Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 358211 - Portage 2.1.9.42 traceback: os.kill, OSError: [Errno 1] Operation not permitted (hardened kernel)
Summary: Portage 2.1.9.42 traceback: os.kill, OSError: [Errno 1] Operation not permitt...
Status: RESOLVED FIXED
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Core (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 484436
  Show dependency tree
 
Reported: 2011-03-10 12:57 UTC by Paweł Hajdan, Jr. (RETIRED)
Modified: 2013-09-10 00:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-03-10 12:57:55 UTC
At the end of emerge -uDNa world, after - or in the middle of the merged packages messages I got a traceback:

 * Messages for package net-print/cups-1.4.6:

 * For information about installing a printer and general cups setup
 * take a look at: http://www.gentoo.org/doc/en/printing-howto.xml
Traceback (most recent call last):
  File "/usr/lib/portage/bin/emerge", line 43, in <module>
    retval = emerge_main()
  File "/usr/lib/portage/pym/_emerge/main.py", line 1732, in emerge_main
    myopts, myaction, myfiles, spinner)
  File "/usr/lib/portage/pym/_emerge/actions.py", line 439, in action_build
    retval = mergetask.merge()
  File "/usr/lib/portage/pym/_emerge/Scheduler.py", line 1184, in merge
    rval = self._merge()
  File "/usr/lib/portage/pym/_emerge/Scheduler.py", line 1522, in _merge
    self._main_loop()
  File "/usr/lib/portage/pym/_emerge/Scheduler.py", line 1665, in _main_loop
    self._poll_loop()
  File "/usr/lib/portage/pym/_emerge/PollScheduler.py", line 165, in _poll_loop
    f, event = self._next_poll_event()
  File "/usr/lib/portage/pym/_emerge/PollScheduler.py", line 151, in _next_poll_event
    self._terminate_tasks()
  File "/usr/lib/portage/pym/_emerge/Scheduler.py", line 299, in _terminate_tasks
    q.clear()
  File "/usr/lib/portage/pym/_emerge/SequentialTaskQueue.py", line 79, in clear
    task.cancel()
  File "/usr/lib/portage/pym/_emerge/CompositeTask.py", line 17, in cancel
    self._current_task.cancel()
  File "/usr/lib/portage/pym/_emerge/CompositeTask.py", line 17, in cancel
    self._current_task.cancel()
  File "/usr/lib/portage/pym/_emerge/CompositeTask.py", line 17, in cancel
    self._current_task.cancel()
  File "/usr/lib/portage/pym/_emerge/TaskSequence.py", line 30, in cancel
    CompositeTask.cancel(self)
  File "/usr/lib/portage/pym/_emerge/CompositeTask.py", line 17, in cancel
    self._current_task.cancel()
  File "/usr/lib/portage/pym/_emerge/CompositeTask.py", line 17, in cancel
    self._current_task.cancel()
  File "/usr/lib/portage/pym/_emerge/SubProcess.py", line 55, in cancel
    self.wait()
  File "/usr/lib/portage/pym/_emerge/AsynchronousTask.py", line 40, in wait
    self._wait()
  File "/usr/lib/portage/pym/_emerge/SubProcess.py", line 73, in _wait
    os.kill(self.pid, signal.SIGKILL)
  File "/usr/lib/portage/pym/portage/__init__.py", line 226, in __call__
    rval = self._func(*wrapped_args, **wrapped_kwargs)
OSError: [Errno 1] Operation not permitted

I was running emerge on a remote system (ssh) in a screen session. At one point I lost network access, and attached again later. I'm not sure if that's related.

Portage 2.1.9.42 (default/linux/x86/10.0, gcc-4.5.2, glibc-2.13-r1, 2.6.25-hardened-r13 x86_64)
=================================================================
System uname: Linux-2.6.25-hardened-r13-x86_64-Dual_Core_AMD_Opteron-tm-_Processor_280-with-gentoo-2.0.1
Timestamp of tree: Thu, 10 Mar 2011 12:00:01 +0000
app-shells/bash:     4.2_p7
dev-lang/python:     2.7.1-r1, 3.1.3-r1
dev-util/cmake:      2.8.4
sys-apps/baselayout: 2.0.1-r1
sys-apps/openrc:     0.7.0
sys-apps/sandbox:    2.5
sys-devel/autoconf:  2.68
sys-devel/automake:  1.11.1
sys-devel/binutils:  2.21
sys-devel/gcc:       4.5.2
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.4-r1
sys-devel/make:      3.82
virtual/os-headers:  2.6.36.1 (sys-kernel/linux-headers)
ACCEPT_KEYWORDS="x86 ~x86"
ACCEPT_LICENSE="* -@EULA"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -march=i686 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distlocks fixlafiles fixpackages news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl berkdb bzip2 cli cracklib crypt cups cxx dri fortran gdbm gpm iconv icu ipv6 modules mudflap ncurses nls nptl nptlonly openmp pam pcre perl pppd python readline session ssl subversion sysfs tcpd threads unicode x86 xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="dummy" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

# qlop -l | tail
Thu Mar 10 10:45:55 2011 >>> dev-python/pysvn-1.7.5
Thu Mar 10 10:46:09 2011 >>> x11-apps/xset-1.2.1-r1
Thu Mar 10 10:46:47 2011 >>> app-text/poppler-0.16.3
Thu Mar 10 10:47:14 2011 >>> x11-libs/libXaw-1.0.9
Thu Mar 10 10:48:15 2011 >>> net-misc/openssh-5.8_p1-r1
Thu Mar 10 10:48:23 2011 >>> x11-misc/xdg-utils-1.1.0_rc1-r1
Thu Mar 10 10:48:33 2011 >>> dev-util/chromium-tools-0.1.7
Thu Mar 10 10:49:27 2011 >>> sys-apps/groff-1.21
Thu Mar 10 10:50:48 2011 >>> net-print/cups-1.4.6
Thu Mar 10 10:59:45 2011 >>> app-text/ghostscript-gpl-9.01

I think the emerge didn't finish correctly. When running emerge -uDNa world in the console I'm still getting packages to be updated that were in the original list:

# emerge -uDNa world

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild     U ] www-client/chromium-11.0.686.3 [10.0.648.11]
[ebuild     U ] app-editors/vim-core-7.3.102 [7.3.75]
[ebuild     U ] app-editors/vim-7.3.102 [7.3.75]

The emerge was running as root, but this was on a hardened machine (miranda.amd64.dev.gentoo.org) inside a chroot (/chroots/chromium-x86-experimental).

Please let me know if you'd like to get some more info.
Comment 1 Zac Medico gentoo-dev 2011-03-10 15:18:39 UTC
It seems that somebody sent either SIGINT or SIGTERM to that emerge process, since that's the only way to trigger line 151 of PollScheduler.py. It's really strange that kill() raised EPERM, since emerge should always have permission to send a kill signal to its subprocesses.
Comment 2 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-03-10 15:30:50 UTC
(In reply to comment #1)
> It seems that somebody sent either SIGINT or SIGTERM to that emerge process,
> since that's the only way to trigger line 151 of PollScheduler.py. It's really
> strange that kill() raised EPERM, since emerge should always have permission to
> send a kill signal to its subprocesses.

Right, I think I sent a few Ctrl-C's (bad idea) to the "hung" screen. Anyway, I guess the traceback is still unexpected.
Comment 3 Zac Medico gentoo-dev 2011-03-10 16:20:32 UTC
I'm not sure if this traceback is reproducible. I guess we can just wait and see if anyone else experiences it. It's mainly a cosmetic issue, since it can only happen after emerge has been interrupted by SIGINT or SIGTERM. Previous versions of portage simply exited immediately, but recent versions of portage-2.1.9.x try to do some minimal cleanup before exiting.
Comment 4 Zac Medico gentoo-dev 2013-06-04 21:31:55 UTC
That kill "Operation not permitted" error could be triggered by grsec combined with dropped privileges from the default FEATURES=userfetch setting. I recall somebody else having a similar issue with userpriv recently, and their dmesg output showed a complaint from grsec.
Comment 5 Rick Farina (Zero_Chaos) gentoo-dev 2013-09-08 18:41:54 UTC
(In reply to Zac Medico from comment #4)
> That kill "Operation not permitted" error could be triggered by grsec
> combined with dropped privileges from the default FEATURES=userfetch
> setting. I recall somebody else having a similar issue with userpriv
> recently, and their dmesg output showed a complaint from grsec.

I'm on hardened, running userfetch, userpriv, usersync, usersandbox and I can reproduce this trivially (happens to me all the time but at random intervals).

If anyone has ideas, I'll be happy to test whatever you like with ~1 day testing.  Most days this happens to my build system 5-10 times.
Comment 6 Zac Medico gentoo-dev 2013-09-09 16:20:34 UTC
Kill normally does not thow an EPERM error like this, so it seems like a possible bug in the hardened kernel.
Comment 8 Zac Medico gentoo-dev 2013-09-10 00:42:35 UTC
This is fixed in 2.2.2.