Bug 1216787 - [Build 548.2] AppARmor many upgrade tests fail on AVC denials
Summary: [Build 548.2] AppARmor many upgrade tests fail on AVC denials
Status: NEW
Alias: None
Product: openSUSE Distribution
Classification: openSUSE
Component: AppArmor (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Christian Boltz
QA Contact: E-mail List
URL: https://openqa.opensuse.org/tests/369...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-01 12:51 UTC by Lubos Kocman
Modified: 2023-11-01 13:47 UTC (History)
1 user (show)

See Also:
Found By: openQA
Services Priority:
Business Priority:
Blocker: Yes
Marketing QA Status: ---
IT Deployment: ---
suse-beta: needinfo? (lubos.kocman)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lubos Kocman 2023-11-01 12:51:45 UTC
## Observation


many of our upgrade tests failed on following AVC denials in AppArmor

full log https://paste.opensuse.org/pastes/09c5eebd91df


# wait_serial expected: "SCRIPT_FINISHEDOSm16-\\d+-"
# Result:

OSm16
type=AVC msg=audit(1698766514.856:11): apparmor="STATUS" operation="profile_load" profile="unconfined" name="php-fpm" pid=639 comm="apparmor_parser"
type=AVC msg=audit(1698766514.884:12): apparmor="STATUS" operation="profile_load" profile="unconfined" name="samba-bgqd" pid=641 comm="apparmor_parser"
type=SYSCALL msg=audit(1698766514.884:12): arch=c000003e syscall=1 success=yes exit=42097 a0=8 a1=5651a69e3bf0 a2=a471 a3=0 items=0 ppid=617 pid=641 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apparmor_parser" exe="/sbin/apparmor_parser" subj=unconfined key=(null)
type=PROCTITLE msg=audit(1698766514.884:12): proctitle=2F7362696E2F61707061726D6F725F706172736572002D2D7265706C616365002D2D002F6574632F61707061726D6F722E64
type=AVC msg=audit(1698766514.912:13): apparmor="STATUS" operation="profile_load" profile="unconfined" name="samba-dcerpcd" pid=642 comm="apparmor_parser"
type=SYSCALL msg=audit(1698766514.912:13): arch=c000003e syscall=1 success=yes exit=43027 a0=8 a1=5651a694e370 a2=a813 a3=0 items=0 ppid=617 pid=642 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apparmor_parser" exe="/sbin/apparmor_parser" subj=unconfined key=(null)
type=PROCTITLE msg=audit(1698766514.912:13): proctitle=2F7362696E2F61707061726D6F725F706172736572002D2D7265706C616365002D2D002F6574632F61707061726D6F722E64
type=AVC msg=audit(1698766514.940:14): apparmor="STATUS" operation="profile_load" profile="unconfined" name="samba-rpcd" pid=643 comm="apparmor_parser"
type=SYSCALL msg=audit(1698766514.940:14): arch=c000003e syscall=1 success=yes exit=41505 a0=8 a1=5651a6989e80 a2=a221 a3=0 items=0 ppid=617 pid=643 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apparmor_parser" exe="/sbin/apparmor_parser" subj=unconfined key=(null)
type=PROCTITLE msg=audit(1698766514.940:14): proctitle=2F7362696E2F61707061726D6F725F706172736572002D2D7265706C616365002D2D002F6574632F61707061726D6F722E64




openQA test in scenario opensuse-15.6-NET-x86_64-kde@64bit-2G fails in
[prepare_system_for_update_tests](https://openqa.opensuse.org/tests/3691976/modules/prepare_system_for_update_tests/steps/15)

## Test suite description
TIMEOUT_SCALE property is added to avoid sporadic shutdown fails in kde@USBboot_64 scenario.

Added by : oorlov; 

Related ticket: poo#37000


## Reproducible

Fails since (at least) Build [545.1](https://openqa.opensuse.org/tests/3670617)


## Expected result

Last good: [538.1](https://openqa.opensuse.org/tests/3640584) (or more recent)


## Further details

Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=NET&machine=64bit-2G&test=kde&version=15.6)
Comment 1 Christian Boltz 2023-11-01 13:47:22 UTC
(In reply to Lubos Kocman from comment #0)
> many of our upgrade tests failed on following AVC denials in AppArmor

The log (also the full log) only shows profile loads, but no denials.

Are you sure that this is caused by AppArmor? If so, are there any DENIED log messages somewhere?

Also, what was changed in 15.66 and/or openQA since the last successful run?