Source: arno-iptables-firewall Version: 2.1.2a-4 Severity: important Justification: fails autopkgtest on Debian CI infrastructure Tags: forky sid User: [email protected] Usertags: lxc
Hi, Debian CI is switching away from lxc containers in favor of incus Containers. This is motivated by security concerns from us; incus is based on lxc, but orchestrates containers substantially different: containers are not privileged (so root in the container is not uid 0 outside of it, and incus imposes a stricter isolation from the host system. arno-iptables-firewall passes its tests under lxc, but fails under incus. The relevant part of the failure is (hopefully): > Get:4 http://deb.debian.org/debian testing/main amd64 gawk amd64 1:5.3.2-1 > [772 kB] > Get:5 http://deb.debian.org/debian testing/main amd64 libcap2 amd64 1:2.78-1 > [26.9 kB] > Get:6 http://deb.debian.org/debian testing/main amd64 libcap2-bin amd64 > 1:2.78-1 [36.7 kB] > Get:7 http://deb.debian.org/debian testing/main amd64 libelf1t64 amd64 > 0.195-1 [58.1 kB] > Get:8 http://deb.debian.org/debian testing/main amd64 libbpf1 amd64 1:1.7.0-1 > [179 kB] > Get:9 http://deb.debian.org/debian testing/main amd64 libmnl0 amd64 > 1.0.5-3+b2 [12.2 kB] > Get:10 http://deb.debian.org/debian testing/main amd64 libkrb5support0 amd64 > 1.22.1-3 [31.1 kB] > Get:11 http://deb.debian.org/debian testing/main amd64 libcom-err2 amd64 > 1.47.4-1 [19.2 kB] > Get:12 http://deb.debian.org/debian testing/main amd64 libk5crypto3 amd64 > 1.22.1-3 [79.0 kB] > Get:13 http://deb.debian.org/debian testing/main amd64 libkeyutils1 amd64 > 1.6.3-6+b2 [9348 B] > Get:14 http://deb.debian.org/debian testing/main amd64 libkrb5-3 amd64 > 1.22.1-3 [335 kB] > Get:15 http://deb.debian.org/debian testing/main amd64 libgssapi-krb5-2 amd64 > 1.22.1-3 [137 kB] > Get:16 http://deb.debian.org/debian testing/main amd64 libtirpc-common all > 1.3.7+ds-1 [10.0 kB] > Get:17 http://deb.debian.org/debian testing/main amd64 libtirpc3t64 amd64 > 1.3.7+ds-1 [82.9 kB] > Get:18 http://deb.debian.org/debian testing/main amd64 libxtables12 amd64 > 1.8.13-1 [30.5 kB] > Get:19 http://deb.debian.org/debian testing/main amd64 iproute2 amd64 7.1.0-1 > [1149 kB] > Get:20 http://deb.debian.org/debian testing/main amd64 libkmod2 amd64 > 34.2-2+b2 [62.5 kB] > Get:21 http://deb.debian.org/debian testing/main amd64 kmod amd64 34.2-2+b2 > [95.7 kB] > Get:22 http://deb.debian.org/debian testing/main amd64 netbase all 6.5 [12.4 > kB] > Get:23 http://deb.debian.org/debian testing/main amd64 libncursesw6 amd64 > 6.6+20260608-2 [137 kB] > Get:24 http://deb.debian.org/debian testing/main amd64 libproc2-1 amd64 > 2:4.0.6-3 [69.4 kB] > Get:25 http://deb.debian.org/debian testing/main amd64 procps amd64 2:4.0.6-3 > [983 kB] > Get:26 http://deb.debian.org/debian testing/main amd64 libip4tc2 amd64 > 1.8.13-1 [18.6 kB] > Get:27 http://deb.debian.org/debian testing/main amd64 libip6tc2 amd64 > 1.8.13-1 [18.9 kB] > Get:28 http://deb.debian.org/debian testing/main amd64 libnfnetlink0 amd64 > 1.0.2-3+b2 [14.9 kB] > Get:29 http://deb.debian.org/debian testing/main amd64 > libnetfilter-conntrack3 amd64 1.1.1-1 [43.5 kB] > Get:30 http://deb.debian.org/debian testing/main amd64 libnftnl11 amd64 > 1.3.1-1+b1 [66.3 kB] > Get:31 http://deb.debian.org/debian testing/main amd64 iptables amd64 > 1.8.13-1 [361 kB] > Get:32 http://deb.debian.org/debian testing/main amd64 arno-iptables-firewall > all 2.1.2a-4 [149 kB] > Preconfiguring packages ... > /var/cache/debconf/tmp.ci/arno-iptables-firewall.config.uNnupG: 1: ps: not > found > /var/cache/debconf/tmp.ci/arno-iptables-firewall.config.uNnupG: 12: [: =: > unexpected operator > /var/cache/debconf/tmp.ci/arno-iptables-firewall.config.uNnupG: 1: ps: not > found > /var/cache/debconf/tmp.ci/arno-iptables-firewall.config.uNnupG: 11: [: -gt: > unexpected operator > Fetched 5984 kB in 0s (15.3 MB/s) > Selecting previously unselected package libmpfr6:amd64. > (Reading database ... (Reading database ... 5% (Reading database ... 10% > (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% > (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% > (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% > (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% > (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% > (Reading database ... 90% (Reading database ... 95% (Reading database ... > 100% (Reading database ... 10006 files and directories currently installed.) > Preparing to unpack .../libmpfr6_4.2.2-3_amd64.deb ... > Unpacking libmpfr6:amd64 (4.2.2-3) ... > Selecting previously unselected package readline-common. > Preparing to unpack .../readline-common_8.3-4_all.deb ... > Unpacking readline-common (8.3-4) ... > Selecting previously unselected package libreadline8t64:amd64. > Preparing to unpack .../libreadline8t64_8.3-4_amd64.deb ... > Adding 'diversion of /lib/x86_64-linux-gnu/libhistory.so.8 to > /lib/x86_64-linux-gnu/libhistory.so.8.usr-is-merged by libreadline8t64' > Adding 'diversion of /lib/x86_64-linux-gnu/libhistory.so.8.2 to > /lib/x86_64-linux-gnu/libhistory.so.8.2.usr-is-merged by libreadline8t64' > Adding 'diversion of /lib/x86_64-linux-gnu/libreadline.so.8 to > /lib/x86_64-linux-gnu/libreadline.so.8.usr-is-merged by libreadline8t64' > Adding 'diversion of /lib/x86_64-linux-gnu/libreadline.so.8.2 to > /lib/x86_64-linux-gnu/libreadline.so.8.2.usr-is-merged by libreadline8t64' > Unpacking libreadline8t64:amd64 (8.3-4) ... > Setting up libmpfr6:amd64 (4.2.2-3) ... > Setting up readline-common (8.3-4) ... > Setting up libreadline8t64:amd64 (8.3-4) ... > Selecting previously unselected package gawk. > (Reading database ... (Reading database ... 5% (Reading database ... 10% > (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% > (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% > (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% > (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% > (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% > (Reading database ... 90% (Reading database ... 95% (Reading database ... > 100% (Reading database ... 10049 files and directories currently installed.) > Preparing to unpack .../00-gawk_1%3a5.3.2-1_amd64.deb ... > Unpacking gawk (1:5.3.2-1) ... > Selecting previously unselected package libcap2:amd64. > Preparing to unpack .../01-libcap2_1%3a2.78-1_amd64.deb ... > Unpacking libcap2:amd64 (1:2.78-1) ... > Selecting previously unselected package libcap2-bin. > Preparing to unpack .../02-libcap2-bin_1%3a2.78-1_amd64.deb ... The full autokpgtest logs are available at: https://ci.debian.net/experiments/8/regressions/ (please beware of pagination) Common types of failure and suggested fixes are being documented at: https://wiki.debian.org/ContinuousIntegration/LxcToIncus Note that for the time being, arno-iptables-firewall is still being tested under lxc to avoid disturbing its testing migration test results. If you decide to add the `isolation-machine` restriction to get this package tested under qemu, please mention that explicitly when closing this bug (it's fine to do that only in the package changelog entry that closes the bug) so that we can configure your package for qemu on ci.debian.net.
signature.asc
Description: PGP signature
