New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 877846 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 6
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

chromeos-base/authpolicy is failing UnitTest stage in ubsan builder

Project Member Reported by cmt...@chromium.org, Aug 26

Issue description


As the title says, chromeos-base/authpolicy is failing in the UnitTest stage of the ubsan builder.  An example log can be found here:

https://luci-logdog.appspot.com/v/?s=chromeos/buildbucket/cr-buildbucket.appspot.com/8937131194333835744/+/steps/UnitTest/0/stdout

Most of the failures seem to be kinit failures, e.g.

authpolicy-0.0.1-r1168: [0826/141029:ERROR:tgt_manager.cc(172)] kinit failed - bad password
 
authpolicy-0.0.1-r1168: [0826/141029:ERROR:tgt_manager.cc(172)] kinit failed - bad password
authpolicy-0.0.1-r1168: [0826/141030:ERROR:tgt_manager.cc(166)] kinit failed - bad user name

Please fix this asap.
 
Labels: Enterprise-Triaged
Owner: atwilson@chromium.org
Status: Assigned (was: Untriaged)
Cc: ljusten@chromium.org
Owner: rsorokin@chromium.org
Labels: -Pri-2 Pri-1
Hey, is there a way to repro locally?
Repro instructions:

Create ubsan profile
$ ./setup_board --board=amd64-generic --profile=ubsan
Build authpolicy
$ ./build_packages chromeos-base/authpolicy
Run unit tests
$ FEATURES=test emerge-amd64-generic chromeos-base/authpolicy
Status: Started (was: Assigned)
Thanks!
The failing tests just runs /bin/echo inside minijail. I'm trying from a command line:
/sbin/minijail0 /bin/echo 
==135917==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
==135917==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
/usr/bin/coreutils: symbol lookup error: /lib64/libminijailpreload.so: undefined symbol: __ubsan_handle_type_mismatch_v1_abort

Any idea how to fix it?
Cc: jorgelo@chromium.org euge...@chromium.org
Is it possible to disable minijail when running tests under UBSan?
Or maybe minijail lets the user to provide a list of exceptions that he still may access?
Yes, we already disable asan for minijail. Same should most likely be done for ubsan.

I think, adding ubsan after asan to this file should fix this.
https://cs.corp.google.com/chromeos_public/src/third_party/chromiumos-overlay/profiles/targets/chromeos/package.use.mask
this has already been done in Minijail (https://android-review.googlesource.com/c/platform/external/minijail/+/737175) we just need to roll Minijail in CrOS. Will upload a CL shortly.
Regarding #10, will it fix the symbol lookup error which is most likely caused by loading minijail library by an executable that was not built with ubsan.

I am doubtful since the aosp CL does not touch build aspects of minijail. 
Fair point, we need to do both.
Project Member

Comment 13 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/66d2fa2593d44f9df9af6661ef3292d6b2105ab9

commit 66d2fa2593d44f9df9af6661ef3292d6b2105ab9
Author: Roman Sorokin <rsorokin@chromium.org>
Date: Wed Sep 05 16:15:19 2018

authpolicy: Fix unit tests for UBSAN

Seems like UBSAN image does not have 'grep' executable. Switched to 'cat'.

BUG= chromium:877846 
TEST=run tests locally with ubsan profile
CQ-DEPEND=CL:1202183

Change-Id: Id08b27fe5ed35c18b842f29dcc344ac1fafb6a13
Reviewed-on: https://chromium-review.googlesource.com/1202089
Commit-Ready: Roman Sorokin <rsorokin@chromium.org>
Tested-by: Roman Sorokin <rsorokin@chromium.org>
Reviewed-by: Zentaro Kavanagh <zentaro@chromium.org>

[modify] https://crrev.com/66d2fa2593d44f9df9af6661ef3292d6b2105ab9/authpolicy/process_executor_unittest.cc

Labels: M-71
Status: Fixed (was: Started)
Labels: Chromad
Hi Roman,

Please let me know if this bug requires any additional manual verification. I checked already steps from #5 and don't see such errors.

Thanks,
Ivan
Status: Verified (was: Fixed)
Hi, this one should be ok w/o manual verification. Thanks!

Sign in to add a comment