Summary: | >=dev-lang/python-3.4 with FEATURES="pid-sandbox userpriv": test test_resource failed | ||
---|---|---|---|
Product: | Portage Development | Reporter: | tka <tka> |
Component: | Core | Assignee: | Portage team <dev-portage> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | python |
Priority: | Normal | Keywords: | InVCS, REGRESSION, TESTFAILURE |
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
See Also: | https://bugs.gentoo.org/show_bug.cgi?id=924313 | ||
Whiteboard: | |||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | |||
Bug Blocks: | 671498 | ||
Attachments: |
build.log
Patch build.log with portage-2.3.58 |
Description
tka
2019-01-19 18:01:45 UTC
Does this problem occur with FEATURES="-ipc-sandbox"? Does this problem occur with FEATURES="-network-sandbox"? Does this problem occur with FEATURES="-pid-sandbox"? So this is caused by FEATURES="pid-sandbox". Running full test suite of Python is unnecessary. Simpler ebuild to reproduce problem: EAPI="7" SLOT="0" KEYWORDS="*" S="${WORKDIR}" src_unpack() { python3.6 -m test.test_resource } Correct, no failure with FEATURES="-pid-sandbox". Since pid-sandbox changes the prlimit PermissionError behavior, I wonder if test_prlimit should handle this somehow. Failing code in test: if os.geteuid() != 0: self.assertRaises(PermissionError, resource.prlimit, 1, resource.RLIMIT_AS) This assumes that changing of properties of process with PID 1 is not allowed if current process has UID != 0. With FEATURES="pid-sandbox -userpriv", this assumption succeeds. With FEATURES="pid-sandbox userpriv", this assumption fails because pid-ns-init is run with UID 250. I suggest to delay dropping of permissions to after spawning pid-ns-init. Created attachment 562380 [details, diff]
Patch
Could we change the pid-sandbox code to run PID 1 as root instead? See Lennart's advice: https://github.com/systemd/systemd/pull/11504#issuecomment-456009720 Oh, that's exactly what your patch does. Nice! (In reply to Arfrever Frehtes Taifersar Arahesis from comment #6) > Created attachment 562380 [details, diff] [details, diff] > Patch Looks good. Patch sent for more review: https://archives.gentoo.org/gentoo-portage-dev/message/0d180507dbc1f941605fd8809a14bcda https://github.com/gentoo/portage/pull/405 The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=82e86efb503a23588b6b8e4351427cc3fca27de3 commit 82e86efb503a23588b6b8e4351427cc3fca27de3 Author: Arfrever Frehtes Taifersar Arahesis <Arfrever@Apache.Org> AuthorDate: 2019-01-21 16:14:03 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-23 04:47:29 +0000 pid-sandbox: run pid-ns-init as root (bug 675868) Drop permissions only for subprocess of pid-ns-init but not pid-ns-init itself. With FEATURES="pid-sandbox userpriv", pid-ns-init should be run with unchanged permissions (usually UID=0, GID=0). Bug: https://bugs.gentoo.org/675868 Signed-off-by: Arfrever Frehtes Taifersar Arahesis <Arfrever@Apache.Org> Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 49 ++++++++++++++++++++++++++++++------------------- lib/portage/process.py | 12 ++++++++++-- 2 files changed, 40 insertions(+), 21 deletions(-) Created attachment 563004 [details] build.log with portage-2.3.58 Now with sys-apps/portage-2.3.58, there is a different issue with FEATURES="pid-sandbox": >>> Source compiled. >>> Test phase: dev-lang/python-3.6.6 /var/tmp/portage/dev-lang/python-3.6.6/temp/environment: line 3781: /dev/tty: No such device or address * The following tests have been skipped: * test_gdb.py * If you would like to run them, you may: * cd '/usr/lib64/python3.6/test' * and run the tests separately. * ERROR: dev-lang/python-3.6.6::gentoo failed (test phase): * emake test failed Running it with FEATURES="-pid-sandbox" makes the issue go away. (In reply to tka from comment #12) > Created attachment 563004 [details] > build.log with portage-2.3.58 > > Now with sys-apps/portage-2.3.58, there is a different issue with > FEATURES="pid-sandbox": > > >>> Source compiled. > >>> Test phase: dev-lang/python-3.6.6 > /var/tmp/portage/dev-lang/python-3.6.6/temp/environment: line 3781: > /dev/tty: No such device or address > * The following tests have been skipped: > * test_gdb.py > * If you would like to run them, you may: > * cd '/usr/lib64/python3.6/test' > * and run the tests separately. > * ERROR: dev-lang/python-3.6.6::gentoo failed (test phase): > * emake test failed > > Running it with FEATURES="-pid-sandbox" makes the issue go away. This patch will fix it, assuming that it's possible to allocate a pty device to set as the controlling terminal: https://archives.gentoo.org/gentoo-portage-dev/message/c65c74ad30f8c1ef106b4ab9273c1280 https://github.com/gentoo/portage/pull/406 (In reply to Zac Medico from comment #13) > This patch will fix it, assuming that it's possible to allocate a pty device > to set as the controlling terminal: > > https://archives.gentoo.org/gentoo-portage-dev/message/ > c65c74ad30f8c1ef106b4ab9273c1280 > https://github.com/gentoo/portage/pull/406 The patch works for me. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc5692d278fcca7d07e2d5bc282f5467a2237ecf commit bc5692d278fcca7d07e2d5bc282f5467a2237ecf Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 06:18:05 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 06:27:08 +0000 sys-apps/portage: version bump to 2.3.59 #675868 pid-sandbox: pid-ns-init TIOCSCTTY after setsid Bug: https://bugs.gentoo.org/671498 Bug: https://bugs.gentoo.org/675868 Package-Manager: Portage-2.3.59, Repoman-2.3.12 Signed-off-by: Zac Medico <zmedico@gentoo.org> sys-apps/portage/Manifest | 1 + sys-apps/portage/portage-2.3.59.ebuild | 271 +++++++++++++++++++++++++++++++++ 2 files changed, 272 insertions(+) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=ce0656337268601aeadff091ea4f683eeea16148 commit ce0656337268601aeadff091ea4f683eeea16148 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-27 20:24:55 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-27 20:45:53 +0000 pid-sandbox: pid-ns-init TIOCSCTTY after setsid (bug 675868) Set the controlling terminal to the stdout pty after calling setsid, in order to avoid "No such device or address" ENXIO errors when attempting to open /dev/tty. Bug: https://bugs.gentoo.org/675868 Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 13 +++++++++++++ 1 file changed, 13 insertions(+) (In reply to tka from comment #14) > (In reply to Zac Medico from comment #13) > > This patch will fix it, assuming that it's possible to allocate a pty device > > to set as the controlling terminal: > > > > https://archives.gentoo.org/gentoo-portage-dev/message/ > > c65c74ad30f8c1ef106b4ab9273c1280 > > https://github.com/gentoo/portage/pull/406 > The patch works for me. Thanks! This is included in portage-2.3.59. JFYI FEATURES="pid-sandbox" emerge -1 portage Calculating dependencies... done! >>> Verifying ebuild manifests >>> Running pre-merge checks for sys-apps/portage-2.3.59 * Determining the location of the kernel source code * Found kernel source directory: * /usr/src/linux * Found sources for kernel version: * 4.20.5-gentoo * Checking for suitable kernel configuration options... [ ok ] Traceback (most recent call last): File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, in <module> sys.exit(main(sys.argv)) File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, in main fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) IOError: [Errno 1] Operation not permitted >>> Emerging (1 of 1) sys-apps/portage-2.3.59::gentoo Traceback (most recent call last): File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, in <module> sys.exit(main(sys.argv)) File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, in main fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) IOError: [Errno 1] Operation not permitted Works with FEATURES="-pid-sandbox" >>> Failed to emerge sys-apps/portage-2.3.59 The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 commit d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 19:27:47 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 19:42:21 +0000 pid-sandbox: handle EnvironmentError for python2 compat (bug 675868) The fcntl.ioctl call raises IOError, which is different from OSError for python2. Use EnvironmentError for compatibility. Bug: https://bugs.gentoo.org/675868 Reported-by: Ivan Ivanich <ivanich@ivanich.org.ua> Fixes: ce0656337268 ("pid-sandbox: pid-ns-init TIOCSCTTY after setsid (bug 675868)") Signed-off-by: Zac Medico <zmedico@gentoo.org> bin/pid-ns-init | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a89abbf82cc13d266d512b3100bb990ed7718f40 commit a89abbf82cc13d266d512b3100bb990ed7718f40 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2019-01-28 19:41:43 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2019-01-28 19:47:08 +0000 sys-apps/portage: revbump to 2.3.59-r1 for bug 675868 Bug: https://bugs.gentoo.org/675868 Reported-by: Ivan Ivanich <ivanich@ivanich.org.ua> See: https://gitweb.gentoo.org/proj/portage.git/commit/?id=d66f4238e6b5dca2bbc0fb04f64c67f3e0bc3586 Package-Manager: Portage-2.3.59, Repoman-2.3.12 Signed-off-by: Zac Medico <zmedico@gentoo.org> sys-apps/portage/{portage-2.3.59.ebuild => portage-2.3.59-r1.ebuild} | 3 +++ 1 file changed, 3 insertions(+) (In reply to Ivan Ivanich from comment #18) > JFYI > FEATURES="pid-sandbox" emerge -1 portage > Calculating dependencies... done! > > >>> Verifying ebuild manifests > >>> Running pre-merge checks for sys-apps/portage-2.3.59 > * Determining the location of the kernel source code > * Found kernel source directory: > * /usr/src/linux > * Found sources for kernel version: > * 4.20.5-gentoo > * Checking for suitable kernel configuration options... > [ ok ] > Traceback (most recent call last): > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, > in <module> > sys.exit(main(sys.argv)) > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, > in main > fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) > IOError: [Errno 1] Operation not permitted > > >>> Emerging (1 of 1) sys-apps/portage-2.3.59::gentoo > Traceback (most recent call last): > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 127, > in <module> > sys.exit(main(sys.argv)) > File "/tmp/portage/._portage_reinstall_.nFO0Ya/bin/pid-ns-init", line 82, > in main > fcntl.ioctl(sys.stdout, termios.TIOCSCTTY, 0) > IOError: [Errno 1] Operation not permitted > > > Works with FEATURES="-pid-sandbox" > >>> Failed to emerge sys-apps/portage-2.3.59 Reported separately as bug 675868. I mean bug 676856. |