rpm-ostree: wireshark post scriptlet fails due to udevadm trigger

[akshayshah1]

Describe the bug
An update from version 32.20201104.3.0 (stable) to 33.20201201.3.0 (stable) with overlay package wireshark-cli fails

Reproduction steps
Steps to reproduce the behavior:

1. Boot up 32.20201104.3.0 (stable) with ignition attached below
2. rpm-ostree install wireshark-cli
3. systemctl reboot
4. rpm-ostree deploy 33.20201201.3.0 (to update)

Expected behavior
ostree deployment successful

Actual behavior

[root@linux ~]# rpm-ostree deploy 33.20201201.3.0 
Resolving version '33.20201201.3.0'
1 metadata, 0 content objects fetched; 592 B transferred in 1 seconds; 0 bytes content written
1 metadata, 0 content objects fetched; 592 B transferred in 0 seconds; 0 bytes content written
Checking out tree cad8008... done
Enabled rpm-md repositories: updates fedora
rpm-md repo 'updates' (cached); generated: 2020-12-21T01:20:13Z
rpm-md repo 'fedora' (cached); generated: 2020-10-19T23:27:19Z
Importing rpm-md... done
Resolving dependencies... done
Checking out packages... done
Running pre scripts... done
Running post scripts... done
error: Running %post for wireshark-cli: Executing bwrap(/bin/sh): Child process killed by signal 1; run `journalctl -t 'rpm-ostree(wireshark-cli.post)'` for more information
[root@linux ~]# journalctl -t 'rpm-ostree(wireshark-cli.post)'
-- Logs begin at Fri 2020-10-02 06:59:09 UTC, end at Mon 2020-12-21 05:18:00 UTC. --
Dec 21 05:13:11 linux rpm-ostree(wireshark-cli.post)[6993]: Failed to write 'change' to '/sys/devices/virtual/usbmon/usbmon0/uevent': Read-only file system

System details

• VMware ESXi virtual machine.

NAME=Fedora
VERSION="32.20201104.3.0 (CoreOS)"
ID=fedora
VERSION_ID=32
VERSION_CODENAME=""
PLATFORM_ID="platform:f32"
PRETTY_NAME="Fedora CoreOS 32.20201104.3.0"
ANSI_COLOR="0;34"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:32"
HOME_URL="https://getfedora.org/coreos/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora-coreos/"
SUPPORT_URL="https://github.com/coreos/fedora-coreos-tracker/"
BUG_REPORT_URL="https://github.com/coreos/fedora-coreos-tracker/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=32
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=32
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="CoreOS"
VARIANT_ID=coreos
OSTREE_VERSION='32.20201104.3.0'

Ignition config

{"ignition": {"version": "3.1.0"}, "passwd": {"users": [{"name": "root", "sshAuthorizedKeys": [<keys>]}]}, "storage": {"files": [{"overwrite": true, "path": "/etc/zincati/config.d/90-disable-feature.toml", "contents": {"source": "data:,%23%20Disable%20auto-updates.%0A%5Bupdates%5D%0A%0Aenabled%20%3D%20false%0A"}, "mode": 420}, {"overwrite": true, "path": "/etc/NetworkManager/system-connections/eth0.nmconnection", "contents": {"source": "data:,%5Bconnection%5D%0Aid%3DWired%20Connection%0Atype%3Dethernet%0A%0A%5Bipv4%5D%0Amethod%3Dauto"}, "mode": 384}]}}

[lucab]

Thanks for the report!
This seems to be due to the /usr/bin/udevadm trigger --subsystem-match=usbmon performed by the scriplet, however I'm not sure why this started failing only recently.

[dustymabe]

Thanks for the report!
This seems to be due to the /usr/bin/udevadm trigger --subsystem-match=usbmon performed by the scriplet, however I'm not sure why this started failing only recently.

Maybe rpm-ostree started executing scriptlets more confined?

[jlebon]

Hmm, yeah I've seen this before in other RPMs which use udevadm. IIRC, this is likely due to a change in udevadm which now treats these errors as fatal. Anyway, I think what we need here is for Wireshark to not do that if udevd isn't available: https://src.fedoraproject.org/rpms/wireshark/pull-request/5

[akshayshah1]

Hi!
Thanks for the PR on the wireshark rpm

Is there any way meanwhile I can get around this problem by maybe ignoring the error or excluding wireshark from the Fedora CoreOS update? Basically want to update the OS even if it means wireshark doesn't get updated.

[jlebon]

Can you use Wireshark from a privileged container instead? Then you can rpm-ostree uninstall wireshark-cli and update.