Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #56011 > unrolled thread

Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run

Back to article view | Back to linux.debian.kernel

Contents

  Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run Olaf Meeuwissen <olaf.meeuwissen@avasys.jp> - 2016-12-06 05:10 +0100
    Bug#847154: marked as done (linux-image-amd64: Disabling vsyscall  interface may break docker run) owner@bugs.debian.org (Debian Bug Tracking System) - 2016-12-06 11:10 +0100
    Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run Ian Campbell <ijc@debian.org> - 2016-12-06 15:30 +0100
      Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run Olaf Meeuwissen <olaf.meeuwissen@avasys.jp> - 2016-12-07 00:50 +0100
    Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run Ben Hutchings <ben@decadent.org.uk> - 2016-12-06 15:30 +0100
    Processed: Re: linux-image-amd64: Disabling vsyscall interface  may break docker run owner@bugs.debian.org (Debian Bug Tracking System) - 2016-12-18 04:00 +0100

#56011 — Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run

Package: linux-image-amd64
Version: 4.8+76
Severity: wishlist

Dear Maintainer,

You may want to add to the NEWS blurb that disabling the old 'virtual
syscall' interface can lead to crashes when trying to run a Docker
container.  With upstream's docker-engine-1.12.3-0~stretch, I see

  docker run -it --rm centos:6.8 /bin/bash

exit with a 139 status (and may leave a core file).  Adding a

  vsyscall=emulate

to the kernel parameters fixed this for me.

When using the centos:7 image, this problem does not occur.
On 4.7.0-1-amd64, both centos:6.8 and centos:7 Docker images work
without any problems.

Seeing that the centos:7 image works fine, I am inclined to think that
this problem may be limited to older Docker images.  I have not done any
research to back this up, nor do I plan to.

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable-updates'), (500, 'unstable'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.8.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=ja_JP.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages linux-image-amd64 depends on:
ii  linux-image-4.8.0-1-amd64  4.8.7-1

linux-image-amd64 recommends no packages.

linux-image-amd64 suggests no packages.

-- no debconf information

Hope this helps,
--
Olaf Meeuwissen, LPIC-2       FLOSS Engineer -- EPSON AVASYS CORPORATION
       Free Software Foundation Associate Member since 2004-01-27
    Support Free Software                  https://my.fsf.org/donate
    Join the Free Software Foundation        https://my.fsf.org/join

[toc] | [next] | [standalone]

#56014 — Bug#847154: marked as done (linux-image-amd64: Disabling vsyscall interface may break docker run)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Tue, 06 Dec 2016 10:02:11 +0000
with message-id <1481018531.4509.120.camel@debian.org>
and subject line Re: Bug#847154: linux-image-amd64: Disabling vsyscall interface may break docker run
has caused the Debian Bug report #847154,
regarding linux-image-amd64: Disabling vsyscall interface may break docker run
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
847154: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847154
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#56017

On Tue, 2016-12-06 at 14:17 +0000, Ben Hutchings wrote:
> 
> But perhas we should more explicit in this message, e.g.:
> 
> "This breaks (e)glibc 2.13 and earlier, which may still be installed in
> a chroot or container environment based on Debian 7, RHEL/CentOS 6 or
> earlier versions."

That's a good idea!

Ian.

[toc] | [prev] | [next] | [standalone]

#56024

Ian Campbell writes:

> On Tue, 2016-12-06 at 14:17 +0000, Ben Hutchings wrote:
>> 
>> But perhas we should more explicit in this message, e.g.:
>> 
>> "This breaks (e)glibc 2.13 and earlier, which may still be installed in
>> a chroot or container environment based on Debian 7, RHEL/CentOS 6 or
>> earlier versions."
>
> That's a good idea!

And is what I actually wanted to achieve because the message as is did
not make this "obvious" for me.  Sorry for not being clear.

@Ian Thanks for the pointers, will have a look.
-- 
Olaf Meeuwissen, LPIC-2       FLOSS Engineer -- EPSON AVASYS CORPORATION
       Free Software Foundation Associate Member since 2004-01-27
    Support Free Software                  https://my.fsf.org/donate
    Join the Free Software Foundation        https://my.fsf.org/join

[toc] | [prev] | [next] | [standalone]

#56018

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2016-12-06 at 10:02 +0000, Ian Campbell wrote:
> On Tue, 2016-12-06 at 12:56 +0900, Olaf Meeuwissen wrote:
> > You may want to add to the NEWS blurb that disabling the old 'virtual
> > syscall' interface can lead to crashes when trying to run a Docker
> > container.  With upstream's docker-engine-1.12.3-0~stretch, I see
> 
> This was also reported as #845085 against docker.io.
> 
> Ben mentioned somewhere that NEWS is not displayed for newly installed
> packages (such as linux-image-$ABI) and so the message is instead part
> of the NEWS in the meta package:
>
> $ zcat /usr/share/doc/linux-image-amd64/NEWS.Debian.gz | head -n18
> linux-latest (76) unstable; urgency=medium
> 
>   * From Linux 4.8, several changes have been made in the kernel
>     configuration to 'harden' the system, i.e. to mitigate security bugs.
>     Some changes may cause legitimate applications to fail, and can be
>     reverted by run-time configuration:
>     - On 64-bit PCs (amd64), the old 'virtual syscall' interface is
>       disabled.  This breaks (e)glibc 2.13 and earlier.  To re-enable it,
>       set the kernel parameter: vsyscall=emulate
>     - On most architectures, the /dev/mem device can no longer be used to
>       access devices that also have a kernel driver.  This breaks dosemu
>       and some old user-space graphics drivers.  To allow this, set the
>       kernel parameter: iomem=relaxed
>     - The kernel log is no longer readable by unprivileged users.  To
>       allow this, set the sysctl: kernel.dmesg_restrict=0
> 
> >  -- Ben Hutchings <ben@decadent.org.uk>  Sat, 29 Oct 2016 02:05:32 +0100
> 
> $
> 
> This was also displayed for me just now on upgrade of linux-image-amd64 
> from 4.7+75 to 4.8+76. Since this is already present in the version you
> reported the wishlist issue against I'm closing with this mail.
[...]

But perhas we should more explicit in this message, e.g.:

"This breaks (e)glibc 2.13 and earlier, which may still be installed in
a chroot or container environment based on Debian 7, RHEL/CentOS 6 or
earlier versions."

Ben.

-- 
Ben Hutchings
I'm always amazed by the number of people who take up solipsism because
they heard someone else explain it. - E*Borg on alt.fan.pratchett

[toc] | [prev] | [next] | [standalone]

#56276 — Processed: Re: linux-image-amd64: Disabling vsyscall interface may break docker run

Processing control commands:

> reassign -1 src:linux 4.8.4-1~exp1
Bug #847154 [linux-image-amd64] linux-image-amd64: Disabling vsyscall interface may break docker run
Bug reassigned from package 'linux-image-amd64' to 'src:linux'.
No longer marked as found in versions linux-latest/76.
Ignoring request to alter fixed versions of bug #847154 to the same values previously set
Bug #847154 [src:linux] linux-image-amd64: Disabling vsyscall interface may break docker run
Marked as found in versions linux/4.8.4-1~exp1.
> tag -1 pending
Bug #847154 [src:linux] linux-image-amd64: Disabling vsyscall interface may break docker run
Added tag(s) pending.

-- 
847154: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847154
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web