From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751001AbdJCGs4 (ORCPT ); Tue, 3 Oct 2017 02:48:56 -0400 Received: from mx2.suse.de ([195.135.220.15]:33505 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750720AbdJCGsz (ORCPT ); Tue, 3 Oct 2017 02:48:55 -0400 Subject: Re: regression in 4.14-rc2 caused by apparmor: add base infastructure for socket mediation To: James Bottomley , John Johansen , Seth Arnold Cc: linux-kernel References: <1507003338.3174.4.camel@HansenPartnership.com> <1507007707.3082.16.camel@HansenPartnership.com> From: Vlastimil Babka Message-ID: <5d57381f-e915-1b8f-7838-eba46ab89f34@suse.cz> Date: Tue, 3 Oct 2017 08:48:53 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <1507007707.3082.16.camel@HansenPartnership.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/03/2017 07:15 AM, James Bottomley wrote: > On Mon, 2017-10-02 at 21:11 -0700, John Johansen wrote: >> On 10/02/2017 09:02 PM, James Bottomley wrote: >>> >>> The specific problem is that dnsmasq refuses to start on openSUSE >>> Leap 42.2.  The specific cause is that and attempt to open a >>> PF_LOCAL socket gets EACCES.  This means that networking doesn't >>> function on a system with a 4.14-rc2 system. >>> >>> Reverting commit 651e28c5537abb39076d3949fb7618536f1d242e >>> (apparmor: add base infastructure for socket mediation) causes the >>> system to function again. >>> >> >> This is not a kernel regression, > > Regression means something that worked in a previous version of the > kernel which is broken now. This problem falls within that definition. Hm, but if this was because opensuse kernel and apparmor rules relied on an out-of-tree patch, then it's not an upstream regression? >> it is because  opensuse dnsmasque is starting with policy that >> doesn't allow access to PF_LOCAL socket > > Because there was no co-ordination between their version of the patch > and yours.  If you're sending in patches that you know might break > systems because they need a co-ordinated rollout of something in > userspace then it would be nice if you could co-ordinate it ... > > Doing it in the merge window and not in -rc2 would also be helpful > because I have more expectation of a userspace mismatch from stuff in > the merge window. Agree, but with rc2 there's still plenty of time, and running rcX means some issues can be expected... >> Christian Boltz the opensuse apparmor maintainer has been working >> on a policy update for opensuse see bug >> >> https://bugzilla.opensuse.org/show_bug.cgi?id=1061195 > > Well, that looks really encouraging: The line about "To give you an > impression what "lots of" means - I had to adjust 40 profiles on my > laptop".  The upshot being apart from a bandaid, openSUSE still has no > co-ordinated fix for this. Note that the openSUSE Leap 42.2 kernel is 4.4, so by running 4.14 means you are unsupported from the distro POV and you can't expect that the 42.2 apparmor profiles will ever be updated. I reported the bug above for the Tumbleweed rolling distro, which gets new kernels after the final version is released and passes QA. rcX kernels are packaged for testing, but you have to add the repo explicitly. So there's still enough time to co-ordinate fix of profiles and final 4.14 even for Tumbleweed. > James >