Connection requests to saucy server VMs from a hosts fail after fresh preseeded VM installs

Bug #1202203 reported by Para Siva
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
isc-dhcp (Ubuntu)
Fix Released
High
Unassigned

Bug Description

Reporting a new bug since the fix for bug 1197484, as suspected, did not fix the issue. I am reporting again against isc-dhcp but the issue appeared for the first time when Linux version 3.10.0-2-generic was first used. Also, using utah this is easily reproducible irrespective of the host ( confirmed on precise and raring hosts) and appears to only happen during the first boot after the installation. I say this because, I tried to reboot an impacted VM a number of times (after sudo ifdown eth0 and sudo ifup eth0) but could not reproduce the issue. Logging into an impacted system, running ifconfig does not list an ipv4 address for eth0, when the issue occurs.

Summary of the issue:
The ssh/ ping requests from the host to the client VMs of preseeded saucy server installations fail on first reboot after fresh installations of 20130703 images onwards. The ping requests to the IP address allocated to the VMs during the installations fail with 'Destination Host Unreachable'. There does not appear to be anything wrong during installations.
The VMs use libvirt/KVM and using bridged interface. This issue happens not always but most of the time. With isc-dhcp - 4.2.4-7ubuntu3 we do NOT see the 'dhclient: execve (/sbin/dhclient-script, ...): Permission denied' in the boot log but still see

Jul 17 03:59:55 utah-11601-saucy-server-i386 kernel: [ 13.514969] type=1400 audit(1374047995.545:11): apparmor="DENIED" operation="file_mmap" parent=488 profile="/sbin/dhclient" name="/bin/bash" pid=591 comm="dhclient-script" requested_mask="m" denied_mask="m" fsuid=0 ouid=0

The installer syslog and boot log of one of the latest failures are attached.

==============================================
How to reproduce:
1. Install utah using
   sudo apt-add-repository -y ppa:utah/stable
   sudo apt-get update
   sudo apt-get install utah

2. Now run the installation test using
sudo -u utah -i run_utah_tests.py -i /path/to/saucy-server-amd64.iso -p lp:ubuntu-test-cases/server/preseeds/mail-server.preseed lp:ubuntu-test-cases/server/runlists/mail-server.run -x /etc/utah/bridged-network-vm.xml

3. Now it could be seen that the the connection to the VMs from the host after the installation fails.

Related branches

Revision history for this message
Para Siva (psivaa) wrote :
Revision history for this message
Para Siva (psivaa) wrote :
Para Siva (psivaa)
description: updated
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Note that this:
Jul 17 03:59:55 utah-11601-saucy-server-i386 kernel: [ 13.514969] type=1400 audit(1374047995.545:11): apparmor="DENIED" operation="file_mmap" parent=488 profile="/sbin/dhclient" name="/bin/bash" pid=591 comm="dhclient-script" requested_mask="m" denied_mask="m" fsuid=0 ouid=0

is a different denial than in bug #1197484. Bug #1197484 denied 'r' access, this is denying 'm' access. Can you boot/test with apparmor=0 to take apparmor completely out of the equation?

Revision history for this message
Para Siva (psivaa) wrote :

So the bug could not be reproduced in a number of runs with preseeds having the following late command to disable apparmor

d-i preseed/late_command string in-target sed -i 's/quiet/quiet apparmor=0/' /boot/grub/grub.cfg

Changed in isc-dhcp (Ubuntu):
importance: Undecided → High
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Sigh. I cannot reproduce this and code inspection does not reveal why the access is needed. I'll adjust the profile but if someone can reproduce this in another environment and document the steps to reproduce, that would be immensely appreciated.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package isc-dhcp - 4.2.4-7ubuntu4

---------------
isc-dhcp (4.2.4-7ubuntu4) saucy; urgency=low

  * debian/apparmor-profile.dhclient: allow 'm' of /bin/bash (LP: #1202203)
 -- Jamie Strandboge <email address hidden> Thu, 18 Jul 2013 16:59:08 -0500

Changed in isc-dhcp (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.