security_SandboxedServices is failing shill checking |
|||||||||||
Issue description
It's failing on the amd64-generic-informational as well as several pfq bots. Seems to be shill related.
10/02 03:09:01.355 INFO | base_sysinfo:0400| ChromeOS BOARD = betty_VM
10/02 03:09:01.374 INFO |security_Sandboxed:0208| Loading baseline /usr/local/autotest/tests/security_SandboxedServices/baseline
10/02 03:09:02.641 WARNI|security_Sandboxed:0108| Failed to read mountinfo for pid 9711: [Errno 2] No such file or directory: '/proc/9711/mountinfo'
10/02 03:09:02.692 WARNI|security_Sandboxed:0379| Stale baselines: defaultdict(<type 'list'>, {'anomaly_collect': ['potentially missing flags: pidns,mntns'], 'attestationd': ['unused'], 'timberslide': ['unused'], 'app_process': ['unused'], 'cromo': ['unused'], 'arc-obb-mounter': ['unused'], 'thermal.sh': ['unused'], 'cros_camera_service': ['unused'], 'cras': ['potentially missing flags: filter'], 'tlsdated': ['potentially missing flags: pidns,mntns'], 'easy_unlock': ['unused'], 'trunksd': ['unused'], 'wimax-manager': ['unused'], 'tpm_managerd': ['unused'], 'cros_camera_algo': ['unused'], 'daisydog': ['unused'], 'tcsd': ['unused'], 'tlsdated-setter': ['potentially missing flags: pidns,mntns'], 'netfilter-queue': ['unused'], 'upstart-udev-br': ['unused'], 'disks': ['unused'], 'firewalld': ['unused'], 'bugreportd': ['unused'], 'brcm_patchram_p': ['unused'], 'esif_ufd': ['unused'], 'arc_camera_serv': ['unused'], 'arc-networkd': ['unused'], 'lid_touchpad_he': ['unused']})
10/02 03:09:02.702 WARNI|security_Sandboxed:0382| New services: set(['adbd', 'usbguard-daemon', 'cros_camera_ser', 'cros_camera_alg', 'btdispatch', 'main', 'cros-disks', 'arc-bugreportd'])
10/02 03:09:02.712 ERROR|security_Sandboxed:0395| Failed sandboxing: shill
10/02 03:09:02.791 WARNI| test:0606| The test failed with the following exception
Traceback (most recent call last):
File "/usr/local/autotest/common_lib/test.py", line 600, in _exec
_call_test_function(self.execute, *p_args, **p_dargs)
File "/usr/local/autotest/common_lib/test.py", line 800, in _call_test_function
return func(*args, **dargs)
File "/usr/local/autotest/common_lib/test.py", line 464, in execute
postprocess_profiled_run, args, dargs)
File "/usr/local/autotest/common_lib/test.py", line 371, in _call_run_once
self.run_once(*args, **dargs)
File "/usr/local/autotest/tests/security_SandboxedServices/security_SandboxedServices.py", line 397, in run_once
sandbox_delta)
TestFail: One or more processes failed sandboxing: defaultdict(<type 'list'>, {'shill': ['bad user: wanted "shill" but got "root"', 'bad group: wanted "shill" but got "root"', 'missing caps usage', 'missing NoNewPrivs']})
,
Oct 2
This sounds like a duplicate of issue 888089 .
,
Oct 2
stevenjb - That one says security_SandboxLinuxUnittests and this one says security_SandboxedServices. Also it seems that one only affects peach_pit-tot-chrome-pfq-informational and is flaky while this one affects multiple informationals and is also seen on the last normal pfq run, and does not appear to be flaky.
,
Oct 2
,
Oct 2
I'm not really familiar with these tests. The other issue has shown up on at least one other builder (tricky I think?) but this could certainly be different. I would try to find an owner of that test to investigate.
,
Oct 2
Thanks Steven. +mortonm, vapier mortonm/vapier - Would either of you have any ideas?
,
Oct 2
Seems like this DUT is maybe somehow getting Finch updates? shill will run as 'shill' user by default but currently we have an experiment that will flip 50% of users to running as 'root'. We're actually about to flip back the default user for shill ('shill' -> 'root') https://chromium-review.googlesource.com/c/chromiumos/third_party/autotest/+/1250985, so that may solve this.
,
Oct 2
"pfq bots" from comment 1 makes me think these bots are getting Finch updates. I guess that is still an issue even after the CL listed in the previous comment goes in, since Finch will still be flipping behavior (but in the opposite direction) and breaking the test.
,
Oct 2
finch being deployed to test images sounds like a bad idea in general that, if true, we should file a dedicated bug to track in this specific case, is there a way we can force the finch state to be off ? or maybe update the shill init script so that, on test images, it ignores finch entirely and always runs as sandboxed ?
,
Oct 2
actually nevermind about the Finch stuff. this is just probably the first thing to catch the fact that we need the CL listed above (along with its dependent change) to be changed along with this CL that got merged: https://chromium-review.googlesource.com/c/chromium/src/+/1251326
,
Oct 2
Planning to submit CL:1250985 to the CQ today. That should fix this issue.
,
Oct 2
,
Oct 3
CL:1250985 just landed. Hopefully that fixes this
,
Oct 4
None of the bots on the pfq fail on this, will monitor for one more run before marking as fixed.
,
Oct 5
Should this be marked as fixed?
,
Oct 5
,
Oct 15
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/f380b7e89cfd2cff451278796a12ba726e52ce29 commit f380b7e89cfd2cff451278796a12ba726e52ce29 Author: Micah Morton <mortonm@chromium.org> Date: Mon Oct 15 23:01:46 2018 shill: reenable shill sandboxing switch via chrome flag We added a hard-coded line into shill.sh to make sure shill never ran in a sandbox, so we could uprev chrome after changing the default behavior for the ShillSandboxing flag (true->false). See crbug.com/891338 . This has been resolved by uprevving chrome, so were taking this line out. TEST=modify init script on dut and see switch controlling sandbox BUG= chromium:891338 Change-Id: I8380c2a553f03fa07c84239554b099378989414d Reviewed-on: https://chromium-review.googlesource.com/1277897 Commit-Ready: Micah Morton <mortonm@chromium.org> Tested-by: Micah Morton <mortonm@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> [modify] https://crrev.com/f380b7e89cfd2cff451278796a12ba726e52ce29/shill/init/shill.sh
,
Oct 18
CL in c#17 should go back to M71 so we can continue to test this feature on M71 images.
,
Oct 19
Your change meets the bar and is auto-approved for M71. Please go ahead and merge the CL to branch 3578 manually. Please contact milestone owner if you have questions. Owners: benmason@(Android), kariahda@(iOS), kbleicher@(ChromeOS), govind@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 22
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/platform2/+/39bd2f0e63d85ba0a9a7d2155a53220cd7589445 commit 39bd2f0e63d85ba0a9a7d2155a53220cd7589445 Author: Micah Morton <mortonm@chromium.org> Date: Mon Oct 22 21:32:55 2018 shill: reenable shill sandboxing switch via chrome flag We added a hard-coded line into shill.sh to make sure shill never ran in a sandbox, so we could uprev chrome after changing the default behavior for the ShillSandboxing flag (true->false). See crbug.com/891338 . This has been resolved by uprevving chrome, so were taking this line out. TEST=modify init script on dut and see switch controlling sandbox BUG= chromium:891338 Change-Id: I8380c2a553f03fa07c84239554b099378989414d Reviewed-on: https://chromium-review.googlesource.com/1277897 Commit-Ready: Micah Morton <mortonm@chromium.org> Tested-by: Micah Morton <mortonm@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> (cherry picked from commit f380b7e89cfd2cff451278796a12ba726e52ce29) Reviewed-on: https://chromium-review.googlesource.com/c/1291929 Commit-Queue: Micah Morton <mortonm@chromium.org> Trybot-Ready: Micah Morton <mortonm@chromium.org> [modify] https://crrev.com/39bd2f0e63d85ba0a9a7d2155a53220cd7589445/shill/init/shill.sh
,
Oct 23
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 23
|
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by sammiequon@chromium.org
, Oct 2