Source: iotop Version: 0.6-42-ga14256a-0.3 Severity: important Justification: fails autopkgtest on Debian CI infrastructure Tags: forky sid User: [email protected] Usertags: lxc
Hi, Debian CI is switching away from lxc containers in favor of incus Containers. This is motivated by security concerns from us; incus is based on lxc, but orchestrates containers substantially different: containers are not privileged (so root in the container is not uid 0 outside of it, and incus imposes a stricter isolation from the host system. iotop passes its tests under lxc, but fails under incus. The relevant part of the failure is (hopefully): > Preparing to unpack .../iotop_0.6-42-ga14256a-0.3+b2_amd64.deb ... > Unpacking iotop (0.6-42-ga14256a-0.3+b2) ... > Setting up media-types (14.0.0) ... > Setting up libsqlite3-0:amd64 (3.53.4-2) ... > Setting up libncursesw6:amd64 (6.6+20260608-2) ... > Setting up libffi8:amd64 (3.7.1-2) ... > Setting up netbase (6.5) ... > Setting up readline-common (8.3-4) ... > Setting up libreadline8t64:amd64 (8.3-4) ... > Setting up libpython3.14-stdlib:amd64 (3.14.6-1) ... > Setting up python3.14 (3.14.6-1) ... > Setting up libpython3-stdlib:amd64 (3.14.6-1) ... > Setting up python3 (3.14.6-1) ... > Setting up iotop (0.6-42-ga14256a-0.3+b2) ... > update-alternatives: using /usr/sbin/iotop-py to provide /usr/sbin/iotop > (iotop) in auto mode > Processing triggers for systemd (261.2-1) ... > Processing triggers for libc-bin (2.42-17) ... > autopkgtest [20:47:39]: test command2: cd "$AUTOPKGTEST_TMP" ; iotop --only > --batch --time --quiet --iter 10 > autopkgtest [20:47:39]: test command2: [----------------------- > Netlink error: Operation not permitted (1) > > The Linux kernel interfaces that iotop relies on now require root privileges > or the NET_ADMIN capability. This change occurred because a security issue > (CVE-2011-2494) was found that allows leakage of sensitive data across user > boundaries. If you require the ability to run iotop as a non-root user, please > configure sudo to allow you to run iotop as root. > > Please do not file bugs on iotop about this. > autopkgtest [20:47:39]: test command2: -----------------------] > autopkgtest [20:47:39]: test command2: - - - - - - - - - - results - - - - - > - - - - - > command2 FAIL non-zero exit status 1 The full autokpgtest logs are available at: https://ci.debian.net/experiments/8/regressions/ (please beware of pagination) Common types of failure and suggested fixes are being documented at: https://wiki.debian.org/ContinuousIntegration/LxcToIncus Note that for the time being, iotop is still being tested under lxc to avoid disturbing its testing migration test results. If you decide to add the `isolation-machine` restriction to get this package tested under qemu, please mention that explicitly when closing this bug (it's fine to do that only in the package changelog entry that closes the bug) so that we can configure your package for qemu on ci.debian.net.
signature.asc
Description: PGP signature
