Created attachment 562202 [details] build.log == Tests result: FAILURE == 381 tests OK. 1 test failed: test_resource 24 tests skipped: test_curses test_devpoll test_idle test_kqueue test_msilib test_nis test_ossaudiodev test_smtpnet test_socketserver test_startfile test_tcl test_timeout test_tix test_tk test_ttk_guionly test_ttk_textonly test_turtle test_urllib2net test_urllibnet test_winconsoleio test_winreg test_winsound test_xmlrpc_net test_zipfile64 Re-running failed tests in verbose mode Re-running test 'test_resource' in verbose mode test_args (test.test_resource.ResourceTest) ... ok test_freebsd_contants (test.test_resource.ResourceTest) ... ok test_fsize_enforced (test.test_resource.ResourceTest) ... ok test_fsize_ismax (test.test_resource.ResourceTest) ... ok test_fsize_toobig (test.test_resource.ResourceTest) ... ok test_getrusage (test.test_resource.ResourceTest) ... ok test_linux_constants (test.test_resource.ResourceTest) ... ok test_pagesize (test.test_resource.ResourceTest) ... ok test_prlimit (test.test_resource.ResourceTest) ... FAIL test_prlimit_refcount (test.test_resource.ResourceTest) ... ok test_setrusage_refcount (test.test_resource.ResourceTest) ... ok ====================================================================== FAIL: test_prlimit (test.test_resource.ResourceTest) ---------------------------------------------------------------------- Traceback (most recent call last): File "/var/tmp/portage/dev-lang/python-3.6.6/work/Python-3.6.6/Lib/test/support/__init__.py", line 572, in wrapper return func(*args, **kw) File "/var/tmp/portage/dev-lang/python-3.6.6/work/Python-3.6.6/Lib/test/test_resource.py", line 153, in test_prlimit 1, resource.RLIMIT_AS) AssertionError: PermissionError not raised by prlimit ---------------------------------------------------------------------- Ran 11 tests in 0.072s FAILED (failures=1) test test_resource failed 1 test failed again: test_resource == Tests result: FAILURE then FAILURE == 381 tests OK. 1 test failed: test_resource 24 tests skipped: test_curses test_devpoll test_idle test_kqueue test_msilib test_nis test_ossaudiodev test_smtpnet test_socketserver test_startfile test_tcl test_timeout test_tix test_tk test_ttk_guionly test_ttk_textonly test_turtle test_urllib2net test_urllibnet test_winconsoleio test_winreg test_winsound test_xmlrpc_net test_zipfile64 1 re-run test: test_resource Total duration: 2 min 22 sec Tests result: FAILURE then FAILURE make: *** [Makefile:1047: test] Error 2 This happens for the necessary rebuild of python after upgrading sys-libs/readline to version 8.0. The test passed when python was updated some time ago and fails only now for the rebuild. # emerge -pqv '=dev-lang/python-3.6.6::gentoo' [ebuild R ] dev-lang/python-3.6.6 USE="gdbm hardened ipv6 ncurses readline sqlite ssl test (threads) xml -bluetooth -build -examples -libressl -tk -wininst" # emerge --info '=dev-lang/python-3.6.6::gentoo' Portage 2.3.56 (python 3.6.6-final-0, default/linux/amd64/17.0/no-multilib/hardened, gcc-8.2.0, glibc-2.28-r5, 4.20.3 x86_64) ================================================================= System Settings ================================================================= System uname: Linux-4.20.3-x86_64-Intel-R-_Core-TM-_i7-3720QM_CPU_@_2.60GHz-with-gentoo-2.6 KiB Mem: 16385216 total, 9077360 free KiB Swap: 17825788 total, 17825788 free Timestamp of repository gentoo: Sat, 19 Jan 2019 17:00:01 +0000 Head commit of repository gentoo: 3b61c1ec86c034a0afa5622818d9f73e5ce3954c sh bash 5.0 ld GNU ld (Gentoo 2.31.1 p5) 2.31.1 app-shells/bash: 5.0::gentoo dev-java/java-config: 2.2.0-r4::gentoo dev-lang/perl: 5.28.0::gentoo dev-lang/python: 2.7.15::gentoo, 3.6.6::gentoo dev-util/cmake: 3.13.3::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.6-r1::gentoo sys-apps/openrc: 0.40.3::gentoo sys-apps/sandbox: 2.15::gentoo sys-devel/autoconf: 2.13-r1::gentoo, 2.69-r4::gentoo sys-devel/automake: 1.16.1-r1::gentoo sys-devel/binutils: 2.31.1-r3::gentoo sys-devel/gcc: 7.3.0-r6::gentoo, 8.2.0-r6::gentoo sys-devel/gcc-config: 2.0::gentoo sys-devel/libtool: 2.4.6-r5::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 4.20::gentoo (virtual/os-headers) sys-libs/glibc: 2.28-r5::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-metamanifest: yes sync-rsync-verify-jobs: 1 sync-rsync-verify-max-age: 24 sync-rsync-extra-opts: local location: /var/lib/portage-local/local masters: gentoo priority: 0 testing location: /var/lib/portage-local/testing masters: gentoo priority: 1 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -mtune=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=native -mtune=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps=y" ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs cgroup collision-protect config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned sandbox sfperms strict test unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu" LINGUAS="" MAKEOPTS="-j8" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="X a52 acl acpi alsa amd64 avx bzip2 cairo caps cdda cddb cdparanoia crypt cups cxx dbus dri dts dvd fam ffmpeg fftw flac fontconfig gif gimp gmp gnutls gtk hardened iconv icu idn ipv6 jpeg lame lcms libnotify libtirpc lzma mad matroska mmap mmx mmxext mp3 mpeg ncurses networkmanager nptl ogg opengl openmp pam pcre pie png policykit ppds readline sasl sdl seccomp sse sse2 sse3 sse4 sse4_1 sse4_2 ssl ssp ssse3 startup-notification svg test theora threads tiff truetype udev unicode upower vaapi vorbis wayland x264 xattr xcb xinerama xml xtpax xv xvid zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx f16c mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-1" POSTGRES_TARGETS="postgres9_5 postgres10" PYTHON_SINGLE_TARGET="python3_6" PYTHON_TARGETS="python2_7 python3_6" RUBY_TARGETS="ruby24" USERLAND="GNU" VIDEO_CARDS="i965 intel nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS ================================================================= Package Settings ================================================================= dev-lang/python-3.6.6::gentoo was built with the following: USE="gdbm hardened ipv6 ncurses readline sqlite ssl test (threads) xml -bluetooth -build -examples -libressl -tk -wininst" CFLAGS="-march=native -mtune=native -O2 -pipe -fwrapv" CXXFLAGS="-march=native -mtune=native -O2 -pipe -fwrapv" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu -L." # emerge -pqv '=sys-libs/readline-8.0:0/8::gentoo' [ebuild R ] sys-libs/readline-8.0 USE="-static-libs -utils"
Does this problem occur with FEATURES="-ipc-sandbox"? Does this problem occur with FEATURES="-network-sandbox"? Does this problem occur with FEATURES="-pid-sandbox"?
So this is caused by FEATURES="pid-sandbox". Running full test suite of Python is unnecessary. Simpler ebuild to reproduce problem: EAPI="7" SLOT="0" KEYWORDS="*" S="${WORKDIR}" src_unpack() { python3.6 -m test.test_resource }
Correct, no failure with FEATURES="-pid-sandbox".
Since pid-sandbox changes the prlimit PermissionError behavior, I wonder if test_prlimit should handle this somehow.
Failing code in test: if os.geteuid() != 0: self.assertRaises(PermissionError, resource.prlimit, 1, resource.RLIMIT_AS) This assumes that changing of properties of process with PID 1 is not allowed if current process has UID != 0. With FEATURES="pid-sandbox -userpriv", this assumption succeeds. With FEATURES="pid-sandbox userpriv", this assumption fails because pid-ns-init is run with UID 250. I suggest to delay dropping of permissions to after spawning pid-ns-init.
Created attachment 562380 [details, diff] Patch
Could we change the pid-sandbox code to run PID 1 as root instead? See Lennart's advice: https://github.com/systemd/systemd/pull/11504#issuecomment-456009720
Oh, that's exactly what your patch does. Nice!
(In reply to Arfrever Frehtes Taifersar Arahesis from comment #6) > Created attachment 562380 [details, diff] [details, diff] > Patch Looks good.
Patch sent for more review: https://archives.gentoo.org/gentoo-portage-dev/message/0d180507dbc1f941605fd8809a14bcda https://github.com/gentoo/portage/pull/405
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=82e86efb503a23588b6b8e4351427cc3fca27de3 commit 82e86efb503a23588b6b8e4351427cc3fca27de3 Author: Arfrever Frehtes Taifersar Arahesis <Arfrever@Apache.Org> AuthorDate: 2019-01-21 16:14:03 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-23 04:47:29 +0000 pid-sandbox: run pid-ns-init as root (bug 675868) Drop permissions only for subprocess of pid-ns-init but not pid-ns-init itself. With FEATURES="pid-sandbox userpriv", pid-ns-init should be run with unchanged permissions (usually UID=0, GID=0). Bug: https://bugs.gentoo.org/675868 Signed-off-by: Arfrever Frehtes Taifersar Arahesis <Arfrever@Apache.Org> Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 49 ++++++++++++++++++++++++++++++------------------- lib/portage/process.py | 12 ++++++++++-- 2 files changed, 40 insertions(+), 21 deletions(-)
Created attachment 563004 [details] build.log with portage-2.3.58 Now with sys-apps/portage-2.3.58, there is a different issue with FEATURES="pid-sandbox": >>> Source compiled. >>> Test phase: dev-lang/python-3.6.6 /var/tmp/portage/dev-lang/python-3.6.6/temp/environment: line 3781: /dev/tty: No such device or address * The following tests have been skipped: * test_gdb.py * If you would like to run them, you may: * cd '/usr/lib64/python3.6/test' * and run the tests separately. * ERROR: dev-lang/python-3.6.6::gentoo failed (test phase): * emake test failed Running it with FEATURES="-pid-sandbox" makes the issue go away.
(In reply to tka from comment #12) > Created attachment 563004 [details] > build.log with portage-2.3.58 > > Now with sys-apps/portage-2.3.58, there is a different issue with > FEATURES="pid-sandbox": > > >>> Source compiled. > >>> Test phase: dev-lang/python-3.6.6 > /var/tmp/portage/dev-lang/python-3.6.6/temp/environment: line 3781: > /dev/tty: No such device or address > * The following tests have been skipped: > * test_gdb.py > * If you would like to run them, you may: > * cd '/usr/lib64/python3.6/test' > * and run the tests separately. > * ERROR: dev-lang/python-3.6.6::gentoo failed (test phase): > * emake test failed > > Running it with FEATURES="-pid-sandbox" makes the issue go away. This patch will fix it, assuming that it's possible to allocate a pty device to set as the controlling terminal: https://archives.gentoo.org/gentoo-portage-dev/message/c65c74ad30f8c1ef106b4ab9273c1280 https://github.com/gentoo/portage/pull/406
(In reply to Zac Medico from comment #13) > This patch will fix it, assuming that it's possible to allocate a pty device > to set as the controlling terminal: > > https://archives.gentoo.org/gentoo-portage-dev/message/ > c65c74ad30f8c1ef106b4ab9273c1280 > https://github.com/gentoo/portage/pull/406 The patch works for me.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc5692d278fcca7d07e2d5bc282f5467a2237ecf commit bc5692d278fcca7d07e2d5bc282f5467a2237ecf Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 06:18:05 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 06:27:08 +0000 sys-apps/portage: version bump to 2.3.59 #675868 pid-sandbox: pid-ns-init TIOCSCTTY after setsid Bug: https://bugs.gentoo.org/671498 Bug: https://bugs.gentoo.org/675868 Package-Manager: Portage-2.3.59, Repoman-2.3.12 Signed-off-by: Zac Medico <zmedico@gentoo.org> sys-apps/portage/Manifest | 1 + sys-apps/portage/portage-2.3.59.ebuild | 271 +++++++++++++++++++++++++++++++++ 2 files changed, 272 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=ce0656337268601aeadff091ea4f683eeea16148 commit ce0656337268601aeadff091ea4f683eeea16148 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-27 20:24:55 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-27 20:45:53 +0000 pid-sandbox: pid-ns-init TIOCSCTTY after setsid (bug 675868) Set the controlling terminal to the stdout pty after calling setsid, in order to avoid "No such device or address" ENXIO errors when attempting to open /dev/tty. Bug: https://bugs.gentoo.org/675868 Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 13 +++++++++++++ 1 file changed, 13 insertions(+)
(In reply to tka from comment #14) > (In reply to Zac Medico from comment #13) > > This patch will fix it, assuming that it's possible to allocate a pty device > > to set as the controlling terminal: > > > > https://archives.gentoo.org/gentoo-portage-dev/message/ > > c65c74ad30f8c1ef106b4ab9273c1280 > > https://github.com/gentoo/portage/pull/406 > The patch works for me. Thanks! This is included in portage-2.3.59.
JFYI FEATURES="pid-sandbox" emerge -1 portage Calculating dependencies... done! >>> Verifying ebuild manifests >>> Running pre-merge checks for sys-apps/portage-2.3.59 * Determining the location of the kernel source code * Found kernel source directory: * /usr/src/linux * Found sources for kernel version: * 4.20.5-gentoo * Checking for suitable kernel configuration options... [ ok ] Traceback (most recent call last): File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, in <module> sys.exit(main(sys.argv)) File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, in main fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) IOError: [Errno 1] Operation not permitted >>> Emerging (1 of 1) sys-apps/portage-2.3.59::gentoo Traceback (most recent call last): File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, in <module> sys.exit(main(sys.argv)) File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, in main fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) IOError: [Errno 1] Operation not permitted Works with FEATURES="-pid-sandbox" >>> Failed to emerge sys-apps/portage-2.3.59
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 commit d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 19:27:47 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 19:42:21 +0000 pid-sandbox: handle EnvironmentError for python2 compat (bug 675868) The fcntl.ioctl call raises IOError, which is different from OSError for python2. Use EnvironmentError for compatibility. Bug: https://bugs.gentoo.org/675868 Reported-by: Ivan Ivanich <ivanich@ivanich.org.ua> Fixes: ce0656337268 ("pid-sandbox: pid-ns-init TIOCSCTTY after setsid (bug 675868)") Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a89abbf82cc13d266d512b3100bb990ed7718f40 commit a89abbf82cc13d266d512b3100bb990ed7718f40 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 19:41:43 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 19:47:08 +0000 sys-apps/portage: revbump to 2.3.59-r1 for bug 675868 Bug: https://bugs.gentoo.org/675868 Reported-by: Ivan Ivanich <ivanich@ivanich.org.ua> See: https://gitweb.gentoo.org/proj/portage.git/commit/?id=d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 Package-Manager: Portage-2.3.59, Repoman-2.3.12 Signed-off-by: Zac Medico <zmedico@gentoo.org> sys-apps/portage/{portage-2.3.59.ebuild => portage-2.3.59-r1.ebuild} | 3 +++ 1 file changed, 3 insertions(+)
(In reply to Ivan Ivanich from comment #18) > JFYI > FEATURES="pid-sandbox" emerge -1 portage > Calculating dependencies... done! > > >>> Verifying ebuild manifests > >>> Running pre-merge checks for sys-apps/portage-2.3.59 > * Determining the location of the kernel source code > * Found kernel source directory: > * /usr/src/linux > * Found sources for kernel version: > * 4.20.5-gentoo > * Checking for suitable kernel configuration options... > [ ok ] > Traceback (most recent call last): > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, > in <module> > sys.exit(main(sys.argv)) > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, > in main > fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) > IOError: [Errno 1] Operation not permitted > > >>> Emerging (1 of 1) sys-apps/portage-2.3.59::gentoo > Traceback (most recent call last): > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, > in <module> > sys.exit(main(sys.argv)) > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, > in main > fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) > IOError: [Errno 1] Operation not permitted > > > Works with FEATURES="-pid-sandbox" > >>> Failed to emerge sys-apps/portage-2.3.59 Reported separately as bug 675868.
I mean bug 676856.
