[06:47] morning [06:59] mborzecki: hi! I think I need your help :-) [06:59] mardy: hey, what's up? [06:59] I have made these changes to snap-confine: https://github.com/snapcore/snapd/pull/11367 [06:59] PR #11367: snap-confine: ground work for homedirs support <⛔ Blocked> [07:00] many tests already work, some others don't [07:00] I see this error message: cannot update snap namespace: cannot recover from trespassing over / [07:01] I added some more debug now, and here's what I see: https://paste.ubuntu.com/p/DVSvY8NG5s/ [07:01] (this is when running google:ubuntu-20.04-64:tests/main/docker-smoke) [07:02] mardy: hm this must be from snap-update-ns [07:03] mborzecki: yes, and the problem is that I don't know what it does, and whether it's trying to do the right thing [07:03] hahaha, let me look at the code, maybe i can remember [07:04] like, should /etc/docker be restricted? [07:04] mardy: iirc the problem was that without those checks we could have modified directories on the host by accident [07:04] eg. /etc/ which is mounted from the host and isn't ro [07:06] mborzecki: ok, then it looks like that /etc/docker should be restricted indeed [07:07] but then why is the test failing? [07:08] I guess I can try to run this test on the master branch, with some extra debugging, and compare the logs [07:08] mardy: is there a specific layout that docker snap.yaml has? [07:08] * mardy checks [07:10] mborzecki: yes, there's a bind on /etc/docker: https://github.com/docker-snap/docker-snap/blob/main/snap/snapcraft.yaml#L38-L46 [07:10] could it be that my changes on snap-confine broke something and made the bind impossible to setup? Would that explain the error I'm seeing? [07:11] mardy: hm maybe, in theory snap-update-ns should either create tmpfs on /etc within the snap ns, then bind mount everything there, or if /etc/docker exists in /etc/already it would use that [07:11] is it happy if you create /etc/docker on the host? [07:14] mardy: it's clearly creating a writable mock on /etc; https://pastebin.ubuntu.com/p/rjnK94bJYy/ [07:15] mborzecki: yes, it's happy, then. It still fails, but on another file (/etc/gitconfig): https://paste.ubuntu.com/p/qrjGx2rjwF/ [07:15] mardy: maybe it's confused as there's tmpfs on / no too [07:15] s/no/now/ [07:17] mborzecki: ah, thanks, your logs give me some hints: "change.go:124: DEBUG: need to create writable mimic needed to create path "/etc/docker" (original error: cannot write to "/etc/docker" because it would affect the host in "/etc")" [07:18] mborzecki: so, it expects an error like "cannot write to "/etc/docker" because it would affect the host in "/etc"", whereas with my changes it gets another error [07:18] mardy: yeah, that's what should happen, but i wonder why it doesn't, looking at the code [07:18] aa [07:18] ok [07:18] that explains it then [07:19] mborzecki: thanks a lot, you made my day :-) [07:21] mardy: hm actually the logs sugges that it returns TrespassingError [07:26] mborzecki: yes, trespassing error is returned in https://github.com/snapcore/snapd/blob/master/cmd/snap-update-ns/trespassing.go#L229, whereas with my changes it returns on line 222. [07:28] mardy: ah ok, so it already called createPath() which then calls itself again and fails with the error from 222 [07:35] mborzecki: thanks, then I'll add some debugging in there [08:03] morning [08:06] pstolowski: hey [08:12] PR snapd#11362 closed: libsnap-confine-private: string functions simplification [08:48] hi pstolowski, mvo [08:48] good morning mardy pstolowski [09:04] mardy: can you take a look at https://github.com/snapcore/snapd/pull/11372 ? [09:04] PR #11372: interfaces/systemd: use batch systemd operations [09:36] mborzecki: I see that the AppArmor profile for snap-confine has "/run/snapd/ns/snap.*.fstab w,", but I don't see where snap-confine is writing that file [10:42] PR snapd#11375 opened: interfaces: add private /dev/shm support to shared-memory interface [11:07] PR snapd#11376 opened: tests: skip ~/.snap migration test on openSUSE [11:14] mvo: can you merge https://github.com/snapcore/snapd/pull/11337 please? failures are unrelated [11:14] PR #11337: many: fix leftover empty snap dirs [11:15] mborzecki: I noticed a build failure on arch, is it something that you are already aware of? https://github.com/snapcore/snapd/runs/5154941656?check_suite_focus=true [11:17] mardy: yes, there's some inconsistency at the mirrors i think [11:19] mardy: https://bugs.archlinux.org/task/73737 the joys of arch being a niche distro [11:20] so even worse, than what i suspected [11:25] miguelpires: sure [11:25] thank you [11:27] PR snapd#11337 closed: many: fix leftover empty snap dirs [12:18] zaga I have a question regarding the "\040(deleted)" issue that you've filed and discussed here upon my first visit of the channel. [12:19] zyga sorry for the typo. [12:19] zyga I have a question regarding the "\040(deleted)" issue that you've filed and discussed here upon my first visit of the channel. [12:27] zyga when I reproduced the failure instead of getting suffix "\40(deleted)" or " (deleted)", I've got "//deleted" [12:27] PR snapd#11377 opened: asserts: add preseed assertion type [12:29] PR snapcraft#3636 closed: parts: integrate craft-parts (CRAFT-765) [12:32] Interesting [12:32] I'm not following the kernel mount subsystem [12:33] I would go and check the patches on that part of the kernel [12:33] Perhaps there is a new unified syntaxe for this? [12:33] Do you know where to look? [13:01] zyga No, unfortunately no. [13:48] PR snapd#11379 opened: tests: smoke test support for core22 [14:18] PR snapd#11338 closed: asserts,cmd/snap-repair: support delegation when validating signatures [14:28] PR snapd#11380 opened: asserts: first-class support for formatting/encoding signatory-id [14:33] PR snapd#11381 opened: asserts: fetching code should fetch authority-delegation assertions with signing keys as needed [14:54] PR snapcraft#3637 opened: meta: generate basic snap.yaml (CRAFT-801) [15:28] PR snapd#11382 opened: asserts: remove unused function, fix for linter <⚠ Critical> [16:43] PR snapd#11383 opened: o/snapstate: migrate on core22 refresh and init ~/Snap [17:34] PR snapd#11354 closed: gadget: identify/match encryption parts, include in traits info [17:39] PR snapd#11384 opened: gadget: refactor StructureEncryption to have a concrete type instead of map [18:14] PR snapcraft#3637 closed: meta: generate basic snap.yaml (CRAFT-801) [18:29] PR snapcraft#3638 opened: Colcon v2: forward cmake args [18:35] arsenique: I'll show you next week, ok [21:30] PR snapcraft#3639 opened: commands: add pack command and set it as default (CRAFT-762)