{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/6519","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/6519/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/6519/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/6519/events","html_url":"https://github.com/systemd/systemd/issues/6519","id":247452802,"number":6519,"title":"systemd-journald-audit.socket vs lxd","user":{"login":"xnox","id":19779,"avatar_url":"https://avatars1.githubusercontent.com/u/19779?v=4","gravatar_id":"","url":"https://api.github.com/users/xnox","html_url":"https://github.com/xnox","followers_url":"https://api.github.com/users/xnox/followers","following_url":"https://api.github.com/users/xnox/following{/other_user}","gists_url":"https://api.github.com/users/xnox/gists{/gist_id}","starred_url":"https://api.github.com/users/xnox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xnox/subscriptions","organizations_url":"https://api.github.com/users/xnox/orgs","repos_url":"https://api.github.com/users/xnox/repos","events_url":"https://api.github.com/users/xnox/events{/privacy}","received_events_url":"https://api.github.com/users/xnox/received_events","type":"User","site_admin":false},"labels":[{"id":219549857,"url":"https://api.github.com/repos/systemd/systemd/labels/journal","name":"journal","color":"d4c5f9","default":false},{"id":191919611,"url":"https://api.github.com/repos/systemd/systemd/labels/needs-discussion","name":"needs-discussion","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-08-02T16:43:25Z","updated_at":"2017-08-14T08:16:58Z","closed_at":null,"body":"### Submission type\r\n\r\n - Bug report\r\n\r\n### systemd version the issue has been seen with\r\n\r\n234\r\n\r\n### Used distribution\r\n\r\nUbuntu\r\n\r\n### In case of bug report: Expected behaviour you didn't see\r\n\r\nSystem boots non-degraded\r\n\r\n### In case of bug report: Unexpected behaviour you saw\r\n\r\nSystem boots degraded, status of systemd-journald-audit.socket is failed Result: resources\r\n\r\n### In case of bug report: Steps to reproduce the problem\r\n\r\nOn Ubuntu:\r\n$ lxc launch ubuntu-daily:a degradedboot\r\n$ lxc exec degradedboot bash\r\n$ systemctl status systemd-journald-audit.socket\r\n\r\n....\r\nThe container in question, is apparmor protected unpriviledged (user namespaced) lxd container (systemd-virt-detect lxc).\r\n\r\nI did manual check as mentioned in https://github.com/systemd/systemd/pull/6508#issuecomment-319667527 and there is no errno set, and fd 4 is opened.\r\n\r\nTo debug this further, I have tweaked .socket unit to actaully be related to some other unit, rather than be before systemd-journald, as otherwise there are no useful logs to see why starting the socket unit failed.\r\n\r\nHere are more detailed logs:\r\n\r\n```\r\n# systemctl status systemd-journald-audit.socket\r\n● systemd-journald-audit.socket - Journal Audit Socket\r\n   Loaded: loaded (/lib/systemd/system/systemd-journald-audit.socket; static; vendor preset: enabled)\r\n   Active: failed (Result: resources)\r\n     Docs: man:systemd-journald.service(8)\r\n           man:journald.conf(5)\r\n   Listen: audit 1 (Netlink)\r\n\r\nAug 02 16:08:19 normal systemd[1]: systemd-journald-audit.socket: Enqueued job systemd-journald-audit.socket/stop as 594\r\nAug 02 16:08:19 normal systemd[1]: systemd-journald-audit.socket: Job systemd-journald-audit.socket/stop finished, result=done\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: Trying to enqueue job systemd-journald-audit.socket/start/replace\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: Installed new job systemd-journald-audit.socket/start as 659\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: Enqueued job systemd-journald-audit.socket/start as 659\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: ConditionCapability=CAP_AUDIT_READ succeeded.\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: ConditionSecurity=audit succeeded.\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: Failed to listen on sockets: Operation not permitted\r\nAug 02 16:08:23 normal systemd[1]: systemd-journald-audit.socket: Job systemd-journald-audit.socket/start finished, result=failed\r\nAug 02 16:08:23 normal systemd[1]: Failed to listen on Journal Audit Socket.\r\n```\r\nWhich means we get `EPERM` upon `bind` call. And on the host I get\r\n\r\n```\r\n[2956447.961322] audit: type=1400 audit(1501690831.694:2170): apparmor=\"DENIED\" operation=\"file_lock\" profile=\"lxd-normal_</var/lib/lxd>\" pid=8307 comm=\"(t-daemon)\" family=\"unix\" sock_type=\"dgram\" protocol=0 addr=none\r\n```\r\nI'm trying to resolve a user experience issue of default container comming up degraded. Thus at the moment I have no preference on how to solve this.\r\n\r\nFrom above. Should the audit checks try to bind() and watch for EPERM comming from LSM? Or for example, should the host LSM (apparmor) rules be tightened to prevent opening NETLINK_AUDIT if one will not be able to bind to it? By default lxd doesn't limit / filter capabilities that are available in the container.\r\n\r\nPlease advise best strategy. And I'll ping lxd / apparmor people to read this bug report - despite this not being neither lxd nor apparmor bug tracker. Somehow I suspect that this can be fixed in either of the three projects. And all three can point fingers at the other =)\r\n\r\nAlso as a side note, if audit-fd was not passed to journald, it will try to open it, but it will ignore failing it. Thus maybe audit.socket unit can be adjusted to somehow be \"non-fatal\" to not cause degraded state if and when bind() fails for it. However, ideally in above scenario audit.socket unit should not be started at all given, in a way, it is known in advance it will fail for this user case."},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/322127310","html_url":"https://github.com/systemd/systemd/issues/6519#issuecomment-322127310","issue_url":"https://api.github.com/repos/systemd/systemd/issues/6519","id":322127310,"user":{"login":"xnox","id":19779,"avatar_url":"https://avatars1.githubusercontent.com/u/19779?v=4","gravatar_id":"","url":"https://api.github.com/users/xnox","html_url":"https://github.com/xnox","followers_url":"https://api.github.com/users/xnox/followers","following_url":"https://api.github.com/users/xnox/following{/other_user}","gists_url":"https://api.github.com/users/xnox/gists{/gist_id}","starred_url":"https://api.github.com/users/xnox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xnox/subscriptions","organizations_url":"https://api.github.com/users/xnox/orgs","repos_url":"https://api.github.com/users/xnox/repos","events_url":"https://api.github.com/users/xnox/events{/privacy}","received_events_url":"https://api.github.com/users/xnox/received_events","type":"User","site_admin":false},"created_at":"2017-08-14T08:16:58Z","updated_at":"2017-08-14T08:16:58Z","body":"The plan is to piggyback onto user namespace and thus be transparent. But indeed that is speculation, until all merged and stable. And it has been \"worked on\" for a while now. Thus no expectations as to when audit namespacing will land."}}
{"actor":{"display_login":"xnox"}}