonbut actually I think I can get away with just a single implementation, thinking about it I don't know that I need multiple different functions to be called so I think I'll just use a special optional argument to the original function I need to call12:58
degvillepstolowski: thanks for letting me know (and the welcome back!) - I'll check, but it's pretty low quality anyway as it was just a long exposure shot taken with my phone. I do have a RAW version, so I may try and play with it in Darktable.13:15
mupPR snapcraft#3261 opened: requirements: pin setuptools devel requirement <Created by cjp256> <https://github.com/snapcore/snapcraft/pull/3261>13:23
mborzeckizyga-x240: there's no way to set the 'script' interpreter in spread, or is there?13:29
zyga-x240mborzecki: no and in addition, spread joins many separate task together13:29
zyga-x240IIRC13:29
ijohnsonlet's all switch to julia instead of bash13:32
ijohnsonalternative to julia would be the good ol lisp13:32
zyga-x240ijohnson: I think js is the most realistic alternative13:34
* ijohnson really doesn't wanna write js tho13:34
zyga-x240it's not great but has arguably the best tooling13:34
ijohnsonI see your clojures in js and raise you an offer of erlang13:34
zyga-x240I think it's not something we should pick in a rush13:35
zyga-x240maybe figuring out how to transition to anything is more relevant13:35
zyga-x240then we can consider alternatives13:35
cachiozyga-x240, I see this error https://github.com/snapcore/snapd/runs/1021534236#step:5:174413:37
cachiotodya the image has been updated13:38
cachiodid you already see that?13:38
zygacachio strange, is that image changing from efi to legacy boot?13:40
cachiono13:42
cachiozyga, it shouldn't13:42
cachioI am trying to reproduce13:42
zygaok13:44
mupPR snapd#9206 opened: boot: complain about reused asset name during initial install <UC20> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/9206>14:11
zygasnap wait --help panics14:31
zygapstolowski snap save on f32 says "broken: invalid snapshot"14:32
zygahttps://pastebin.ubuntu.com/p/cxHqJ9MZQn/14:33
mborzeckizyga: backtrace goes to go-flags14:34
zygamaybe go-flags is old14:34
mborzeckizyga: maybe a particular version is broken14:35
zygathe beauty of maintaining packages14:35
pstolowskizyga: ? is this my PR?14:36
zyganope14:36
zygamborzecki it creshes on14:36
zyga                                        descPadding := strings.Repeat(" ", descStart-len(argPrefix))14:36
zygaafk14:36
zygadog needs to go out14:37
pstolowskiwe run snapshot-basic spread test everywhere, are you sure it's not some local issue on your f32?14:41
pedronispstolowski: I did a pass on #919914:48
mupPR #9199: snapstate: installSizeInfo helper that calculates total size of snaps and their prerequisites <Disk space awareness> <Needs Samuele review> <Created by stolowski> <https://github.com/snapcore/snapd/pull/9199>14:48
pstolowskipedronis: just saw it, thanks14:49
pstolowskimborzecki: does the selinux workaround in #9084 look fine to you? it passed now (except for unrelated test failure on centos8 and suse)14:51
mupPR #9084: o/snapstate: check disk space before creating automatic snapshot on remove (3/N) <Disk space awareness> <Created by stolowski> <https://github.com/snapcore/snapd/pull/9084>14:51
mborzeckipstolowski: yeah, i don't think we have any other options at this point14:55
pstolowskimborzecki: ok thanks, i'll land this14:56
mupPR snapd#9084 closed: o/snapstate: check disk space before creating automatic snapshot on remove (3/N) <Disk space awareness> <Created by stolowski> <Merged by stolowski> <https://github.com/snapcore/snapd/pull/9084>15:01
mborzeckipstolowski: still, it'd be nice to maybe ask the lxd team what that ns/shmounts contains, my rough guess it's some bit of /proc/self/ns/.. of the lxd process, hence the unconfined_t label (and nsfs fstype)15:03
=== davdunc_ is now known as davdunc
=== bluesabre_ is now known as bluesabre
pstolowskipedronis: interesting, so the idea is to essentially exclude snaps that could have been installed in the meantime when computing total?15:07
* cachio lunch15:07
=== mborzeck1 is now known as mborzecki
pedronispstolowski: yes, as I said, it doesn't cover all cases, but it get us closer to the kind of code that we would need for that15:23
pstolowskipedronis: right, got it, thanks15:26
* zyga-x240 goes for PT15:34
mvopstolowski: I updated 898215:38
mvopstolowski: thanks for your review, the misgging BadRequest test highlighted a bad error message15:38
pstolowskimvo: yes, i looked briefly, thanks for the changes15:38
pstolowski👍15:39
pstolowski+115:53
mvoyay now 8982 just needs a second review16:15
mupPR snapd#9207 opened: boot/bootstate20: reboot to rollback to previous kernel <Bug> <UC20> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/9207>16:17
zyga-x240re18:01
zyga-x240today's exercise was *intense*18:02
zyga-x240I'm genuinely tired18:02
* zyga-x240 needs water18:02
* zyga-x240 is rehydrated 18:18
zyga-x240let's write some ocd18:18
zyga-x240*code18:18
* zyga-x240 goes upstairs18:32
mupPR core20#82 opened: [RFC] hooks: mv docker user/group definition to extrausers <Created by anonymouse64> <https://github.com/snapcore/core20/pull/82>18:53
mupPR snapd#9208 opened: tests/nested/core20/kernel-failover: add test for failed refresh of uc20 kernel <Run nested> <Test Robustness> <UC20> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/9208>19:22
* ijohnson EODs19:25

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!