Tsuru kernel errors in syslog

[sroze]

I have a lot of tsuru kernel logs such as:

Dec  3 12:41:52 tsuru kernel: [77221.777874] type=1400 audit(1417606912.021:180291): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:41:52 tsuru kernel: [77221.780337] type=1400 audit(1417606912.025:180292): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:41:52 tsuru kernel: [77221.780800] type=1400 audit(1417606912.025:180293): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:41:55 tsuru kernel: [77225.293067] audit_printk_skb: 105 callbacks suppressed
Dec  3 12:41:55 tsuru kernel: [77225.293075] type=1400 audit(1417606915.537:180329): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:42:00 tsuru kernel: [77230.297287] type=1400 audit(1417606920.537:180330): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:42:00 tsuru kernel: [77230.298622] type=1400 audit(1417606920.537:180331): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:42:00 tsuru kernel: [77230.299892] type=1400 audit(1417606920.537:180332): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"
Dec  3 12:42:00 tsuru kernel: [77230.301529] type=1400 audit(1417606920.541:180333): apparmor="DENIED" operation="ptrace" profile="docker-default" pid=7356 comm="circusd" requested_mask="trace" denied_mask="trace" peer="docker-default"

Anybody knows what's the problem here ?

[morpheu]

Yes, it's a docker issue already reported here: moby/moby#7276

[morpheu]

Already fixed with commit moby/moby@aab89e8 - adds ptrace rule to allow ptracing ourselves - but not released yet.

[sroze]

Thanks !

[jonaskac]

Hey!
Is there a working solution for this? The docker solution doesn't seem to have been release yet, and this is making my system to feel like jelly.

[morpheu]

Unfortunately, no :( Even if you manually edit apparmor docker policy,
docker will always rewrite it on restart.

On Wed, Jan 7, 2015 at 8:24 PM, Jonas Kac notifications@github.com wrote:

Hey!
Is there a working solution for this? The docker solution doesn't seem to
have been release yet, and this is making my system to feel like jelly.

—
Reply to this email directly or view it on GitHub
#997 (comment).

[jonaskac]

Thanks @morpheu!

[morpheu]

Starting with docker 1.3.0, there is an extra option on docker run, --security-opt, which allow us to choose a different apparmor profile other than docker default built in. Tsuru should support an extra option on conf for docker apparmor profile. According with ptrace docker issue, we just need to create a profile based on docker default including "ptrace peer=@{profile_name}" - I tested it and works fine :)