https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c0
Summary: encrypted /tmp can only be used by root Classification: openSUSE Product: openSUSE 12.1 Version: Beta 1 Platform: x86-64 OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: dutchkind@txoriaskea.org QAContact: qa@suse.de Found By: --- Blocker: ---
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1
After the upgrade from milestone 5 to beta 1 my encrypted /tmp is no longer mounted as 777 owner rights, so normal users can not login anymore because there is no write access to /tmp. Logging in as root and changing the rights to 777 solves the problem until reboot.
Reproducible: Always
Steps to Reproduce: 1. 2. 3.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c1
Stephan Kulow coolo@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.pr |fcrozat@suse.com |ovo.novell.com |
--- Comment #1 from Stephan Kulow coolo@suse.com 2011-10-18 11:47:36 CEST --- systemd regression I suppose
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c2
--- Comment #2 from Frederic Crozat fcrozat@suse.com 2011-10-18 10:33:29 UTC --- /tmp permissions is handled by /usr/lib/tmpfiles.d/tmp.conf but I guess your issue is caused by remounting /tmp in /etc/fstab
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c3
David Kerkhof dutchkind@txoriaskea.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dutchkind@txoriaskea.org
--- Comment #3 from David Kerkhof dutchkind@txoriaskea.org 2011-10-18 15:25:18 UTC --- I will have a look into this. The interesting thing is that an upgrade on my wife's netbook with the same layout with an encrypted tmp and home it worked without any problems, no problems with access rights of tmp. I wonder if this is a remount issue since I disabled boot.crypto-early because I had this problem with an earlier Opensuse version, can't remember when.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c4
--- Comment #4 from David Kerkhof dutchkind@txoriaskea.org 2011-10-20 17:43:52 UTC --- I looked at the various elements mentioned above and can't find anything wrong. It may indeed be a systemd regression where boot.crypto-early is not disabled although it was disabled in the older init method. I don't see any way to fix this, any ideas?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c5
--- Comment #5 from Frederic Crozat fcrozat@suse.com 2011-10-21 08:37:39 UTC --- boot.crypto-early is always disabled under systemd.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c6
--- Comment #6 from David Kerkhof dutchkind@txoriaskea.org 2011-10-27 17:06:48 UTC --- FOUND IT! I changed the filesystem for /tmp from ext4 to ext3 in fstab, and now it works!
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c7
--- Comment #7 from David Kerkhof dutchkind@txoriaskea.org 2011-10-28 09:39:51 UTC --- Sorry, I was too quick, I just discovered that after changing fstab neither my encrypted /tmp nor my encrypted swap gets mounted. I think I will try a fresh install and to see what happens.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c8
--- Comment #8 from David Kerkhof dutchkind@txoriaskea.org 2011-10-28 15:57:38 UTC --- Update, did a fresh install, but although I configured the system to use an encrypted tmp and swap, none of those are mounted, encrypted tmp and swap is not available.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c9
--- Comment #9 from Frederic Crozat fcrozat@suse.com 2011-10-31 12:28:53 UTC --- could you describe a little more how you setup encrypted swap and /tmp ?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c10
--- Comment #10 from David Kerkhof dutchkind@txoriaskea.org 2011-10-31 16:49:42 UTC --- I have 2 partitions reserved for them, and during install in yast I just select each of those partitions, choose to format to ext3 or ext4, select encrypted and the mount point, either /tmp or swap. When asked for the password I leave it blank, assuming that then a random password is created during boot. That's all, no special settings. And it worked since at least opensuse 11.0, maybe even longer.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c11
--- Comment #11 from Frederic Crozat fcrozat@suse.com 2011-10-31 16:58:10 UTC --- please attach /etc/fstab and /etc/crypttab
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c12
--- Comment #12 from David Kerkhof dutchkind@txoriaskea.org 2011-10-31 17:20:21 UTC --- Created an attachment (id=459635) --> (http://bugzilla.novell.com/attachment.cgi?id=459635) crypttab
Here is my crypttab
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c13
--- Comment #13 from David Kerkhof dutchkind@txoriaskea.org 2011-10-31 17:21:11 UTC --- Created an attachment (id=459636) --> (http://bugzilla.novell.com/attachment.cgi?id=459636) fstab
And here my fstab
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c14
--- Comment #14 from David Kerkhof dutchkind@txoriaskea.org 2011-10-31 17:26:38 UTC --- Since I had my 12.1 partitions mounted, I could take a look in /var/log/messages, and this it what I see that seems related:
Oct 28 18:15:04 linux-8u5h mke2fs[1159]: mke2fs 1.41.14 (22-Dec-2010) Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Filesystem label= Oct 28 18:15:04 linux-8u5h mke2fs[1159]: OS type: Linux Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Block size=4096 (log=2) Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Fragment size=4096 (log=2) Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Stride=0 blocks, Stripe width=0 blocks Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 135456 inodes, 541696 blocks Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 27084 blocks (5.00%) reserved for the super user Oct 28 18:15:04 linux-8u5h mke2fs[1159]: First data block=0 Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Maximum filesystem blocks=557842432 Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 17 block groups Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 32768 blocks per group, 32768 fragments per group Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 7968 inodes per group Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Superblock backups stored on blocks: Oct 28 18:15:04 linux-8u5h mke2fs[1159]: 32768, 98304, 163840, 229376, 294912 Oct 28 18:15:04 linux-8u5h mke2fs[1159]: Writing inode tables: 0/17#010#010#010#010#010 1/17#010#010#010#010#010 2/17#010#010#010#010#010 3/17#010#010#010#010#010 4/17#010#010#010#010#010 5/17#010#010#010#010#010 6/17#010#010#010#010#010 7/17#010#010#010#010#010 8/17#010#010#010#010#010 9/17#010#010#010#010#01010/17#010#010#010#010#01011/17#010#010#010#010#01012/17#010#010#010#010#01013/17#010#010#010#010#01014/17#010#010#010#010#01015/17#010#010#010#010#01016/17#010#010#010#010#010done Oct 28 18:15:04 linux-8u5h mkswap[1173]: mkswap: /dev/mapper/cr_sda7: warning: don't erase bootbits sectors Oct 28 18:15:04 linux-8u5h mkswap[1173]: on whole disk. Use -f to force. Oct 28 18:15:05 linux-8u5h mkswap[1173]: Setting up swapspace version 1, size = 1018876 KiB Oct 28 18:15:05 linux-8u5h mkswap[1173]: no label, UUID=128241af-5e32-41e8-b1ba-db7ad4d46b2e Oct 28 18:15:05 linux-8u5h mke2fs[1159]: Writing superblocks and filesystem accounting information: done Oct 28 18:15:05 linux-8u5h mke2fs[1159]: This filesystem will be automatically checked every 21 mounts or Oct 28 18:15:05 linux-8u5h mke2fs[1159]: 180 days, whichever comes first. Use tune2fs -c or -i to override. Oct 28 18:15:35 linux-8u5h systemd[1]: NetworkManager-wait-online.service: main process exited, code=exited, status=1 Oct 28 18:15:35 linux-8u5h systemd[1]: Unit NetworkManager-wait-online.service entered failed state. Oct 28 18:15:35 linux-8u5h sshd[1256]: Server listening on 0.0.0.0 port 22. Oct 28 18:15:35 linux-8u5h sshd[1256]: Server listening on :: port 22. Oct 28 18:15:35 linux-8u5h kernel: [ 45.239277] EXT3-fs (dm-0): error: no journal found. mounting ext3 over ext2? Oct 28 18:15:35 linux-8u5h systemd[1]: tmp.mount mount process exited, code=exited status=32 Oct 28 18:15:35 linux-8u5h systemd[1]: Job remote-fs.target/start failed with result 'dependency'. Oct 28 18:15:35 linux-8u5h systemd[1]: Job local-fs.target/start failed with result 'dependency'. Oct 28 18:15:35 linux-8u5h systemd[1]: Triggering OnFailure= dependencies of local-fs.target. Oct 28 18:15:35 linux-8u5h systemd[1]: Unit tmp.mount entered failed state.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c15
--- Comment #15 from David Kerkhof dutchkind@txoriaskea.org 2011-10-31 18:21:44 UTC --- Ok, I changed fstab to use ext2 for /tmp, and now at least it boots again. /tmp is now mounted, which didn't do it, but still no user access unless I enter first in root and change it. The encrypted swap doesn't get activated.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c16
--- Comment #16 from David Kerkhof dutchkind@txoriaskea.org 2011-11-05 12:16:01 UTC --- Tried it in RC2, same story. I then tried disabling systemd and lo and behold, it works! All encrypted stuff gets mounted and is user accessible.
Now I have only one bug that appeared, the partition for my personal data that got mounted on /media/datadisk since the years I have been using suse/opensuse from 8.2 onwards, now gets mounted during boot, but then a tmpfs gets mounted on /media and so my data partition is no longer accessible! WHY in the world did this have to change to a tmpfs? It took me already hours to rewrite scripts that used /media/xxx to mount encrypted stuff. Any way to fix this?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c17
--- Comment #17 from Frederic Crozat fcrozat@suse.com 2011-11-07 16:39:05 UTC --- this bug is only about encrypted /tmp.
I've reproduced the issue, it is caused by another fix for lvm on top of crypted partition
working on a fix
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c18
--- Comment #18 from Frederic Crozat fcrozat@suse.com 2011-11-08 16:13:20 UTC --- please test package in home:fcrozat:systemd/systemd, it fixes issue for both encrypted swap and encrypted /tmp on my test system
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c19
--- Comment #19 from David Kerkhof dutchkind@txoriaskea.org 2011-11-08 17:58:04 UTC --- I installed systemd-37-289 from http://download.opensuse.org/repositories/home:/fcrozat:/systemd/openSUSE_12... It didn't fix the issue, still the /tmp is not writable for normal user.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c20
--- Comment #20 from David Kerkhof dutchkind@txoriaskea.org 2011-11-08 17:59:45 UTC --- Created an attachment (id=460978) --> (http://bugzilla.novell.com/attachment.cgi?id=460978) dmesg output
Created for bug 726896, same dmesg output
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c21
--- Comment #21 from Frederic Crozat fcrozat@suse.com 2011-11-09 09:54:09 UTC --- please give output of systemctl show tmp.mount and systemctl show systemd-tmpfiles-setup.service, it looks like you have an ordering problem between both..
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c22
--- Comment #22 from David Kerkhof dutchkind@txoriaskea.org 2011-11-10 16:26:02 UTC --- Created an attachment (id=461474) --> (http://bugzilla.novell.com/attachment.cgi?id=461474) output of systemctl show tmp.mount
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c23
--- Comment #23 from David Kerkhof dutchkind@txoriaskea.org 2011-11-10 16:27:01 UTC --- Created an attachment (id=461475) --> (http://bugzilla.novell.com/attachment.cgi?id=461475) output of systemctl show systemd-tmpfiles-setup.service
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c24
--- Comment #24 from Frederic Crozat fcrozat@suse.com 2011-11-10 16:41:03 UTC --- could you try removing nofail in /etc/fstab for /tmp ?
I think it causes dependency between tmp.mount and local-fs.target to be too "soft".
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c25
--- Comment #25 from David Kerkhof dutchkind@txoriaskea.org 2011-11-10 18:24:29 UTC --- That did the trick
BUT, now the system doesn't shut down properly, I get:
systemd-cryptsetup[4911]: Failed to deactivate: Device or resource busy
This error is shown twice, but with a different number, 4913
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c26
--- Comment #26 from Frederic Crozat fcrozat@suse.com 2011-11-14 12:49:31 UTC --- does it cause any issue other than the warning in the logs ?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c27
--- Comment #27 from David Kerkhof dutchkind@txoriaskea.org 2011-11-14 14:49:50 UTC --- The first time after it worked the system hung while shutting down. But another time it just shut down properly. I don't know how it will hold up, at the moment it is mainly running with an older 12.1 because it worked, so my wife can at least use it. So I only boot into the latest version and therefore can not tell much because 2 shutdowns is not enough to know. On my own laptop I had the same issue of not shutting down completely with 11.4 installed, in the end I just went back to 11.3 (also for other issues) I hope I can use 12.1 without problems. All I can do for now is thank you for all the effort.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c28
--- Comment #28 from David Kerkhof dutchkind@txoriaskea.org 2011-11-18 19:29:46 UTC --- I assumed that this bug was fixed in final, and that the fix that I had to try out was included in final. /tmp is again not user accessible and removing nofail for /tmp in fstab makes the system stop with an emergency root login prompt. So restored nofail in fstab, rebooted and before user login chmod-ded /tmp and it works. How to get this right without dirty hacks in init.d/boot.local or so?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c29
--- Comment #29 from Frederic Crozat fcrozat@suse.com 2011-11-29 10:09:08 UTC --- what make you thing the bug was fixed in final, since I didn't close the bug as fixed ?
So, it will be fixed in a maintenance update, since I was waiting for your input (and for other fixes to be tested).
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c30
--- Comment #30 from David Kerkhof dutchkind@txoriaskea.org 2011-11-29 11:54:06 UTC --- O well, sorry, I thought that at least the encrypted tmp was accessible, so that part worked. It would be great to see this come in a maintenance update. After that I will see if the system hangs again when I switch back to systemd. For now, since it was a fresh install, I did not install your patch and just used the old init system for the time being. But on my own laptop this is not working either because of consolekit errors, so this fix would really be appreciated.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c31
--- Comment #31 from David Kerkhof dutchkind@txoriaskea.org 2011-12-06 10:41:15 UTC --- I installed systemd-37-301 and it's additional packages just to have a working system, and now I discovered /tmp doesn't get mounted so I have an unencrypted /tmp. The newer version that is now available doesn't work either. No matter what I do, it doesn't work. So what changed between 289 and 301?
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c32
--- Comment #32 from Frederic Crozat fcrozat@suse.com 2011-12-06 12:20:32 UTC --- it should still work.
Please make sure you removed nofail from /etc/fstab and attach dmesg output
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c33
--- Comment #33 from David Kerkhof dutchkind@txoriaskea.org 2011-12-06 14:51:06 UTC --- Created an attachment (id=466100) --> (http://bugzilla.novell.com/attachment.cgi?id=466100) dmesg output
This is the fstab entry: /dev/mapper/cr_sda6 /tmp ext3 acl,user_xattr,noauto 0 0
According to mtab both the encrypted swap and tmp don't get mounted
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c34
--- Comment #34 from Frederic Crozat fcrozat@suse.com 2011-12-07 11:50:15 UTC --- remove noauto otherwise, systemd won't mount it..
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c35
--- Comment #35 from David Kerkhof dutchkind@txoriaskea.org 2011-12-07 14:33:27 UTC --- ok, that fixed it, thanks again!
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c36
--- Comment #36 from Frederic Crozat fcrozat@suse.com 2011-12-07 14:49:49 UTC --- excellent, we'll close this bug when maintenance update is released.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c37
--- Comment #37 from David Kerkhof dutchkind@txoriaskea.org 2011-12-07 15:12:53 UTC --- great. and btw, I did not have shutdown problems anymore, all seems to work as it should now.
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c38
Frederic Crozat fcrozat@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |maintenance@opensuse.org
--- Comment #38 from Frederic Crozat fcrozat@suse.com 2011-12-09 14:39:53 UTC --- sr 96122 pushed to openSUSE:12.1:Update:Test requesting maintenance update for 12.1
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c39
--- Comment #39 from Bernhard Wiedemann bwiedemann@suse.com 2011-12-09 16:00:14 CET --- This is an autogenerated message for OBS integration: This bug (722539) was mentioned in https://build.opensuse.org/request/show/96122 12.1 / systemd https://build.opensuse.org/request/show/96125 Factory / systemd
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c40
--- Comment #40 from Bernhard Wiedemann bwiedemann@suse.com 2011-12-09 19:00:15 CET --- This is an autogenerated message for OBS integration: This bug (722539) was mentioned in https://build.opensuse.org/request/show/96193 Factory / systemd
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c41
--- Comment #41 from Bernhard Wiedemann bwiedemann@suse.com 2011-12-12 18:00:16 CET --- This is an autogenerated message for OBS integration: This bug (722539) was mentioned in https://build.opensuse.org/request/show/96377 12.1 / systemd
https://bugzilla.novell.com/show_bug.cgi?id=722539
https://bugzilla.novell.com/show_bug.cgi?id=722539#c43
Frederic Crozat fcrozat@suse.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED
--- Comment #43 from Frederic Crozat fcrozat@suse.com 2012-01-04 09:23:10 UTC --- maintenance update for 12.1 has been released, closing as fixed
-
bugzilla_noreply＠novell.com