libvirt-lxc: virFileOpenTtyAt can't be called on /some/other/dev/pts

Bug #863629 reported by Serge Hallyn
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libvirt (Ubuntu)
Fix Released
High
Unassigned
Lucid
Fix Released
Undecided
Unassigned
Maverick
Fix Released
Undecided
Unassigned
Natty
Fix Released
Undecided
Unassigned
Oneiric
Fix Released
Undecided
Unassigned

Bug Description

lxcControllerRun() is calling virFileOpenTtyAt() with a slave opened on /the/container/chroot/dev/pts. While it is not documented in the manpages, glibc's grantpt does a first check (ensuring that the passed in fd is a pty slave) with '/dev/pts' as the hardcoded path, appending the pty#.

lxcControllerRun always calls this on the first slave opened after creating the new /dev/pts, so grantpt is always checking /dev/pts/0. Therefore, if your host does not have /dev/pts/0 (easy to reproduce using screen), then grantpt will fail, and the container creation will subsequently also fail.

=================================================================
SRU Justification:

1. Impact: libvirt will be unable to create lxc containers, saying that it cannot allocate /dev/pts/0
2. Development fix: A patch was sent upstream which makes libvirt-lxc not use glibc's grantpt, which is the cause of the bug.
3. Stable fix: same as the development fix.
4. Test case:
   0. [ Set up libvirt and create a libvirt-lxc container ]
   1. make sure noone is logged into the server
   2. log in, make sure your tty is /dev/pts/0 (check with 'tty')
   3. Pin /dev/pts/0 by doing "sleep 2h & disown; exit"
   4. Try to start a container on that system. Without this fix it will fail with an error about /dev/pts/0.
   5. Regression potential: if the patch was bad, it could cause failures when starting a container, or other places when libvirt allocates a tty.
=================================================================

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

The proposed fix - short of fixing glibc - is to set up an environment for the grantpt call with the container's /dev/pts bind-mounted to /dev/pts.

Changed in libvirt (Ubuntu):
status: New → Confirmed
importance: Undecided → High
Scott Moser (smoser)
tags: added: server-o-nrs
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "Debdiff with the proposed fix" of this bug report has been identified as being a patch in the form of a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-sponsors please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags: added: patch
Revision history for this message
Scott Moser (smoser) wrote :

I now know how I I was hitting this.
On my local system, I would log, open a terminal and and then run a bip proxy with:
 ssh -o ControlPath=none -C -L 7778:localhost:7778 -f -N ${HOST}

I can replicate that same behavior by ssh'ing to a system, then doing:
  sleep 30m & disown; exit
After that, 'sleep 30m' will be alive and holding the /dev/pts/0 so nothing will get that any more, but the entry is deleted.

I couldn't seem to get that to work through ssh running the command ie, the following kills the sleep and frees the /dev/pts/0:
  ssh $HOST -t 'sleep 30m & disown; exit 0;'

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Thanks, Scott. I can now finally reproduce this :) I see you were right on irc, my debdiff does not suffice. fascinating.

Revision history for this message
Scott Moser (smoser) wrote :

Just for reference, Serge posted to libc-alpha mailing list at http://www.cygwin.com/ml/libc-alpha/2011-10/threads.html#00009 ("multiple devpts mounts not supported insysdeps/unix/sysv/linux/ptsname.c:_ptsname_internal()")

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

This debdiff works for me even after making /dev/pts/0 unavailable (using Scott's great 'sleep 2h & disown; exit' trick on /dev/pts/0).

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

I am going to upload libvirt to precise with this fix (which also tests fine on my systems). Upstream has indicated it will prefer this simpler approach.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.9.2-4ubuntu16

---------------
libvirt (0.9.2-4ubuntu16) precise; urgency=low

  * lxc_controller: use our own unlocpt+grantpt rather than glibc's, which
    can't handle opening a pty in a devpts not mounted at /dev/pts.
    (LP: #863629)
 -- Serge Hallyn <email address hidden> Fri, 14 Oct 2011 10:47:57 -0500

Changed in libvirt (Ubuntu):
status: Confirmed → Fix Released
description: updated
Changed in libvirt (Ubuntu Lucid):
status: New → In Progress
status: In Progress → New
Revision history for this message
Martin Pitt (pitti) wrote : Please test proposed package

Hello Serge, or anyone else affected,

Accepted libvirt into oneiric-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in libvirt (Ubuntu Oneiric):
status: New → Fix Committed
tags: added: verification-needed
Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Tested, works.

Martin Pitt (pitti)
tags: added: verification-done
removed: verification-needed
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Nothing here to sponsor, removing ubuntu-sponsors.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.9.2-4ubuntu15.1

---------------
libvirt (0.9.2-4ubuntu15.1) oneiric-proposed; urgency=low

  * lxc_controller: use our own unlocpt+grantpt rather than glibc's, which
    can't handle opening a pty in a devpts not mounted at /dev/pts.
    (LP: #863629)
 -- Serge Hallyn <email address hidden> Tue, 01 Nov 2011 17:52:53 +0000

Changed in libvirt (Ubuntu Oneiric):
status: Fix Committed → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Hello Serge, or anyone else affected,

Accepted libvirt into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in libvirt (Ubuntu Lucid):
status: New → Fix Committed
tags: removed: verification-done
tags: added: verification-needed
Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Failed to build for lucid:

gcc -DHAVE_CONFIG_H -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\""/usr/lib"\" -DBINDIR=\""/usr/lib/libvirt"\" -DSBINDIR=\""/usr/sbin"\" -DSYSCONF_DIR="\"/etc\"" -DLOCALEBASEDIR=\""/usr/share/locale"\" -DPKGDATADIR=\""/usr/share/libvirt"\" -DLOCAL_STATE_DIR=\""/var"\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -I../src/conf -g -O2 -g -Wall -O2 -c -o libvirt_lxc-lxc_controller.o `test -f 'lxc/lxc_controller.c' || echo './'`lxc/lxc_controller.c
lxc/lxc_controller.c: In function 'lxcCreateTty':
lxc/lxc_controller.c:524: error: expected expression before ')' token
lxc/lxc_controller.c:533: warning: implicit declaration of function 'VIR_FORCE_CLOSE'
lxc/lxc_controller.c:533: warning: nested extern declaration of 'VIR_FORCE_CLOSE'

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Sorry. Given that (a) you need a backport kernel to use lxc on lucid, and (b) this race is hard to run into anyway, I'm going to mark this wontfix for lucid. If anyone actually is bothered by this on lucid, I'm open to changing my mind, but if we can't straightforwardly backport the fix, then I'd rather not risk a regression by finagling it.

Changed in libvirt (Ubuntu Lucid):
status: Fix Committed → Won't Fix
tags: added: verification-failed
removed: verification-needed
Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

(Change of mind or heart; will upload an updated package)

Changed in libvirt (Ubuntu Lucid):
status: Won't Fix → Confirmed
tags: added: verification-needed
removed: verification-failed
Revision history for this message
Martin Pitt (pitti) wrote :

Accepted 0.7.5-5ubuntu27.19 into lucid-proposed.

Changed in libvirt (Ubuntu Maverick):
status: New → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

Hello Serge, or anyone else affected,

Accepted libvirt into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Changed in libvirt (Ubuntu Natty):
status: New → Fix Committed
Revision history for this message
Martin Pitt (pitti) wrote :

Hello Serge, or anyone else affected,

Accepted libvirt into natty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Fix verified on lucid.

Martin Pitt (pitti)
Changed in libvirt (Ubuntu Lucid):
status: Confirmed → Fix Committed
tags: added: verification-done-lucid
Revision history for this message
Martin Pitt (pitti) wrote :

Hello Serge, or anyone else affected,

Accepted libvirt into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Verified on maverick.

Martin Pitt (pitti)
tags: added: verification-done-maverick
Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Verified on natty, thanks.

tags: added: verification-done-natty
removed: verification-needed
tags: added: verification-done
removed: verification-done-lucid verification-done-maverick verification-done-natty
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.7.5-5ubuntu27.19

---------------
libvirt (0.7.5-5ubuntu27.19) lucid-proposed; urgency=low

  * New version of debian/patches/lxc-use-own-ptyfns.patch. Previous version
    failed to build.

libvirt (0.7.5-5ubuntu27.18) lucid-proposed; urgency=low

  * lxc_controller: use our own unlocpt+grantpt rather than glibc's, which
    can't handle opening a pty in a devpts not mounted at /dev/pts.
    (LP: #863629)
 -- Serge Hallyn <email address hidden> Mon, 14 Nov 2011 15:11:24 -0600

Changed in libvirt (Ubuntu Lucid):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.8.3-1ubuntu19.4

---------------
libvirt (0.8.3-1ubuntu19.4) maverick-proposed; urgency=low

  * New version of debian/patches/lxc-use-own-ptyfns.patch. Previous version
    failed to build.

libvirt (0.8.3-1ubuntu19.3) maverick-proposed; urgency=low

  * lxc_controller: use our own unlocpt+grantpt rather than glibc's, which
    can't handle opening a pty in a devpts not mounted at /dev/pts.
    (LP: #863629)
 -- Serge Hallyn <email address hidden> Tue, 15 Nov 2011 08:06:57 -0600

Changed in libvirt (Ubuntu Maverick):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libvirt - 0.8.8-1ubuntu6.7

---------------
libvirt (0.8.8-1ubuntu6.7) natty-proposed; urgency=low

  * lxc_controller: use our own unlocpt+grantpt rather than glibc's, which
    can't handle opening a pty in a devpts not mounted at /dev/pts.
    (LP: #863629)
 -- Serge Hallyn <email address hidden> Tue, 01 Nov 2011 18:00:51 +0000

Changed in libvirt (Ubuntu Natty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.