interfaces: add socketcall() to the network/network-bind interfaces #1251

Merged
merged 3 commits into from Jun 2, 2016

Conversation

Projects
None yet
2 participants
Collaborator

mvo5 commented Jun 1, 2016

Upon investigating the autopkgtest failure of snapd on i386 (https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/i386/s/snapd/20160519_224511@/log.gz) I found that we get a seccomp denial for syscall 102 which is:

$ scmp_sys_resolver 102
socketcall

Running the test with this branch via CGO_ENABLED=1 GOARCH=386 go run integration-tests/main.go --ip localhost -port 11022 --filter networkBindInterfaceSuite --snappy-from-branch make the integration tests work on i386.

Some more changes were needed because the failure mode of the network integration tests now include getting killed from seccomp. So instead of using c.ExecCommand() I switched to c.ExecCommandErr() where failures are expected.

mvo5 added some commits Jun 1, 2016

Make network-consumer fail with exitcode 1 on error
and adjust the tests to check for cli.ExecCommandErr() when failures
from the consumer are expected. The rational is that on i386 the
syscall "socketcall" is used and if the interface is not available
the network-consumer gets killed because of seccomp violations.

The previous code was checking for error output only and got
confused by non-zero exit states.
Contributor

jdstrand commented Jun 1, 2016

@tyhicks - we said before that since --devmode is available as well as a workaround for people to adjust the filter directly for testing confinement, we would not allow socketcall and instead wait on the seccomp changes which is high priority but behind other high priority work. However, now socketcall is getting in the way of integration tests. Unless we add new code to add socketcall conditionally, I think we have to allow this now. The nice thing though is that with these integration tests we have an easy way to make sure we don't regress when removing socketcall again with the new seccomp.

Contributor

jdstrand commented Jun 2, 2016

Please feel free to commit the change and we'll undo it in a future commit.

@mvo5 mvo5 merged commit 257cdc7 into snapcore:master Jun 2, 2016

3 checks passed

Integration tests Success
Details
autopkgtest Success
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment