[Bug 1660268] Re: Apparmor blocks Firefox to access meminfo

2017-01-31 Thread Simon Déziel
@Thomas, how is this bug not a dup of LP: #1553758 that was opened before and contains the exact same Apparmor denial? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1660268 Title: Apparmor blocks Fi

Re: [Bug 1659922] Re: Firefox 51.0.1 does not display pages/shows blank pages.

2017-01-31 Thread Simon Déziel
On 2017-01-31 02:20 PM, Thomas Mayer wrote: > Why should all the distros do that independently? There's a lot of > redundancy which could be allocated elsewhere. Indeed but cross-distro compatibility is profiles as not every distro/release have the same feature set. For example, not all supported

Re: [Bug 1659922] Re: Firefox 51.0.1 does not display pages/shows blank pages.

2017-01-31 Thread Simon Déziel
On 2017-01-31 02:51 PM, Thomas Mayer wrote: > Ugly as it is, but mozilla could also maintain profiles for different > feature sets, or distros, respectively. > > But there's more: Different versions of FF with different requirements. > The only right place to keep track of that is in the source re

Re: [Bug 1495248] Re: usr.bin.firefox blocks /dev/shm

2017-01-31 Thread Simon Déziel
On 2017-01-31 05:46 PM, Jean-Philippe Guérard wrote: > I was able to reproduce the problem, but only using the flash plugin: > > Jan 31 23:38:34 tigreraye kernel: [221147.141240] audit: type=1400 > audit(1485902314.881:3406): apparmor="DENIED" operation="mknod" > profile="/usr/lib/firefox/firefo

[Bug 1661101] Re: Can't log in to Hotmail

2017-02-01 Thread Simon Déziel
This isn't a problem with Firefox. It seems like MS folks have not added the "www." prefix to their TLS certificate. Try going to https://hotmail.co.uk/ instead. ** Changed in: firefox (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu

[Bug 1661199] Re: Apt-cacher-ng fails on https repo

2017-02-02 Thread Simon Déziel
** Changed in: apt-cacher-ng (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1661199 Title: Apt-cacher-ng fails on https repo To manage notifications about this

[Bug 1661199] Re: Apt-cacher-ng fails on https repo

2017-02-02 Thread Simon Déziel
@wiredfool, this is the expected behavior and I ran into it as well. Since apt-cacher-ng cannot cache the HTTPS connection so it's refusing to proxy it. A possible workaround is to let it pass through apt-cacher- ng using a regex like that in the config file: # Required for HTTPS outbound PassThro

[Bug 1640826] Re: please evaluate enabling more plugins to make strongswan more useful

2016-11-10 Thread Simon Déziel
The eap-mschapv2 and xauth-generic plugins are both provided by libcharon-extra-plugins which is in main. It seems that you already split the TNC stuff off of libcharon-extra- plugins in https://git.launchpad.net/~paelzer/ubuntu/+source/strongswan/commit/?h =merge-zesty&id=4e1bbd943cb61de280ac9891

[Bug 1640826] Re: please evaluate enabling more plugins to make strongswan more useful

2016-11-10 Thread Simon Déziel
The eap-mschapv2 and xauth-generic plugins are both provided by libcharon-extra-plugins which is in main. It seems that you already split the TNC stuff off of libcharon-extra- plugins in https://git.launchpad.net/~paelzer/ubuntu/+source/strongswan/commit/?h =merge-zesty&id=4e1bbd943cb61de280ac9891

Re: [Bug 1640826] Re: please evaluate enabling more plugins to make strongswan more useful

2016-11-11 Thread Simon Déziel
What I'd like is for someone to install the strongswan package and have both plugins installed as "recommends" but without the TNC stuff. Debian/you took care of splitting out the TNC part so that's done already, thanks. The 2 plugins are currently in libcharon-extra-plugins [*] so I'd keep them t

[Bug 1546674] Re: virt-aa-helper Apparmor profile missing rules for name resolution

2016-11-14 Thread Simon Déziel
** Description changed: + Reproducing steps: + + 1) Sync Xenial cloud-image + uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily arch=amd64 label=daily release=xenial + + 2) Create a test guest with: + uvt-kvm create --memory 2048 --cpu 4 --password=ubuntu xenial-kerne

[Bug 1641618] [NEW] Apparmor denials caused by virt-aa-helper trying to read zvol devices (/dev/zdX) should be silenced

2016-11-14 Thread Simon Déziel
Public bug reported: Libvirt qemu-kvm guests backed by zvols (ZFS volumes) generate useless noise due to virt-aa-helper trying to read the backing device in the host (/dev/zdX). Other host's devs are already denied in virt-aa- helper's profile: # for hostdev /sys/devices/ r, /sys/devices/**

[Bug 1641564] Re: nginx service fails to start

2016-11-14 Thread Simon Déziel
@ehainry, nginx couldn't start because of this error in one of your site(s): nov. 14 10:48:06 aotearoa nginx[1035]: nginx: [emerg] host not found in upstream "api.football-data.org" in /etc/nginx/sites-enabled/mine:52 ** Changed in: nginx (Ubuntu) Status: New => Invalid -- You received t

[Bug 1546674] Re: virt-aa-helper Apparmor profile missing rules for name resolution

2016-11-14 Thread Simon Déziel
** Description changed: Reproducing steps: 1) Sync Xenial cloud-image uvt-simplestreams-libvirt sync --source http://cloud-images.ubuntu.com/daily arch=amd64 label=daily release=xenial 2) Create a test guest with: uvt-kvm create --memory 2048 --cpu 4 --password=ubuntu xenial-kerne

[Bug 1546674] Re: virt-aa-helper Apparmor profile missing rules for name resolution

2016-11-14 Thread Simon Déziel
It's not specific to zvols after all as I just setup a new hypervisor where I hand out host's partitions to the guests like this: This is enough to get virt-aa-helper to try reading /etc/nsswitch.conf, /etc/host.conf and /etc/gai.conf. -- You received this bug not

[Bug 1530610] Re: tmpfiles.d conflicting rules to manage /var/log

2016-11-14 Thread Simon Déziel
*** This bug is a duplicate of bug 1504659 *** https://bugs.launchpad.net/bugs/1504659 ** This bug has been marked a duplicate of bug 1504659 Duplicate line for path "/var/log" warning is shown when rsyslog is installed -- You received this bug notification because you are a member of Ubu

[Bug 1624164] Re: Possible missing firmware /lib/firmware/i915/kbl_dmc_ver1.bin for module i915_bpo

2017-01-13 Thread Simon Déziel
@thornyon, why did you marked this bug as fix released? As far as I can see, linux-firmware still doesn't ship kbl_dmc_ver1.bin. I'd like to benefit from lower power usage that should come with this firmware. -- You received this bug notification because you are a member of Ubuntu Bugs, which is

[Bug 1447500] Re: Ubuntu creates cluttered Petitboot menu entries

2017-01-13 Thread Simon Déziel
amd64 user here, this new package asks to remove grub-efi-amd64-signed, is that intended? # apt dist-upgrade --no-install-recommends Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages will be REMOVED:

[Bug 1447500] Re: Ubuntu creates cluttered Petitboot menu entries

2017-01-13 Thread Simon Déziel
Sorry for the noise, the packages arrived at different time on archive.ubuntu.com: grub-efi-amd64-signed_1.66.7+2.02~beta2-36ubuntu3.7_amd64.deb: 2017-01-13 17:48 grub-efi-amd64_2.02~beta2-36ubuntu3.7_amd64.deb : 2017-01-13 17:14 After updating again, everything looks good and no pac

[Bug 1657413] Re: Please enable mediation support for strongswan

2017-01-18 Thread Simon Déziel
** Bug watch added: Debian Bug tracker #851507 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851507 ** Also affects: strongswan (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851507 Importance: Unknown Status: Unknown -- You received this bug notification becaus

[Bug 1658198] [NEW] multi-level stacked qcow2 files are not properly handled in Apparmor

2017-01-20 Thread Simon Déziel
Public bug reported: If a guest uses a .qcow2 with more than one level of stacking, the Apparmor policy for the guest only authorizes access to the first backend file. The guest uses this drive: Here, the alice.qcow2 file is backed by root.qcow2 which is then back

[Bug 1658198] Re: multi-level stacked qcow2 files are not properly handled in Apparmor

2017-01-20 Thread Simon Déziel
** Description changed: If a guest uses a .qcow2 with more than one level of stacking, the Apparmor policy for the guest only authorizes access to the first backend file. The guest uses this drive: - - - - - + +    +    +    +

[Bug 1658198] Re: multi-level stacked qcow2 files are not properly handled in Apparmor

2017-01-24 Thread Simon Déziel
Thanks Jamie and Christian On 2017-01-23 09:33 AM, Jamie Strandboge wrote: > What I think is happening is that you are creating a qcow2 with the '-b' > option rather than using libvirt's 'snapshot' functionality. As such, > the backing store is unknown to libvirt so it doesn't know to add the > fi

[Bug 1641618] Re: Apparmor denials caused by virt-aa-helper trying to read zvol devices (/dev/zdX) should be silenced

2017-01-25 Thread Simon Déziel
Hi Christian, I was hoping for this to be SRU'ed to Xenial, when you have the time. I started filling the SRU justification but would appreciate your input for the regression potential section. Thanks. ** Description changed: - Libvirt qemu-kvm guests backed by zvols (ZFS volumes) generate useles

[Bug 1583515] Re: /usr/bin/env: ‘node’: No such file or directory

2017-03-07 Thread Simon Déziel
*** This bug is a duplicate of bug 1065598 *** https://bugs.launchpad.net/bugs/1065598 ** This bug has been marked a duplicate of bug 1065598 /usr/bin/env: node: No such file or directory -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to

[Bug 1065598] Re: /usr/bin/env: node: No such file or directory

2017-03-07 Thread Simon Déziel
To those running into that problem, the nodejs-legacy package provides the /usr/bin/node symlink. All you need to do is "apt-get install nodejs-legacy". -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/10

[Bug 1573307] Re: wget crashed with SIGSEGV in __memset_avx2()

2017-03-09 Thread Simon Déziel
** Tags removed: verification-needed ** Tags added: verification-done -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1573307 Title: wget crashed with SIGSEGV in __memset_avx2() To manage notificatio

[Bug 1728723] [NEW] postfix check warns about symlink being group writable

2017-10-30 Thread Simon Déziel
Public bug reported: On Xenial, "postfix check" complains like that: postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-tls.so.1 postfix/postfix-script: warning: group or other writable: /usr/lib/postfix/./libpostfix-util.so.1 postfix/postfix-script: warning

[Bug 1728723] Re: postfix check warns about symlink being group writable

2017-10-30 Thread Simon Déziel
Looking into git, this problem seem to have been introduced with the 3.0.0 release: $ git remote -v origin https://git.launchpad.net/postfix (fetch) origin https://git.launchpad.net/postfix (push) $ git show 5afd7bb2 -- conf/postfix-script | sed -n '59,81 p' + todo="$config_directory/." +

[Bug 1728723] Re: postfix check warns about symlink being group writable

2017-10-30 Thread Simon Déziel
** Bug watch added: Debian Bug tracker #880365 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880365 ** Also affects: postfix (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=880365 Importance: Unknown Status: Unknown -- You received this bug notification because

[Bug 1042771] Re: sanitized_helper prevents proper transition to other profiles

2017-10-27 Thread Simon Déziel
Maybe a fallback mechanism would be needed? Something like this: /usr/bin/evince (Px, Cxr -> sanitized_helper), -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1042771 Title: sanitized_helper preve

[Bug 1610500] Re: package pptpd 1.4.0-7ubuntu0.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2017-07-21 Thread Simon Déziel
** Description changed: [Impact] Users with pptpd will encounter errors when upgrading from 14.04->16.04. After the upgrade process, pptpd won't automatically start on boot. [Test case] 1. Setup a Trusty container - lxc launch ubuntu-daily:trusty foo +   lxc launch ubuntu-dail

[Bug 1610500] Re: package pptpd 1.4.0-7ubuntu0.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2017-07-21 Thread Simon Déziel
Christian, my reproduction steps were wrong, "do-release-upgrade --proposed" in a Trusty container won't work because this will only pull the upgrader from xenial-proposed and not pptpd. As such, there is no easy way to do a test release upgrade but you can fix a broken upgrade by installing 1.4.0-

[Bug 1610500] Re: package pptpd 1.4.0-7ubuntu0.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2017-07-21 Thread Simon Déziel
Christian, I finally found how to properly test the upgrade with the -proposed package (see the updated test case). ** Description changed: [Impact] Users with pptpd will encounter errors when upgrading from 14.04->16.04. After the upgrade process, pptpd won't automatically start on boot

[Bug 1610500] Re: package pptpd 1.4.0-7ubuntu0.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2017-07-21 Thread Simon Déziel
Marking as verified: # grep pptpd /var/log/dist-upgrade/screenlog.0 Get:434 http://archive.ubuntu.com/ubuntu/ xenial-proposed/main pptpd amd64 1.4.0-7ubuntu0.2 [74.5 kB] Get:435 http://archive.

[Bug 1610500] Re: package pptpd 1.4.0-7ubuntu0.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2017-07-24 Thread Simon Déziel
Christian, thanks for testing as well. As for the screen socket mode, do-release-upgrade asks for 777 and 775 it didn't work when I tried it (see https://paste.ubuntu.com/25165428/). Thanks again. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed t

[Bug 1601998] Re: /usr/bin/dpkg:6:do_internerr:deb_reassemble:process_archive:archivefiles:main

2017-10-25 Thread Simon Déziel
Verification worked on Xenial: # mkdir /tmp/cats # dpkg -i /tmp/cats dpkg-split: error: error reading /tmp/cats: Is a directory dpkg:../../src/unpack.c:123:deb_reassemble: internal error: unexpected exit status 2 from dpkg-split Aborted # apt-get dist-upgrade ... Setting up libdpkg-perl (1.18.4u

[Bug 1723900] Re: unbound systemctl (re)start fails due to Apparmor profile issue

2017-10-26 Thread Simon Déziel
@Seth, any chance to get that debdiff uploaded? Would be much appreciated. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1723900 Title: unbound systemctl (re)start fails due to Apparmor profile issu

[Bug 1042771] Re: sanitized_helper prevents proper transition to other profiles

2017-10-26 Thread Simon Déziel
Since Evince ships with an Apparmor profile on its own, I think the following fix makes sense: $ diff -Naur abstractions/ubuntu-browsers.d/productivity{.orig,} --- abstractions/ubuntu-browsers.d/productivity.orig2017-10-26 15:34:03.374102924 -0400 +++ abstractions/ubuntu-browsers.d/productivi

Re: [Bug 1723900] Re: unbound systemctl (re)start fails due to Apparmor profile issue

2017-10-26 Thread Simon Déziel
I'll hand around on #ubuntu-devel then, thanks Seth! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1723900 Title: unbound systemctl (re)start fails due to Apparmor profile issue To manage notificat

[Bug 1713787] Re: linux 4.4.0-93 triggers call traces

2017-08-30 Thread Simon Déziel
This really looks like https://patchwork.ozlabs.org/patch/799015/ which fortunately made it into 4.4.0-94.117. I'll give that -proposed kernel a test run. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 1713787] Re: linux 4.4.0-93 triggers call traces

2017-08-31 Thread Simon Déziel
*** This bug is a duplicate of bug 1711535 *** https://bugs.launchpad.net/bugs/1711535 4.4.0-94.117 has solved the problem so I'll mark this as a duplicate of LP: #1711535 (update to stable kernel 4.4.82). ** This bug has been marked a duplicate of bug 1711535 Xenial update to 4.4.82 stabl

[Bug 1185971] Re: Please enable all hardening features

2017-09-07 Thread Simon Déziel
Fixed at least in Xenial: $ hardening-check /usr/lib/thunderbird/thunderbird /usr/lib/thunderbird/thunderbird: Position Independent Executable: yes Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: yes $ apt-cac

[Bug 1711724] Re: Segfaults with dict

2017-09-07 Thread Simon Déziel
On Xenial, before: $ python3.5 bpo-27945.py Segmentation fault After applying 3.5.2-2ubuntu0~16.04.2: $ python3.5 bpo-27945.py Traceback (most recent call last): File "bpo-27945.py", line 7, in for result in d.items(): RuntimeError: dictionary changed size during iteration ** Tags rem

[Bug 1711724] Re: Segfaults with dict

2017-09-07 Thread Simon Déziel
On Zesty, before with python3.6: $ python3.6 /tmp/bpo-27945.py Segmentation fault After applying 3.6.1-1ubuntu0~17.04.0: $ python3.6 /tmp/bpo-27945.py Traceback (most recent call last): File "/tmp/bpo-27945.py", line 7, in for result in d.items(): RuntimeError: dictionary changed size d

[Bug 1710753] Re: Please upgrade Xenial/Zesty to use the latest LTS point release of Tor (0.2.9)

2017-09-07 Thread Simon Déziel
Verified on Xenial with the SRU test case (wget and SSH hidden service). $ sudo apt-get dist-upgrade -V ... The following packages will be upgraded: tor (0.2.7.6-1ubuntu1 => 0.2.9.11-1ubuntu1~16.04.1) tor-geoipdb (0.2.7.6-1ubuntu1 => 0.2.9.11-1ubuntu1~16.04.1) ** Tags removed: verification

[Bug 1709193] Re: Unable to use TLSv1.1 or 1.2 with OpenSSL compat layer

2017-09-08 Thread Simon Déziel
It's been a while since the Xenial -proposed package have been successfully validated. Is there anything preventing it from entering -updates? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1709193 Tit

[Bug 1709193] Re: Unable to use TLSv1.1 or 1.2 with OpenSSL compat layer

2017-09-08 Thread Simon Déziel
The Xenial fix is identical to what went in Artful and Zesty so it shouldn't be subject to any more review. The review was requested to check if the different fix proposed for Trusty was OK. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubu

[Bug 1709193] Re: Unable to use TLSv1.1 or 1.2 with OpenSSL compat layer

2017-09-08 Thread Simon Déziel
@juliank, thanks for the update. I wasn't aware of the autopkgtest failing for some reverse dependencies. Any pointers to those? I'm determined to see this one though, but on Monday ;) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. ht

[Bug 1709193] Re: Unable to use TLSv1.1 or 1.2 with OpenSSL compat layer

2017-09-08 Thread Simon Déziel
I see the NM one passes now, thanks for retrying it. The aria2 armhf problem reliably fails though. I guess I'll have to setup a QEMU VM for that arch and manually run the test to see what's going on. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscrib

[Bug 1711724] Re: Segfaults with dict

2017-09-08 Thread Simon Déziel
On Zesty, before with python3.5: $ python3.5 /tmp/bpo-27945.py Segmentation fault After applying 3.5.3-1ubuntu0~17.04.0: $ python3.5 /tmp/bpo-27945.py Traceback (most recent call last): File "/tmp/bpo-27945.py", line 7, in for result in d.items(): RuntimeError: dictionary changed size du

Re: [Bug 1677398] Re: Apparmor prevents using ZFS storage pools

2017-04-05 Thread Simon Déziel
No worries, I have a good feeling of how busy you are from the bug notifications I get. Knowing that you will look into it is already a great deal, so thanks again. On 2017-04-05 03:33 AM, ChristianEhrhardt wrote: > Damn it seems I can't find the hours yet - I really beg your pardon Simon as > I

Re: [Bug 1677442] Re: openvpn client breaks on connection loss

2017-04-05 Thread Simon Déziel
On 2017-04-05 07:19 PM, Paul wrote: > I'm going to run it with ping 1 and restart 3 for now so we'll see how > well it keeps going... I would advise not to run with such aggressive delays. They usually worsen the problem because as soon as there is a small % of packet loss, your VPN redials. Longe

[Bug 1372284] Re: nagios3 + livestatus: SIGSEGV everyday at midnight

2017-04-06 Thread Simon Déziel
** Tags removed: verification-needed ** Tags added: verification-done-trusty verification-needed-xenial -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1372284 Title: nagios3 + livestatus: SIGSEGV eve

[Bug 1372284] Re: nagios3 + livestatus: SIGSEGV everyday at midnight

2017-04-06 Thread Simon Déziel
Right, sorry. I tested on Trusty by installing the -proposed package (see below) yesterday then checked this AM if nagios had crashed during the log rotation (midnight). It didn't while it used to crash every single nights before. So the problem is fixed by the -proposed package, thanks! $ apt-cac

[Bug 1668813] Re: The tc man page references tc-index man page but tc-index man page does not exist

2017-05-05 Thread Simon Déziel
Fix verified on Xenial with 4.3.0-1ubuntu3.16.04.1 ** Tags removed: verification-needed ** Tags added: verification-done-xenial ** Tags removed: verification-done-xenial ** Tags added: verification-done ** Tags removed: verification-done ** Tags added: verification-done-xenial verification-neede

Re: [Bug 1427807] Re: usermod's man refers to --*-sub-uids but accepts only --*-subuids

2017-05-08 Thread Simon Déziel
On 2017-05-08 03:07 PM, Nish Aravamudan wrote: > @sdeziel, afaict, that is an upstream fix committed,but not the ubuntu > package in artful. Right, my bad, sorry. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.

[Bug 1689585] [NEW] ntp doesn't unload its apparmor profile on purge

2017-05-09 Thread Simon Déziel
Public bug reported: Steps to reproduce: 1) install ntp apt install ntp 2) confirm it has loaded its AA profile aa-status | grep ntpd 3) purge ntp apt purge ntp 4) the profile is left behind but shouldn't aa-status | grep ntpd Additional info: This was found by first install ntp th

[Bug 1689646] [NEW] Installing libapache2-mod-php7.0 doesn't enable PHP module

2017-05-09 Thread Simon Déziel
Public bug reported: Steps to reproduce (on Xenial): 1) install libapache2-mod-php7.0 (note the warning/error) apt install libapache2-mod-php7.0 Setting up libapache2-mod-php7.0 (7.0.15-0ubuntu0.16.04.4) ... Warning: Could not load Apache 2.4 maintainer script helper. 2) apache isn't even runn

[Bug 1689646] Re: Installing libapache2-mod-php7.0 doesn't enable PHP module

2017-05-09 Thread Simon Déziel
libapache2-mod-php5 used to pull apache2 as well as apache2-bin but if I check libapache2-mod-passenger it never pulled apache2 so I am inclined to think I was using it the wrong way. I'd like a confirmation if possible. -- You received this bug notification because you are a member of Ubuntu Bug

[Bug 1689646] Re: Installing libapache2-mod-php7.0 doesn't enable PHP module

2017-05-10 Thread Simon Déziel
Nice, thanks for the quick turnaround. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1689646 Title: Installing libapache2-mod-php7.0 doesn't enable PHP module To manage notifications about this bug

Re: [Bug 1689585] Re: ntp doesn't unload its apparmor profile on purge

2017-05-12 Thread Simon Déziel
On 2017-05-12 01:48 AM, ChristianEhrhardt wrote: > shouldn't dh_apparmor unload it just as it loads it? Exactly, I would have assumed that it was dh_apparmor's job. Curious to hear from the Apparmor folks. Thanks for looking into this. Simon -- You received this bug notification because you are

Re: [Bug 1689585] Re: ntp doesn't unload its apparmor profile on purge

2017-05-12 Thread Simon Déziel
On 2017-05-12 02:15 PM, Christian Boltz wrote: > You are technically correct that the still-loaded profile doesn't > match a clean uninstall. However, I have a different opinion on this > and thing keeping the profile loaded is the better choice. > > Unloading a profile means removing the confinem

Re: [Bug 1689585] Re: ntp doesn't unload its apparmor profile on purge

2017-05-12 Thread Simon Déziel
On 2017-05-12 03:34 PM, Seth Arnold wrote: > On Fri, May 12, 2017 at 06:56:35PM -0000, Simon Déziel wrote: >> If purging a package doesn't kill the running process, that's a >> packaging bug, not something Apparmor should try to paper over, IMHO. > > Yikes, p

[Bug 1687711] Re: strongSwan 5.3.5 has a known incompatibility with iOS/macOS 10+

2017-05-13 Thread Simon Déziel
I was able to reproduce the problematic scenario with an iOS 10.3.1 client and I'm happy to say that 5.3.5-1ubuntu3.2 [*] fixes it. Thanks Christian! *: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/2752 -- You received this bug notification because you are a member of Ubuntu Bugs,

[Bug 1687711] Re: strongSwan 5.3.5 has a known incompatibility with iOS/macOS 10+

2017-05-16 Thread Simon Déziel
5.3.5-1ubuntu3.2 from xenial-proposed fixes the issue. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1687711 Title: strongSwan 5.3.5 has a known incompatibility with iOS/macOS 10+ To manage notific

[Bug 1677398] [NEW] Apparmor prevents using ZFS storage pools

2017-03-29 Thread Simon Déziel
Public bug reported: Apparmor prevents qemu-kvm guests from using ZFS volumes. [Impact] * ZFS storage pools are not usable. [Test Case] 0) Create a zpool (system specific so not documented here) 1) Create a ZFS storage pool (named like your zpool, "internal" here) virsh pool-define-as internal

Re: [Bug 1677398] Re: Apparmor prevents using ZFS storage pools

2017-03-30 Thread Simon Déziel
Hello Christian, On 2017-03-30 06:18 AM, ChristianEhrhardt wrote: > So the following might serve as a temporary workaround adding "/dev/zd[0-9]* > rw" to /etc/apparmor.d/abstractions/libvirt-qemu. What I did something similar but less convenient. My goal was to keep the per-VM isolation so I add

Re: [Bug 1677442] Re: openvpn client breaks on connection loss

2017-03-31 Thread Simon Déziel
On 2017-03-31 04:46 AM, ChristianEhrhardt wrote: > I'd almost consider this a configuration issue instead of a bug. > > I wonder would a static host route to your vpn target fix the issue. > Like: > ip route add dev scope host Adding this to the client configuration should be equivalent to the

[Bug 1677442] Re: openvpn client breaks on connection loss

2017-03-31 Thread Simon Déziel
Paul, do you have the "keepalive" directive in your client config (can also be pushed by the server)? This should trigger a VPN restart after some time without hearing back from the server. IIRC, this should be enough to get you back on track. If not, please share the VPN client logs. -- You rece

[Bug 1723900] Re: unbound systemctl (re)start fails due to Apparmor profile issue

2017-10-16 Thread Simon Déziel
Here is a debdiff for Artful with the same patch that I attached to the Debian bug. ** Patch added: "unbound-apparmor-sd_notify.debdiff" https://bugs.launchpad.net/ubuntu/+source/unbound/+bug/1723900/+attachment/4972700/+files/unbound-apparmor-sd_notify.debdiff -- You received this bug notif

[Bug 1723900] Re: unbound systemctl (re)start fails due to Apparmor profile issue

2017-10-16 Thread Simon Déziel
** Changed in: unbound (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1723900 Title: unbound systemctl (re)start fails due to Apparmor profile issue To manag

[Bug 1580356] Re: OpenVPN causes reboot failure on Xenial in AWS

2016-05-10 Thread Simon Déziel
Scott, could you please provide some information about the routing/IP configuration before the reboot? ** Changed in: openvpn (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launc

[Bug 1580356] Re: OpenVPN causes reboot failure on Xenial in AWS

2016-05-10 Thread Simon Déziel
If you could attach "ip addr" and "ip route" output here that would be good, thanks. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1580356 Title: OpenVPN causes reboot failure on Xenial in AWS To m

[Bug 1580356] Re: OpenVPN causes reboot failure on Xenial in AWS

2016-05-10 Thread Simon Déziel
Thanks Scott. Could you also attach the OpenVPN configs since they apparently don't match the gist [1]. Thanks 1: https://gist.github.com/sc250024/001e05d64cd02fe746ae1772baccd24a -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https

[Bug 1365913] Re: ca-certificates installing a link to libnss3.so in root directory

2016-05-13 Thread Simon Déziel
*** This bug is a duplicate of bug 1065877 *** https://bugs.launchpad.net/bugs/1065877 ** This bug has been marked a duplicate of bug 1065877 A link /libnss3.so is created when installing the package or when updating the jks-keystore -- You received this bug notification because you are

[Bug 1065877] Re: A link /libnss3.so is created when installing the package or when updating the jks-keystore

2016-05-13 Thread Simon Déziel
Extract of the changelog: ca-certificates-java (20120524) unstable; urgency=low [ Marc Deslauriers ] [...] * debian/postinst: don't put a symlink in / if jvm doesn't contain nss configuration. (Closes: #665754, #665749). This means that Trusty and later are not affected. ** Bug watch

[Bug 1581864] Re: nginx.service: Failed to read PID from file /run/nginx.pid: Invalid argument

2016-05-14 Thread Simon Déziel
It seems to be a race between systemd and nginx. As if systemd was expecting the PID file to be populated before nginx had the time to create it. Workaround: printf "[Service]\nExecStartPost=/bin/sleep 0.1\n" > /etc/systemd/system/nginx.service.d/override.conf systemctl daemon-reload -- You

[Bug 1581864] [NEW] nginx.service: Failed to read PID from file /run/nginx.pid: Invalid argument

2016-05-14 Thread Simon Déziel
Public bug reported: Nginx logs an error when started on a machine with a single CPU: systemctl start nginx systemctl status nginx ● nginx.service - A high performance web server and a reverse proxy server Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)

[Bug 1581864] Re: nginx.service: Failed to read PID from file /run/nginx.pid: Invalid argument

2016-05-14 Thread Simon Déziel
In the above workaround, I forgot the first step (mkdir) so here it is again: Workaround: mkdir /etc/systemd/system/nginx.service.d printf "[Service]\nExecStartPost=/bin/sleep 0.1\n" > /etc/systemd/system/nginx.service.d/override.conf systemctl daemon-reload -- You received this bug notific

[Bug 1599428] Re: checkarray doesn't work

2016-07-06 Thread Simon Déziel
** Patch added: "Workaround for Xenial's dash" https://bugs.launchpad.net/ubuntu/+source/mdadm/+bug/1599428/+attachment/4696310/+files/checkarray-workaround-for-lp1599428.diff ** Bug watch added: Debian Bug tracker #787950 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=787950 ** Also aff

[Bug 1599428] [NEW] checkarray doesn't work

2016-07-06 Thread Simon Déziel
Public bug reported: Problem description: The script /usr/share/mdadm/checkarray exits before checking any array. Steps to reproduce: 1) Check the status of every arrays /usr/share/mdadm/checkarray --all --status 2) Expected output md0: idle 3) Problematic output: nothing Additional inf

[Bug 1599428] Re: checkarray doesn't work

2016-07-06 Thread Simon Déziel
After some more debugging, it seems to be a behavior change in dash between Xenial: # /bin/sh -c 'read cur_status < /sys/block/md0/md/sync_action; echo $cur_status' i # /bin/bash -c 'read cur_status < /sys/block/md0/md/sync_action; echo $cur_status' idle And Trusty: # /bin/sh -c 'read cur_statu

[Bug 1599428] Re: checkarray doesn't work

2016-07-06 Thread Simon Déziel
According to https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=787950#10, this is a combination of how dash reads files and the kernel version (4.0+). If that's true, even Trusty machines could be affected when running the HWE kernels. -- You received this bug notification because you are a mem

[Bug 1599428] Re: checkarray doesn't work

2016-07-06 Thread Simon Déziel
A kernel side fix was proposed (https://lkml.org/lkml/2016/6/22/682) but remains to be merged upstream. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1599428 Title: checkarray doesn't work To manag

[Bug 1580356] Re: OpenVPN causes reboot failure on Xenial in AWS

2016-05-16 Thread Simon Déziel
Hi Scott, I just finished migrating my VPN to Xenial. I cannot reproduce your issue using a static IP configuration in /etc/network/interfaces. I'll try to set things up with DHCP and see how it goes. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscri

[Bug 1327477] Re: dnsmasq not using all DHCPv6 provided nameservers

2016-05-19 Thread Simon Déziel
Simon's patch [1] was included in version 2.72 (Vivid and later). Marking as fix released. 1: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=006c162382aaa30f63413b876ecbe805280c3d36 ** Changed in: dnsmasq (Ubuntu) Status: Confirmed => Fix Released -- You received this bug noti

[Bug 1573192] Re: apparmor prevents using SCSI hostdevs

2016-05-19 Thread Simon Déziel
This is reproducible on Trusty (after removing sgio='filtered' which isn't supported). The same workaround works as well. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1573192 Title: apparmor preven

[Bug 1558857] Re: Upgrade to latest stable version v1.3.2

2016-03-20 Thread Simon Déziel
As mentioned in LP: #1553023, this new release brings ZFS support which would be really nice to get now that everyone wants to jump on the ZFS train :) IIRC, upstream libvirt releases every 3 months so that would be the last FFe for Xenial. -- You received this bug notification because you are a

[Bug 1423672] Re: ext4_mb_generate_buddy:756: group N, block bitmap and bg descriptor inconsistent: X vs Y

2016-03-21 Thread Simon Déziel
** Changed in: linux (Ubuntu) Status: Incomplete => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1423672 Title: ext4_mb_generate_buddy:756: group N, block bitmap and bg descriptor

[Bug 1423672] Re: ext4_mb_generate_buddy:756: group N, block bitmap and bg descriptor inconsistent: X vs Y

2016-03-21 Thread Simon Déziel
Thanks Václav, your conclusion about older Intel CPU seems to match my setup since this only happens on a Xeon E3110 (which is in fact a re- branded Core2 Duo E8400). Thanks for bisecting this and figure the fix was: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?h=7dec5

[Bug 1560149] [NEW] missing seccomp whitelist for qemu-kvm

2016-03-21 Thread Simon Déziel
Public bug reported: Steps to reproduce: 1) set "seccomp_sandbox = 1" in /etc/libvirt/qemu.conf 2) restart libvirt-bin 3) create a guest using the attached .xml file 4) start the guest Current behavior: the guest will remain in the "paused" state and fail to start because of this: audit: type=1

[Bug 1560149] Re: missing seccomp whitelist for qemu-kvm

2016-03-21 Thread Simon Déziel
I'm attaching an even simpler guest definition that also fails to boot. ** Attachment added: "guest definition" https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1560149/+attachment/4606630/+files/ubuntu16.04.xml -- You received this bug notification because you are a member of Ubuntu B

[Bug 1550539] Re: VMWare network interface name change with wily → xenial upgrade

2016-03-21 Thread Simon Déziel
@pitti, this new code [*] causes the postinst to fail when no eno* device exist: /var/lib/dpkg/info/udev.postinst: 109: [: Illegal number: * *: https://anonscm.debian.org/cgit/pkg-systemd/systemd.git/commit/?h=ubuntu&id=47584521cd23ab3490b40b8d95a1748d86ad7f25 -- You received this bug notif

[Bug 1560149] Re: missing seccomp whitelist for qemu-kvm

2016-03-22 Thread Simon Déziel
I believe the seccomp whitelist is provided by qemu itself, not libvirt. ** Also affects: qemu (Ubuntu) Importance: Undecided Status: New ** Changed in: libvirt (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which

[Bug 1550539] Re: VMWare network interface name change with wily → xenial upgrade

2016-03-22 Thread Simon Déziel
@Martin, correct, the postinst succeeds, sorry for the confusion. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1550539 Title: VMWare network interface name change with wily → xenial upgrade To man

[Bug 1565561] [NEW] NICs named enpXsX not properly recognized as raw devices

2016-04-03 Thread Simon Déziel
Public bug reported: With an interfaces stanza like this: auto br-trunk0 iface br-trunk0 inet static address 192.168.29.7/24 bridge_ports enp3s0.29 bridge_stp off bridge_fd 0 bridge_maxwait 0 The bridge port isn't brought up because the vlan pre-up script doesn't handle devices named l

[Bug 1564951] Re: systemd-timesyncd: Failed to call clock_adjtime(): Invalid argument

2016-04-04 Thread Simon Déziel
It's also occurring on a freshly installed physical Xenial machine. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1564951 Title: systemd-timesyncd: Failed to call clock_adjtime(): Invalid argument

[Bug 1565561] Re: NICs named enpXsX not properly recognized as raw devices

2016-04-04 Thread Simon Déziel
The code extracting VLANID and IF_VLAN_RAW_DEVICE seems overly complex IMHO. The "case" statement already ensures we operate on vlan device so I think something much simpler would work: VLANID=`echo $IFACE|sed "s/[^.]\+\.\([0-9]\+\).*/\1/; s/^0//"` IF_VLAN_RAW_DEVICE=`echo $IFACE|sed "s/\([^.]

[Bug 1561553] Re: unable to create a ZFS pool

2016-04-04 Thread Simon Déziel
Odd, I've always had -proposed enabled yet even now, only 1.3.1-1ubuntu6 is available to me: $ apt-cache policy libvirt-bin libvirt-bin: Installed: 1.3.1-1ubuntu6 Candidate: 1.3.1-1ubuntu6 Version table: *** 1.3.1-1ubuntu6 500 500 http://archive.ubuntu.com/ubuntu xenial/main amd64 P

<    4   5   6   7   8   9   10   11   12   13   >