1. 10 Dec, 2021 9 commits
    • Kirill Smelkov's avatar
      golang += patches to fix tests under user namespaces · 71ced145
      Kirill Smelkov authored
      If we enter user namespace via regular unshare without help from SUID
      newuidmap/newgidmap, all supplementary groups are mapped to -1. As the result
      when Go test tries to chown to a supplementary group, it gets EINVAL:
      
      https://github.com/golang/go/issues/42525
      
      -> work it around with patch to skip this chown tests.
      
      A more proper, longer-term fix would be to fix Linux kernel to allow writes to
      /proc/self/gid_map to setup mapping not only to original gid, but to all
      original supplementary groups as well here:
      
      https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/user_namespace.c?id=v5.16-rc4-0-g0fcfb00b28c0#n1143
      
      this fix, even if accepted by upstream, would be long to be waited for to
      propagate to distribution kernels that we currently use. So we go with this
      workaround for now.
      
      --------
      
      Another patch is to fix the following TestSCMCredentials failure:
      
          === RUN   TestSCMCredentials
              creds_test.go:81: WriteMsgUnix failed with invalid argument, want EPERM
          --- FAIL: TestSCMCredentials (0.00s)
      
      There the code tries to send uid0/gid0 credentials from non-zero uid and
      expects EPERM reject from kernel. However under `unshare -Umc` uid0/gid0 are
      not mapped to anywhere and so implicitly map to -1 and are rejected with EINVAL
      by the kernel.
      
      /reviewed-by @jerome
      /reviewed-on nexedi/slapos!1095
      71ced145
    • Kirill Smelkov's avatar
      component/nxdtest: Prepare for nexedi/nxdtest!13 (II) · 0fcadfbd
      Kirill Smelkov authored
      4) Hook in python-prctl, as it becomes nxdtest dependency: see
         nexedi/nxdtest!13 (79d13eff)
      
      /reviewed-by @jerome
      /reviewed-on nexedi/slapos!1095
      0fcadfbd
    • Kirill Smelkov's avatar
      component/nxdtest: Prepare for nexedi/nxdtest!13 · e328aa49
      Kirill Smelkov authored
      Prepare for upcoming nxdtest changes to run each testcase with its own
      /tmp and /dev/shm:
      
      1) put unshare from SlapOS component into $PATH, so that our version is
         used even if OS provides /bin/unshare. As @jerome explains we need
         features that were added relatively recently and are missing in unshare
         on Debian 10: nexedi/nxdtest!13 (comment 146752)
      
         It is anyway better to "isolate" from OS by using our own component
         instead of system-provided one.
      
         Correspondingly adjust util-linux to enable unshare in its build.
      
      2) similarly to "1" adjust util-linux to enable mount so that our version
         is used instead of /bin/mount. For example on Debian 9, even if we
         successfully enter user/mount namespace with `unshare -Umc`
      
             /bin/mount -t tmpfs none /tmp
      
         complains that
      
             mount: only root can use "--types" option
      
         -> Fix it the same way as with unshare by forcing usage of
         SlapOS-provided mount.
      
      3) rework how nxdtest script is generated and split it into .nxdtest.pyexe and
         nxdtest itself. .nxdtest.pyexe is python interpreter via which nxdtest is run.
         This interpreter has all eggs required by nxdtest in sys.path, so that
         nxdtest could spawn its trun.py via sys.executable. If we don't care to have
         properly setup sys.executable, trun.py will fail when importing any module that
         nxdtest.py could already successfully import.
      
         Initially I tried to workaround this issue via adjusting $PYTHONPATH <-
         sys.path in main nxdtest script, but @jerome points out that, $PYTHONPATH,
         if set, also affects processes that trun.py spawns, which is not good:
      
         nexedi/slapos!1095 (comment 146799)
      
         -> so fix this via running nxdtest via environment where sys.executable is
         properly setup python interpreter with path for all eggs that nxdtest has
         access to.
      
         Because we already have half-way workarounds for similar problem in several
         places, and because running a script with correctly setup sys.executable is
         generally better, I would say it should be a good idea to rework
         zc.recipe.egg:scripts to generate all scripts to work this way, but I do not
         want to fight about it.
      
         So let's leave this scheme nxdtest-specific for now.
      
      /cc @tomo
      /helped-and-reviewed-by @jerome
      /reviewed-on nexedi/slapos!1095
      e328aa49
    • Thomas Gambier's avatar
      software/kvm: fix netconfig.sh and ipv6_config.sh scripts · 07439e2e
      Thomas Gambier authored
      When adding a route to an interface not up yet, "ip route" command fails
      with:
      
      Error: Device for nexthop is not up.
      
      So we need to up the device before adding the routes.
      07439e2e
    • Julien Muchembled's avatar
      version up: slapos.recipe.build 0.52 · 3836a13f
      Julien Muchembled authored
      This is a regression with 0.48 that prevented parts to be shared depending
      on which Python is used to run Python (whether it's version 2 or 3).
      3836a13f
    • Julien Muchembled's avatar
      3f75a3ff
    • Julien Muchembled's avatar
      ruby: drop versions 2.1 & 2.2 · 7162005a
      Julien Muchembled authored
      7162005a
    • Julien Muchembled's avatar
      openssh: use newer openssl · aa44579f
      Julien Muchembled authored
      aa44579f
    • Julien Muchembled's avatar
      version up: bash 5.1.12 · b9d4836c
      Julien Muchembled authored
      b9d4836c
  2. 09 Dec, 2021 2 commits
  3. 08 Dec, 2021 19 commits
  4. 07 Dec, 2021 1 commit
  5. 06 Dec, 2021 4 commits
  6. 03 Dec, 2021 5 commits