June 2021 - openSUSE Kubic Bugs - openSUSE Mailing Lists

[Bug 1187462] New: Snapshoot unusable (and "reverted") after updates, when SELinux enabled
by bugzilla_noreply＠suse.com 15 Jul '21

15 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187462 Bug ID: 1187462 Summary: Snapshoot unusable (and "reverted") after updates, when SELinux enabled Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: dfaggioli(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hello, This is an intermittent issue that I am (and as far as I know also other MicroOS users) having. It appears that for triggering it, it is sufficient to use `transactional-udpate` or `tukit` directly (or `pkcon`, if on MicroOS desktop) for installing or updating some packages, or in general for modifying the system. During reboot, I quickly saw the error messages shown in screenshot_b.png. Then, during next boot, I see the messages shown in screenshot_a.png. The snapshot is then discarded and the system reboots fine, but of course without the modifications that were being attempted. Note that this does not reproduce 100% of the time. Also, when it reproduced, I always had SELinux enabled. That is, with SELinux enabled, it may or may not happen. With SELinux disabled, it never happens. At least that's my experience. Any idea? Or even anything I can do to help debugging? -- You are receiving this mail because: You are the assignee for the bug.

1 7

[Bug 1187219] New: virtlogd cannot read token due to SElinux
by bugzilla_noreply＠suse.com 12 Jul '21

12 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187219 Bug ID: 1187219 Summary: virtlogd cannot read token due to SElinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: gm.venekamp(a)quicknet.nl QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This bug is might be related to: https://bugzilla.redhat.com/show_bug.cgi?id=1964317 virsh start <vm> gives a permission error on: /run/libvirt/common/system.token This is confirmed by: # systemctl status virtlogd.service �� virtlogd.service - Virtual machine log manager Loaded: loaded (/usr/lib/systemd/system/virtlogd.service; indirect; vendor preset: disabled) Active: active (running) since Wed 2021-06-09 03:31:21 CEST; 2 days ago TriggeredBy: �� virtlogd-admin.socket �� virtlogd.socket Docs: man:virtlogd(8) https://libvirt.org Main PID: 1968 (virtlogd) Tasks: 1 (limit: 19660) CPU: 16ms CGroup: /system.slice/virtlogd.service ��1968 /usr/sbin/virtlogd Jun 09 03:31:21 galadriel systemd[1]: Started Virtual machine log manager. Jun 09 03:31:21 galadriel virtlogd[1968]: libvirt version: 7.4.0 Jun 09 03:31:21 galadriel virtlogd[1968]: hostname: xxxxxxxx Jun 09 03:31:21 galadriel virtlogd[1968]: Unable to open system token /run/libvirt/common/system.token: Permission denied Disabling SElinux solves the error and virtlogd is started correctly. After which virsh is able to start VMs successfully. -- You are receiving this mail because: You are the assignee for the bug.

1 1

[Bug 1187796] New: Missing remote attestation system roles in the control.xml
by bugzilla_noreply＠suse.com 28 Jun '21

28 Jun '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187796 Bug ID: 1187796 Summary: Missing remote attestation system roles in the control.xml Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: aplanas(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- To integrate keylime and the remote attestation feature in MicroOS, we need two new system roles: one to add the verifier and another to add the agent. -- You are receiving this mail because: You are the assignee for the bug.

1 1

[Bug 1185766] Transacrional-update fails due to selinux
by bugzilla_noreply＠suse.com 28 Jun '21

28 Jun '21

https://bugzilla.suse.com/show_bug.cgi?id=1185766 https://bugzilla.suse.com/show_bug.cgi?id=1185766#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2021:2192-1: An update that has 15 recommended fixes can now be installed. Category: recommended (important) Bug References: 1173842,1177149,1182525,1182544,1183442,1183521,1183539,1183856,1184529,1185224,1185226,1185625,1185766,1186775,1186842 CVE References: JIRA References: Sources used: SUSE MicroOS 5.0 (src): transactional-update-3.4.0-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are the assignee for the bug.

1 0

[Bug 1182544] New: transactional-update fails when self-updating from old snapshot
by bugzilla_noreply＠suse.com 28 Jun '21

28 Jun '21

https://bugzilla.suse.com/show_bug.cgi?id=1182544 Bug ID: 1182544 Summary: transactional-update fails when self-updating from old snapshot Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/1638401/modules/imag e_checks/steps/13 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: iforster(a)suse.com Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de CC: dimstar(a)opensuse.org, kubic-bugs(a)opensuse.org Found By: openQA Blocker: Yes This test boots into an old MicroOS image. It fails because combustion failed to run, which is caused by transactional-updates self update: Feb 21 05:49:26.233585 localhost combustion[542]: New version found - updating... Feb 21 05:49:26.374352 localhost combustion[703]: Loading repository data... Feb 21 05:49:26.584979 localhost combustion[703]: Reading installed packages... Feb 21 05:49:26.884304 localhost combustion[703]: Retrieving package transactional-update-3.1.4-1.1.x86_64 (1/1), 54.6 KiB ( 73.1 KiB unpacked) Feb 21 05:49:27.121761 localhost combustion[703]: .........done] Feb 21 05:49:27.306095 localhost combustion[742]: Loading repository data... Feb 21 05:49:27.517683 localhost combustion[742]: Reading installed packages... Feb 21 05:49:27.771859 localhost combustion[742]: Retrieving package libtukit0-3.1.4-1.1.x86_64 (1/2), 128.4 KiB (283.7 KiB unpacked) Feb 21 05:49:28.000220 localhost combustion[742]: ..........done] Feb 21 05:49:28.002964 localhost combustion[742]: Retrieving package tukit-3.1.4-1.1.x86_64 (2/2), 55.9 KiB ( 85.2 KiB unpacked) Feb 21 05:49:28.148466 localhost combustion[742]: ......done] Feb 21 05:49:28.209932 localhost combustion[741]: /tmp/transactional-update.a1AVPfXW9o/usr/sbin/tukit: /lib64/libselinux.so.1: no version information available (required by /tmp/transactional-update.a1AVPfXW9o/usr/lib64/libtukit.so.0) Feb 21 05:49:28.215355 localhost combustion[542]: transactional-update 3.1.4 started Feb 21 05:49:28.217252 localhost combustion[542]: Options: shell Feb 21 05:49:28.271971 localhost combustion[542]: Separate /var detected. Feb 21 05:49:28.320210 localhost combustion[741]: tukit: /lib64/libselinux.so.1: no version information available (required by /tmp/transactional-update.a1AVPfXW9o/usr/lib64/libtukit.so.0) Feb 21 05:49:28.328102 localhost combustion[741]: Failure (dbus fatal exception). ... Feb 21 05:49:29.012290 localhost combustion[741]: ERROR: filesystem error: cannot copy: File exists [/run/netconfig] [/.snapshots/2/snapshot/run/netconfig] Feb 21 05:49:29.013155 localhost combustion[542]: Opening chroot in snapshot , continue with 'exit' Feb 21 05:49:29.013981 localhost combustion[877]: tukit: /lib64/libselinux.so.1: no version information available (required by /tmp/transactional-update.a1AVPfXW9o/usr/lib64/libtukit.so.0) Feb 21 05:49:29.015824 localhost combustion[877]: 2021-02-21 05:49:29 tukit 3.1.4 started ... ## Observation openQA test in scenario microos-Tumbleweed-MicroOS-Image-x86_64-microos-old2microosnext@64bit fails in [image_checks](https://openqa.opensuse.org/tests/1638401/modules/image_check… ## Test suite description Boot from existing, static MicroOS image and transactional-update dup to snapshot under test ## Reproducible Fails since (at least) Build [20210219](https://openqa.opensuse.org/tests/1636750) ## Expected result Last good: [20210218](https://openqa.opensuse.org/tests/1635223) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=microos… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

Your Bugzilla bug list needs attention.
by bugzilla_noreply＠suse.com 27 Jun '21

27 Jun '21

[This e-mail has been automatically generated.] You have one or more bugs assigned to you in the Bugzilla bug tracking system (http://bugzilla.suse.com/) that require attention. All of these bugs are in either the CONFIRMED, NEW, or REOPENED state, and have not been touched in 7 days or more. You need to take a look at them, and decide on an initial action. Generally, this means one of three things: (1) You decide this bug is really quick to deal with (like, it's INVALID), and so you get rid of it immediately. (2) You decide the bug doesn't belong to you, and you reassign it to someone else. (Hint: if you don't know who to reassign it to, make sure that the Component field seems reasonable, and then use the "Reset Assignee to default" option.) (3) You decide the bug belongs to you, but you can't solve it this moment. Ignore this email until you are actively working on this bug, when you should set the status to IN_PROGRESS. To get a list of all affected bugs, you can use this URL (bookmark it if you like!): http://bugzilla.suse.com/buglist.cgi?bug_status=CONFIRMED&bug_status=NEW&bu… Or, you can use the general query page, at http://bugzilla.suse.com/query.cgi Appended below are the individual URLs to get to all of your affected bugs that haven't been touched for 7 days or more. You will get this message once a week until you've dealt with these bugs! security enhancement: no setuid -> http://bugzilla.suse.com/show_bug.cgi?id=1171174 live-add-yast-repos: uses openSUSE-release -> http://bugzilla.suse.com/show_bug.cgi?id=1172100 transactional-update: warn about reboot etc. -> http://bugzilla.suse.com/show_bug.cgi?id=1173261 transactional-update: Notification on failing update -> http://bugzilla.suse.com/show_bug.cgi?id=1176882 [Build 20210128] openQA test fails in journal_check -> http://bugzilla.suse.com/show_bug.cgi?id=1181547 transactional server role has very inconsistent package selection (TW, SLE, Leap) -> http://bugzilla.suse.com/show_bug.cgi?id=1183582 Opening polari flatpak crashes packagekitd and makes gnome go back to login screen -> http://bugzilla.suse.com/show_bug.cgi?id=1184411 ignition doesn't reset firstboot -> http://bugzilla.suse.com/show_bug.cgi?id=1185461 kdump fails on microos -> http://bugzilla.suse.com/show_bug.cgi?id=1185463 Impossible to trigger PackageKit offline update on MicroOS -> http://bugzilla.suse.com/show_bug.cgi?id=1185647 Kubelet/CRI-O/CA-Advisor is not reporting memory -> http://bugzilla.suse.com/show_bug.cgi?id=1185801 selinux-ready error -> http://bugzilla.suse.com/show_bug.cgi?id=1186127 snapper cleanup: Deleting snapshot failed. -> http://bugzilla.suse.com/show_bug.cgi?id=1186943 virtlogd cannot read token due to SElinux -> http://bugzilla.suse.com/show_bug.cgi?id=1187219

1 0

Your Bugzilla bug list needs attention.
by bugzilla_noreply＠suse.com 20 Jun '21

20 Jun '21

[This e-mail has been automatically generated.] You have one or more bugs assigned to you in the Bugzilla bug tracking system (http://bugzilla.suse.com/) that require attention. All of these bugs are in either the CONFIRMED, NEW, or REOPENED state, and have not been touched in 7 days or more. You need to take a look at them, and decide on an initial action. Generally, this means one of three things: (1) You decide this bug is really quick to deal with (like, it's INVALID), and so you get rid of it immediately. (2) You decide the bug doesn't belong to you, and you reassign it to someone else. (Hint: if you don't know who to reassign it to, make sure that the Component field seems reasonable, and then use the "Reset Assignee to default" option.) (3) You decide the bug belongs to you, but you can't solve it this moment. Ignore this email until you are actively working on this bug, when you should set the status to IN_PROGRESS. To get a list of all affected bugs, you can use this URL (bookmark it if you like!): http://bugzilla.suse.com/buglist.cgi?bug_status=CONFIRMED&bug_status=NEW&bu… Or, you can use the general query page, at http://bugzilla.suse.com/query.cgi Appended below are the individual URLs to get to all of your affected bugs that haven't been touched for 7 days or more. You will get this message once a week until you've dealt with these bugs! security enhancement: no setuid -> http://bugzilla.suse.com/show_bug.cgi?id=1171174 live-add-yast-repos: uses openSUSE-release -> http://bugzilla.suse.com/show_bug.cgi?id=1172100 transactional-update: warn about reboot etc. -> http://bugzilla.suse.com/show_bug.cgi?id=1173261 transactional-update: Notification on failing update -> http://bugzilla.suse.com/show_bug.cgi?id=1176882 [Build 20210128] openQA test fails in journal_check -> http://bugzilla.suse.com/show_bug.cgi?id=1181547 transactional server role has very inconsistent package selection (TW, SLE, Leap) -> http://bugzilla.suse.com/show_bug.cgi?id=1183582 Opening polari flatpak crashes packagekitd and makes gnome go back to login screen -> http://bugzilla.suse.com/show_bug.cgi?id=1184411 ignition doesn't reset firstboot -> http://bugzilla.suse.com/show_bug.cgi?id=1185461 kdump fails on microos -> http://bugzilla.suse.com/show_bug.cgi?id=1185463 Impossible to trigger PackageKit offline update on MicroOS -> http://bugzilla.suse.com/show_bug.cgi?id=1185647 Kubelet/CRI-O/CA-Advisor is not reporting memory -> http://bugzilla.suse.com/show_bug.cgi?id=1185801 selinux-ready error -> http://bugzilla.suse.com/show_bug.cgi?id=1186127 SElinux is blocking podman socket access to /var/run/podman/podman.sock -> http://bugzilla.suse.com/show_bug.cgi?id=1186158 snapper cleanup: Deleting snapshot failed. -> http://bugzilla.suse.com/show_bug.cgi?id=1186943 virtlogd cannot read token due to SElinux -> http://bugzilla.suse.com/show_bug.cgi?id=1187219

1 0

[Bug 1185766] New: Transacrional-update fails due to selinux
by bugzilla_noreply＠suse.com 14 Jun '21

14 Jun '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185766 Bug ID: 1185766 Summary: Transacrional-update fails due to selinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE MicroOS Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: gm.venekamp(a)quicknet.nl QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When doing a fresh install with today's current MicroOS image (0505) and with the MicroOS transactiona container pattern, installing additional packages after the initial install fail. For example: # transactional-update pkg install --download-in-advance firewalld ... Additional rpm output: /sbin/ldconfig: Warning: ignoring configuration file that cannot be opened: /etc/ld.so.conf: Permission denied /sbin/ldconfig: Can't create temporary cache file /etc/ld.so.cache.xeizJJ: Permission denied warning: %post(libgirepository-1_0-1-1.68.0-1.2.x86_64) scriptlet failed, exit status 1 There are multiple messages like this. However, when I disable selinux by: setenforce 0 The install succeeds. Disabling selinux as a workaroud for installing a few additional packages to the MicroOS container works as long as this is done manually. However, for automated updates, one would have to permanently disable selinux, which I don't thinks is a good idea. Not sure if the following is related. During initial boot of the installed systemd complains about the following role: system_u_system_r_init_t Regards, Gerben -- You are receiving this mail because: You are the assignee for the bug.

1 2

[Bug 1186943] snapper cleanup: Deleting snapshot failed.
by bugzilla_noreply＠suse.com 07 Jun '21

07 Jun '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1186943 http://bugzilla.opensuse.org/show_bug.cgi?id=1186943#c2 Ludwig Nussel <lnussel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|aschnell(a)suse.com |kubic-bugs(a)opensuse.org --- Comment #2 from Ludwig Nussel <lnussel(a)suse.com> --- There's ID 435 gen 211403 top level 434 path @/.snapshots/46/snapshot/var/lib/machines I guess that comes from systemd-container's %post calling /usr/lib/systemd/scripts/fix-machines-btrfs-subvol.sh. Might be incompatible with transactional mode. -- You are receiving this mail because: You are the assignee for the bug.

1 0

Your Bugzilla bug list needs attention.
by bugzilla_noreply＠suse.com 06 Jun '21

06 Jun '21

[This e-mail has been automatically generated.] You have one or more bugs assigned to you in the Bugzilla bug tracking system (http://bugzilla.suse.com/) that require attention. All of these bugs are in either the CONFIRMED, NEW, or REOPENED state, and have not been touched in 7 days or more. You need to take a look at them, and decide on an initial action. Generally, this means one of three things: (1) You decide this bug is really quick to deal with (like, it's INVALID), and so you get rid of it immediately. (2) You decide the bug doesn't belong to you, and you reassign it to someone else. (Hint: if you don't know who to reassign it to, make sure that the Component field seems reasonable, and then use the "Reset Assignee to default" option.) (3) You decide the bug belongs to you, but you can't solve it this moment. Ignore this email until you are actively working on this bug, when you should set the status to IN_PROGRESS. To get a list of all affected bugs, you can use this URL (bookmark it if you like!): http://bugzilla.suse.com/buglist.cgi?bug_status=CONFIRMED&bug_status=NEW&bu… Or, you can use the general query page, at http://bugzilla.suse.com/query.cgi Appended below are the individual URLs to get to all of your affected bugs that haven't been touched for 7 days or more. You will get this message once a week until you've dealt with these bugs! security enhancement: no setuid -> http://bugzilla.suse.com/show_bug.cgi?id=1171174 live-add-yast-repos: uses openSUSE-release -> http://bugzilla.suse.com/show_bug.cgi?id=1172100 transactional-update: warn about reboot etc. -> http://bugzilla.suse.com/show_bug.cgi?id=1173261 transactional-update: Notification on failing update -> http://bugzilla.suse.com/show_bug.cgi?id=1176882 [Build 20210128] openQA test fails in journal_check -> http://bugzilla.suse.com/show_bug.cgi?id=1181547 transactional server role has very inconsistent package selection (TW, SLE, Leap) -> http://bugzilla.suse.com/show_bug.cgi?id=1183582 Opening polari flatpak crashes packagekitd and makes gnome go back to login screen -> http://bugzilla.suse.com/show_bug.cgi?id=1184411 kdump fails on microos -> http://bugzilla.suse.com/show_bug.cgi?id=1185463 Impossible to trigger PackageKit offline update on MicroOS -> http://bugzilla.suse.com/show_bug.cgi?id=1185647 selinux-ready error -> http://bugzilla.suse.com/show_bug.cgi?id=1186127

1 0