Mircea Vutcovici's questions

This is a canonical question. I want to understand why a specific system call is failing. Is it possible to display the kernel stack trace of the syscall:

• when the return is non-zero or is negative (it depends on syscall to know when it fails, maybe we should base the failure on errno)
• and when the execution reaches the return instruction?

Tried with trace/trace-bpfcc from bcc-tools(Fedora)/bpfcc-tools(Ubuntu):

$ sudo /usr/sbin/trace-bpfcc -K 'r::do_sys_open "%llx", retval'&
$ touch /root  # As normal user
15979   15979   touch           do_sys_open      fffffffffffffffe
        kretprobe_trampoline+0x0 [kernel]
        do_syscall_64+0x5a [kernel]
        entry_SYSCALL_64_after_hwframe+0x44 [kernel]

But the stack trace is meaningless.

I have a VM started by TripleO setup script for OpenStack. I can connect to the VM console with vncviewer. The problem is that the VM is not listed by virsh.

$ sudo virsh list --all
 Id    Name                           State
----------------------------------------------------

$ ps -edf |grep qemu
stack     6451     1 30 Sep24 ?        04:29:15 /usr/libexec/qemu-kvm -name undercloud -S -machine pc-i440fx-rhel7.0.0,accel=kvm,usb=off,dump-guest-core=off -cpu Opteron_G3,+vme,+ht,+mmxext,+fxsr_opt,+pdpe1gb,+3dnowext,+3dnow,+cmp_legacy,+extapic,+cr8legacy,+3dnowprefetch,+osvw,+ibs,+skinit,+wdt,+nodeid_msr,-avx,-avx2 -m 12288 -realtime mlock=off -smp 6,sockets=6,cores=1,threads=1 -uuid 7c9db9d9-846f-480a-aefd-608eb257c379 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/home/stack/.config/libvirt/qemu/lib/domain-1-undercloud/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=delay -no-hpet -no-shutdown -boot menu=off,strict=on -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/home/stack/pool/undercloud.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 -netdev tap,fd=24,id=hostnet0 -device virtio-net-pci,netdev=hostnet0,id=net0,mac=00:04:31:27:f2:40,bus=pci.0,addr=0x3 -netdev tap,fd=25,id=hostnet1 -device virtio-net-pci,netdev=hostnet1,id=net1,mac=00:04:31:27:f2:3e,bus=pci.0,addr=0x4 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -vnc 127.0.0.1:0 -vga cirrus -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x6 -msg timestamp=on
root     10232 20111  0 10:32 pts/0    00:00:00 grep --color=auto qemu
$

I am running a centos7 unprivileged LXD container on a ubuntu 17.04 host. I have a problem setting ulimit for NOFILE inside the container, if it is running in unprivileged mode.

Bellow are the steps to reproduce:

$ lxc launch images:centos/7/amd64 mycontainer
$ lxc exec mycontainer bash
[root@mycontainer ~]# yum install strace
[root@mycontainer ~]# ulimit -n 200000
bash: ulimit: open files: cannot modify limit: Operation not permitted
[root@mycontainer ~]#
[root@mycontainer ~]# strace -e setrlimit bash -c 'ulimit -n 200000'
setrlimit(RLIMIT_NOFILE, {rlim_cur=200000, rlim_max=200000}) = -1 EPERM (Operation not permitted)
bash: line 0: ulimit: open files: cannot modify limit: Operation not permitted
+++ exited with 1 +++
[root@mycontainer ~]#

Configuration details of the container:

$ sudo lxc config show mycontainer
architecture: x86_64
config:
  image.architecture: amd64
  image.build: "20170504_02:16"
  image.description: Centos 7 (amd64) (20170504_02:16)
  image.distribution: centos
  image.release: "7"
  volatile.base_image: 41c7bb494bbdf71c2aee471bb44a2318fd3424a0cd22091fb896a7614ae545eb
  volatile.eth0.hwaddr: 00:16:3e:61:e4:6c
  volatile.eth0.name: eth0
  volatile.idmap.base: "0"
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":140000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":140000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":140000,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":140000,"Nsid":0,"Maprange":65536}]'
  volatile.last_state.power: STOPPED
  volatile.root.hwaddr: 00:16:3e:6b:93:1d
  volatile.root.name: eth1
devices: {}
ephemeral: false
profiles:
- default

As a workaround I can make the container privileged, but I prefer to grant only rlimit access for this container, or to be able to rise the limit from lxd. Here is how I set in to be privileged:

$ lxc config set mycontainer security.privileged true
$ lxc restart mycontainer
$ sudo lxc config show mycontainer                                                                                                                   
architecture: x86_64
config:
  image.architecture: amd64
  image.build: "20170504_02:16"
  image.description: Centos 7 (amd64) (20170504_02:16)
  image.distribution: centos
  image.release: "7"
  security.privileged: "true"
  volatile.base_image: 41c7bb494bbdf71c2aee471bb44a2318fd3424a0cd22091fb896a7614ae545eb
  volatile.eth0.hwaddr: 00:16:3e:61:e4:6c
  volatile.eth0.name: eth0
  volatile.idmap.base: "0"
  volatile.idmap.next: '[]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
devices: {}
ephemeral: false
profiles:
- default

I am trying to use docker container with overlay.

I am starting the docker daemon with: docker daemon -s overlay

The docker run --rm hello-world command fails with:

panic: standard_init_linux.go:175: exec user process caused "permission denied" [recovered]
        panic: standard_init_linux.go:175: exec user process caused "permission denied"

goroutine 1 [running, locked to thread]:
panic(0x7e9de0, 0xc82011f110)
        /usr/local/go/src/runtime/panic.go:481 +0x3e6
github.com/urfave/cli.HandleAction.func1(0xc8200f32e8)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/urfave/cli/app.go:478 +0x38e
panic(0x7e9de0, 0xc82011f110)
        /usr/local/go/src/runtime/panic.go:443 +0x4e9
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization.func1(0xc8200f2bf8, 0xc82001a0c8, 0xc8200f2d08)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:259 +0x136
github.com/opencontainers/runc/libcontainer.(*LinuxFactory).StartInitialization(0xc820059630, 0x7fb8ccc34728, 0xc82011f110)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/opencontainers/runc/libcontainer/factory_linux.go:277 +0x5b1
main.glob.func8(0xc820076a00, 0x0, 0x0)
        /go/src/github.com/opencontainers/runc/main_unix.go:26 +0x68
reflect.Value.call(0x74e5e0, 0x8ffda0, 0x13, 0x846308, 0x4, 0xc8200f3268, 0x1, 0x1, 0x0, 0x0, ...)
        /usr/local/go/src/reflect/value.go:435 +0x120d
reflect.Value.Call(0x74e5e0, 0x8ffda0, 0x13, 0xc8200f3268, 0x1, 0x1, 0x0, 0x0, 0x0)
        /usr/local/go/src/reflect/value.go:303 +0xb1
github.com/urfave/cli.HandleAction(0x74e5e0, 0x8ffda0, 0xc820076a00, 0x0, 0x0)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/urfave/cli/app.go:487 +0x2ee
github.com/urfave/cli.Command.Run(0x8491b8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8df0e0, 0x51, 0x0, ...)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/urfave/cli/command.go:191 +0xfec
github.com/urfave/cli.(*App).Run(0xc820001800, 0xc82000a100, 0x2, 0x2, 0x0, 0x0)
        /go/src/github.com/opencontainers/runc/Godeps/_workspace/src/github.com/urfave/cli/app.go:240 +0xaa4
main.main()
        /go/src/github.com/opencontainers/runc/main.go:137 +0xe24

If I use the default devicemapper driver it works without problems.

I would like to trigger a handler when a variable is changed.

For example I have in mysql config file the innodb-log-file-size config item. I would like to do a couple of actions when this item is changed:

• ensure MySQL is running (we must start from a stable state)
• run in mysql: SET GLOBAL innodb_fast_shutdown = 0
• stop MySQL
• move /var/lib/mysql/ib_logfile[01] to a backup folder
• start MySQL
• check that MySQL is running fine by running a MySQL query

See also: https://dba.stackexchange.com/a/1265/3574

The only problem I have is how can I determine that a variable (actually some specific text) was changed in the configuration file.

I am interested in a generic approach how to solve this problem. For my particular case I have in mind a couple of solutions.

Edit 1: I am using template module.

Mounting a cifs share in RHEL7 fails with the following error: "mount: failed to parse mount options: Numerical result out of range"

# LIBMOUNT_DEBUG=0xffff mount //fileserver/db-mysql /mnt/mysqlBackups -t cifs -o credentials=/etc/samba/fileserver.password,forceuid,uid=mysql,forcegid,gid=mysql,file_mode=0664,dir_mode=0775 -v

5561: libmount:     INIT: library debug mask: 0xffff
5561: libmount:     INIT: library version: 2.23.0
5561: libmount:     INIT:     feature: selinux
5561: libmount:     INIT:     feature: debug
5561: libmount:     INIT:     feature: assert
5561: libmount:      CXT: [0x7ff506842050]: ----> allocate
5561: libmount:    UTILS: mtab: /etc/mtab
5561: libmount:    UTILS: /etc/mtab: irregular/non-writable
5561: libmount:    UTILS: utab: /run/mount/utab
5561: libmount:      CXT: [0x7ff506842050]: enabling flag 0010
5561: libmount:      CXT: [0x7ff506842050]: mount: preparing
5561: libmount:      CXT: [0x7ff506842050]: use default optmode
5561: libmount:      CXT: [0x7ff506842050]: OPTSMODE: ignore=0, append=0, prepend=1, replace=0, force=0, fstab=1, mtab=1
5561: libmount:      CXT: [0x7ff506842050]: fstab not required -- skip
5561: libmount:      CXT: [0x7ff506842050]: merging mount flags
5561: libmount:      CXT: [0x7ff506842050]: final flags: VFS=00000000 user=00000000
5561: libmount:      CXT: [0x7ff506842050]: mount: evaluating permissions
5561: libmount:      CXT: [0x7ff506842050]: mount: fixing optstr
5561: libmount:      CXT: [0x7ff506842050]: mount: fixing vfs optstr
5561: libmount:      CXT: applying 0x00000000 flags to '(null)'
5561: libmount:      CXT: new optstr 'rw'
5561: libmount:      CXT: [0x7ff506842050]: mount: fixing user optstr
5561: libmount:      CXT: applying 0x00000000 flags to '(null)'
5561: libmount:      CXT: new optstr '(null)'
5561: libmount:      CXT: fixing uid
5561: libmount:      CXT: fixing gid
5561: libmount:    UTILS: cannot convert 'mysql' groupname to GID
5561: libmount:      CXT: [0x7ff506842050]: fixed options [rc=-34]: vfs: 'rw' fs: 'credentials=/etc/samba/fileserver.password,forceuid,uid=27,forcegid,gid=mysql,file_mode=0664,dir_mode=0775' user: '(null)', optstr: 'credentials=/etc/samba/fileserver.password,forceuid,uid=mysql,forcegid,gid=mysql,file_mode=0664,dir_mode=0775'
5561: libmount:      CXT: [0x7ff506842050]: mount: preparing failed
mount: failed to parse mount options: Numerical result out of range
5561: libmount:      CXT: [0x7ff506842050]: <---- reset [status=0] ---->
5561: libmount:      CXT: [0x7ff506842050]: tabfiler disabled
5561: libmount:      CXT: [0x7ff506842050]: <---- free

The mysql group exists:

# getent group mysql
mysql:x:27:
# grep mysql /etc/group
mysql:x:27:
# id mysql
uid=27(mysql) gid=27(mysql) groups=27(mysql)
# ls -lZ /etc/group /etc/passwd
-rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/group
-rw-r--r--. root root system_u:object_r:passwd_file_t:s0 /etc/passwd

What if found interesting is that using directly mount.cifs it is working:

# mount.cifs //fileserver/db-mysql /mnt/mysqlBackups --verbose -o credentials=/etc/samba/fileserver.password,forceuid,uid=mysql,forcegid,gid=mysql,file_mode=0664,dir_mode=0775
Credential formatted incorrectly: (null)
domain=fileserver
mount.cifs kernel mount options: ip=10.1.2.20,unc=\\fileserver\db-mysql,forceuid,forcegid,file_mode=0664,dir_mode=0775,uid=27,gid=27,user=svc_linux,,domain=fileserver,pass=********

# grep /mnt/mysqlBackups /proc/mounts
//fileserver/db-mysql /mnt/mysqlBackups cifs rw,relatime,vers=1.0,cache=strict,username=svc_linux,domain=fileserver,uid=27,forceuid,gid=27,forcegid,addr=10.1.2.20,file_mode=0664,dir_mode=0775,nounix,serverino,rsize=61440,wsize=65536,actimeo=1 0 0

It happens in:

# uname -rvpio
3.10.0-327.36.1.el7.x86_64 #1 SMP Sun Sep 18 13:04:29 UTC 2016 x86_64 x86_64 GNU/Linux

Same problem in:

# uname -rvpio
3.10.0-327.36.3.el7.x86_64 #1 SMP Mon Oct 24 16:09:20 UTC 2016 x86_64 x86_64 GNU/Linux

mount and mount.cifs are the latest version for RHEL7:

# rpm -q util-linux cifs-utils
util-linux-2.23.2-26.el7_2.3.x86_64
cifs-utils-6.2-7.el7.x86_64

It seems that getgrnam_r(3) call fails.

Edit 1:
I want to use user and group names and not UID GID. I know that useing numerical IDs I can solve the problem. I know that removing gid=mysql it will work. Why for user mount is able to find UID, but for grup it fails to find GID?

Edit 2: The error seems to be thrown by this code: https://github.com/karelzak/util-linux/blob/master/libmount/src/utils.c#L703

So I tried to reproduce with the following code, but the call is successful. Which is very strange for me. Sorry for the sloppy C code, I am not a programmer.

#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <sys/types.h>
#include <grp.h>
#define UL_GETPW_BUFSIZ (16 * 1024)

int main(void)
{
    int rc = -1;
    struct group grp;
    struct group *gr;
    char *buf;
    int _gid=10;
    gid_t *gid = (gid_t *)& _gid;
    char *groupname = "mysql";

    if (!groupname || !gid)
        return -EINVAL;

    buf = malloc(UL_GETPW_BUFSIZ);
    if (!buf)
        return -ENOMEM;

    if (!getgrnam_r(groupname, &grp, buf, UL_GETPW_BUFSIZ, &gr) && gr) {
        *gid= gr->gr_gid;
        printf("gid=%i\n",*gid);
        rc = 0;
    } else {
        printf("cannot convert '%s' groupname to GID\n", groupname);
        rc = errno ? -errno : -EINVAL;
    }

    free(buf);

    return rc;
}
// vim:ts=4:sts=4:sw=4:et:

No errors are reported:

# gcc -Wall -W test.c
# ./a.out
gid=27
#

Edit 3: If I try with gid=dbus it is working:

# egrep 'mysql|dbus' /etc/passwd /etc/shadow /etc/group /etc/gshadow
/etc/passwd:dbus:x:81:81:System message bus:/:/sbin/nologin
/etc/passwd:mysql:x:27:27:Percona Server:/var/lib/mysql:/bin/false
/etc/shadow:dbus:!!:17086::::::
/etc/shadow:mysql:!!:17104::::::
/etc/group:dbus:x:81:
/etc/group:mysql:x:27:
/etc/gshadow:dbus:!::
/etc/gshadow:mysql:!::
# LIBMOUNT_DEBUG=0xffff  mount //fileserver/db-mysql /mnt/mysqlBackups -t cifs -o credentials=/etc/samba/fileserver.password,forceuid,uid=mysql,forcegid,file_mode=0664,dir_mode=0775,gid=dbsu
10777: libmount:     INIT: library debug mask: 0xffff
10777: libmount:     INIT: library version: 2.23.0
10777: libmount:     INIT:     feature: selinux
10777: libmount:     INIT:     feature: debug
10777: libmount:     INIT:     feature: assert
10777: libmount:      CXT: [0x7f687bf74050]: ----> allocate
10777: libmount:    UTILS: mtab: /etc/mtab
10777: libmount:    UTILS: /etc/mtab: irregular/non-writable
10777: libmount:    UTILS: utab: /run/mount/utab
10777: libmount:      CXT: [0x7f687bf74050]: mount: preparing
10777: libmount:      CXT: [0x7f687bf74050]: use default optmode
10777: libmount:      CXT: [0x7f687bf74050]: OPTSMODE: ignore=0, append=0, prepend=1, replace=0, force=0, fstab=1, mtab=1
10777: libmount:      CXT: [0x7f687bf74050]: fstab not required -- skip
10777: libmount:      CXT: [0x7f687bf74050]: merging mount flags
10777: libmount:      CXT: [0x7f687bf74050]: final flags: VFS=00000000 user=00000000
10777: libmount:      CXT: [0x7f687bf74050]: mount: evaluating permissions
10777: libmount:      CXT: [0x7f687bf74050]: mount: fixing optstr
10777: libmount:      CXT: [0x7f687bf74050]: mount: fixing vfs optstr
10777: libmount:      CXT: applying 0x00000000 flags to '(null)'
10777: libmount:      CXT: new optstr 'rw'
10777: libmount:      CXT: [0x7f687bf74050]: mount: fixing user optstr
10777: libmount:      CXT: applying 0x00000000 flags to '(null)'
10777: libmount:      CXT: new optstr '(null)'
10777: libmount:      CXT: fixing uid
10777: libmount:      CXT: fixing gid
10777: libmount:    UTILS: cannot convert 'dbsu' groupname to GID
10777: libmount:      CXT: [0x7f687bf74050]: fixed options [rc=-34]: vfs: 'rw' fs: 'credentials=/etc/samba/fileserver.password,forceuid,uid=27,forcegid,file_mode=0664,dir_mode=0775,gid=dbsu' user: '(null)', optstr: 'credentials=/etc/samba/fileserver.password,forceuid,uid=mysql,forcegid,file_mode=0664,dir_mode=0775,gid=dbsu'
10777: libmount:      CXT: [0x7f687bf74050]: mount: preparing failed
mount: failed to parse mount options: Numerical result out of range
10777: libmount:      CXT: [0x7f687bf74050]: <---- reset [status=0] ---->
10777: libmount:      CXT: [0x7f687bf74050]: tabfiler disabled
10777: libmount:      CXT: [0x7f687bf74050]: <---- free

I have a local_action the I would like to split in multiple lines.

  - name: Find geographical region of this server
    local_action: uri url=http://locator/studio/{{ ansible_default_ipv4.address}} method=GET return_content=yes register=locator_output

How can you properly escape backslash in ansible playbooks?

I am trying to do a search and replace for the backslash in the password, but I am not even able to add backslash as a string in the regex_replace jinja2 filter. I am using ansible version 2.1.1.0.

Here is an example of the problem:

$ cat jinja2-escape-test.yml
---
- hosts: localhost
  gather_facts: no

  vars:
    password: '\Udl5DoQfa3Uy_:1sbcE'

  tasks:

  - debug: var=password

  - name: Escape root password - working
    set_fact: "password_escaped={{ password | regex_replace ('U','\\X') }}"

  - name: Escape root password - not working
    set_fact: "password_escaped={{ password | regex_replace ('U','\\') }}"

  - debug: msg=password_escaped={{ password_escaped }}

# vim:et:sw=2:ts=2:sts=2:

$ ansible-playbook jinja2-escape-test.yml
ERROR! failed at splitting arguments, either an unbalanced jinja2 block or quotes: password_escaped={{ password | regex_replace ('U','\') }}

The error appears to have been in '/home/mot/build-dashboards/jinja2-escape-test.yml': line 15, column 5, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


  - name: Escape root password - not working
    ^ here

I have often faced various file system permission problems on Linux. And now with SELinux a bit complicated. I am searching for a generic way to debug this.

In my particular case I have a chdir(2) syscall that fails with:

chdir("/var/log/httpd")                 = -1 EACCES (Permission denied)

With ftrace I have a more detailed graph, but I am missing the arguments and the return values.

# trace-cmd record -p function_graph -g sys_enter_chdir -P 26510
# trace-cmd report
[...]
smbd-26510 [001] 10861828.204161: funcgraph_entry:                   |  sys_chdir() {
smbd-26510 [001] 10861828.204162: funcgraph_entry:                   |    user_path_at() {
smbd-26510 [001] 10861828.204162: funcgraph_entry:                   |      getname() {
smbd-26510 [001] 10861828.204163: funcgraph_entry:                   |        kmem_cache_alloc() {
smbd-26510 [001] 10861828.204163: funcgraph_entry:        0.447 us   |          _cond_resched();
smbd-26510 [001] 10861828.204165: funcgraph_exit:         1.784 us   |        }
smbd-26510 [001] 10861828.204165: funcgraph_entry:                   |        strncpy_from_user() {
smbd-26510 [001] 10861828.204166: funcgraph_entry:        0.454 us   |          _cond_resched();
smbd-26510 [001] 10861828.204167: funcgraph_exit:         1.473 us   |        }
smbd-26510 [001] 10861828.204167: funcgraph_exit:         4.926 us   |      }
smbd-26510 [001] 10861828.204168: funcgraph_entry:                   |      filename_lookup() {
smbd-26510 [001] 10861828.204168: funcgraph_entry:                   |        path_init() {
smbd-26510 [001] 10861828.204169: funcgraph_entry:        0.725 us   |          _read_lock();
smbd-26510 [001] 10861828.204170: funcgraph_exit:         1.928 us   |        }
smbd-26510 [001] 10861828.204171: funcgraph_entry:                   |        path_walk() {
smbd-26510 [001] 10861828.204171: funcgraph_entry:                   |          __link_path_walk() {
smbd-26510 [001] 10861828.204172: funcgraph_entry:                   |            acl_permission_check() {
smbd-26510 [001] 10861828.204173: funcgraph_entry:                   |              ext4_check_acl() {
smbd-26510 [001] 10861828.204174: funcgraph_entry:        0.612 us   |                ext4_get_acl();
smbd-26510 [001] 10861828.204175: funcgraph_exit:         1.807 us   |              }
smbd-26510 [001] 10861828.204175: funcgraph_entry:                   |              in_group_p() {
smbd-26510 [001] 10861828.204176: funcgraph_entry:        0.770 us   |                groups_search();
smbd-26510 [001] 10861828.204177: funcgraph_exit:         1.826 us   |              }
smbd-26510 [001] 10861828.204177: funcgraph_exit:         5.527 us   |            }
smbd-26510 [001] 10861828.204178: funcgraph_entry:                   |            security_inode_permission() {
smbd-26510 [001] 10861828.204179: funcgraph_entry:                   |              selinux_inode_permission() {
smbd-26510 [001] 10861828.204180: funcgraph_entry:                   |                inode_has_perm() {
smbd-26510 [001] 10861828.204180: funcgraph_entry:                   |                  avc_has_perm() {
smbd-26510 [001] 10861828.204181: funcgraph_entry:        1.443 us   |                    avc_has_perm_noaudit();
smbd-26510 [001] 10861828.204183: funcgraph_entry:        0.593 us   |                    avc_audit();
smbd-26510 [001] 10861828.204184: funcgraph_exit:         3.735 us   |                  }
smbd-26510 [001] 10861828.204184: funcgraph_exit:         4.892 us   |                }
smbd-26510 [001] 10861828.204185: funcgraph_exit:         5.910 us   |              }
smbd-26510 [001] 10861828.204185: funcgraph_exit:         7.219 us   |            }
smbd-26510 [001] 10861828.204186: funcgraph_entry:                   |            do_lookup() {
smbd-26510 [001] 10861828.204187: funcgraph_entry:                   |              __d_lookup() {
smbd-26510 [001] 10861828.204208: funcgraph_entry:      + 19.857 us  |                _spin_lock();
smbd-26510 [001] 10861828.204210: funcgraph_exit:       + 23.168 us  |              }
smbd-26510 [001] 10861828.204210: funcgraph_entry:                   |              follow_managed() {
smbd-26510 [001] 10861828.204211: funcgraph_entry:                   |                lookup_mnt() {
smbd-26510 [001] 10861828.204211: funcgraph_entry:        0.496 us   |                  _spin_lock();
smbd-26510 [001] 10861828.204212: funcgraph_entry:        1.007 us   |                  __lookup_mnt();
smbd-26510 [001] 10861828.204214: funcgraph_exit:         3.066 us   |                }
smbd-26510 [001] 10861828.204215: funcgraph_entry:        0.601 us   |                dput();
smbd-26510 [001] 10861828.204216: funcgraph_exit:         5.659 us   |              }
smbd-26510 [001] 10861828.204217: funcgraph_exit:       + 30.543 us  |            }
smbd-26510 [001] 10861828.204218: funcgraph_entry:        0.519 us   |            dput();
smbd-26510 [001] 10861828.204219: funcgraph_entry:        0.485 us   |            mntput_no_expire();
smbd-26510 [001] 10861828.204220: funcgraph_entry:                   |            acl_permission_check() {
smbd-26510 [001] 10861828.204221: funcgraph_entry:                   |              ext4_check_acl() {
smbd-26510 [001] 10861828.204221: funcgraph_entry:        0.751 us   |                ext4_get_acl();
smbd-26510 [001] 10861828.204222: funcgraph_exit:         1.660 us   |              }
smbd-26510 [001] 10861828.204223: funcgraph_entry:                   |              in_group_p() {
smbd-26510 [001] 10861828.204223: funcgraph_entry:        0.530 us   |                groups_search();
smbd-26510 [001] 10861828.204224: funcgraph_exit:         1.455 us   |              }
smbd-26510 [001] 10861828.204225: funcgraph_exit:         4.949 us   |            }
smbd-26510 [001] 10861828.204225: funcgraph_entry:                   |            security_inode_permission() {
smbd-26510 [001] 10861828.204226: funcgraph_entry:                   |              selinux_inode_permission() {
smbd-26510 [001] 10861828.204226: funcgraph_entry:                   |                inode_has_perm() {
smbd-26510 [001] 10861828.204227: funcgraph_entry:                   |                  avc_has_perm() {
smbd-26510 [001] 10861828.204228: funcgraph_entry:        0.849 us   |                    avc_has_perm_noaudit();
smbd-26510 [001] 10861828.204229: funcgraph_entry:        0.496 us   |                    avc_audit();
smbd-26510 [001] 10861828.204230: funcgraph_exit:         2.754 us   |                  }
smbd-26510 [001] 10861828.204231: funcgraph_exit:         4.186 us   |                }
smbd-26510 [001] 10861828.204231: funcgraph_exit:         5.159 us   |              }
smbd-26510 [001] 10861828.204231: funcgraph_exit:         6.132 us   |            }
smbd-26510 [001] 10861828.204232: funcgraph_entry:                   |            do_lookup() {
smbd-26510 [001] 10861828.204232: funcgraph_entry:                   |              __d_lookup() {
smbd-26510 [001] 10861828.204234: funcgraph_entry:        0.451 us   |                _spin_lock();
smbd-26510 [001] 10861828.204235: funcgraph_exit:         2.446 us   |              }
smbd-26510 [001] 10861828.204235: funcgraph_entry:        0.503 us   |              follow_managed();
smbd-26510 [001] 10861828.204236: funcgraph_exit:         4.343 us   |            }
smbd-26510 [001] 10861828.204237: funcgraph_entry:        0.462 us   |            dput();
smbd-26510 [001] 10861828.204238: funcgraph_entry:                   |            acl_permission_check() {
smbd-26510 [001] 10861828.204239: funcgraph_entry:                   |              ext4_check_acl() {
smbd-26510 [001] 10861828.204239: funcgraph_entry:        0.579 us   |                ext4_get_acl();
smbd-26510 [001] 10861828.204240: funcgraph_exit:         1.484 us   |              }
smbd-26510 [001] 10861828.204241: funcgraph_entry:                   |              in_group_p() {
smbd-26510 [001] 10861828.204241: funcgraph_entry:        0.481 us   |                groups_search();
smbd-26510 [001] 10861828.204242: funcgraph_exit:         1.383 us   |              }
smbd-26510 [001] 10861828.204243: funcgraph_exit:         4.479 us   |            }
smbd-26510 [001] 10861828.204243: funcgraph_entry:                   |            security_inode_permission() {
smbd-26510 [001] 10861828.204244: funcgraph_entry:                   |              selinux_inode_permission() {
smbd-26510 [001] 10861828.204244: funcgraph_entry:                   |                inode_has_perm() {
smbd-26510 [001] 10861828.204245: funcgraph_entry:                   |                  avc_has_perm() {
smbd-26510 [001] 10861828.204245: funcgraph_entry:        0.786 us   |                    avc_has_perm_noaudit();
smbd-26510 [001] 10861828.204246: funcgraph_entry:        0.461 us   |                    avc_audit();
smbd-26510 [001] 10861828.204247: funcgraph_exit:         2.638 us   |                  }
smbd-26510 [001] 10861828.204248: funcgraph_exit:         3.814 us   |                }
smbd-26510 [001] 10861828.204248: funcgraph_exit:         4.727 us   |              }
smbd-26510 [001] 10861828.204249: funcgraph_exit:         5.647 us   |            }
smbd-26510 [001] 10861828.204249: funcgraph_entry:                   |            do_lookup() {
smbd-26510 [001] 10861828.204250: funcgraph_entry:                   |              __d_lookup() {
smbd-26510 [001] 10861828.204253: funcgraph_entry:        0.451 us   |                _spin_lock();
smbd-26510 [001] 10861828.204254: funcgraph_exit:         4.645 us   |              }
smbd-26510 [001] 10861828.204255: funcgraph_entry:        0.466 us   |              follow_managed();
smbd-26510 [001] 10861828.204256: funcgraph_exit:         6.492 us   |            }
smbd-26510 [001] 10861828.204257: funcgraph_entry:                   |            path_to_nameidata() {
smbd-26510 [001] 10861828.204257: funcgraph_entry:        0.466 us   |              dput();
smbd-26510 [001] 10861828.204258: funcgraph_exit:         1.402 us   |            }
smbd-26510 [001] 10861828.204272: funcgraph_exit:       + 87.715 us  |          }
smbd-26510 [001] 10861828.204273: funcgraph_entry:                   |          path_put() {
smbd-26510 [001] 10861828.204273: funcgraph_entry:        0.508 us   |            dput();
smbd-26510 [001] 10861828.204274: funcgraph_entry:        0.481 us   |            mntput_no_expire();
smbd-26510 [001] 10861828.204275: funcgraph_exit:         2.544 us   |          }
smbd-26510 [001] 10861828.204276: funcgraph_exit:       ! 105.077 us |        }
smbd-26510 [001] 10861828.204276: funcgraph_entry:                   |        path_put() {
smbd-26510 [001] 10861828.204277: funcgraph_entry:        0.462 us   |          dput();
smbd-26510 [001] 10861828.204277: funcgraph_entry:        0.459 us   |          mntput_no_expire();
smbd-26510 [001] 10861828.204278: funcgraph_exit:         2.270 us   |        }
smbd-26510 [001] 10861828.204279: funcgraph_exit:       ! 111.221 us |      }
smbd-26510 [001] 10861828.204279: funcgraph_entry:                   |      putname() {
smbd-26510 [001] 10861828.204280: funcgraph_entry:                   |        final_putname() {
smbd-26510 [001] 10861828.204280: funcgraph_entry:        0.567 us   |          kmem_cache_free();
smbd-26510 [001] 10861828.204281: funcgraph_exit:         1.499 us   |        }
smbd-26510 [001] 10861828.204282: funcgraph_exit:         2.431 us   |      }
smbd-26510 [001] 10861828.204282: funcgraph_exit:       ! 120.501 us |    }
smbd-26510 [001] 10861828.204283: funcgraph_entry:                   |    inode_permission() {
smbd-26510 [001] 10861828.204283: funcgraph_entry:                   |      generic_permission() {
smbd-26510 [001] 10861828.204284: funcgraph_entry:                   |        acl_permission_check() {
smbd-26510 [001] 10861828.204285: funcgraph_entry:                   |          in_group_p() {
smbd-26510 [001] 10861828.204285: funcgraph_entry:        0.533 us   |            groups_search();
smbd-26510 [001] 10861828.204286: funcgraph_exit:         1.416 us   |          }
smbd-26510 [001] 10861828.204286: funcgraph_exit:         2.570 us   |        }
smbd-26510 [001] 10861828.204287: funcgraph_entry:                   |        capable() {
smbd-26510 [001] 10861828.204287: funcgraph_entry:                   |          security_capable() {
smbd-26510 [001] 10861828.204288: funcgraph_entry:                   |            selinux_capable() {
smbd-26510 [001] 10861828.204288: funcgraph_entry:        0.463 us   |              cap_capable();
smbd-26510 [001] 10861828.204289: funcgraph_exit:         1.390 us   |            }
smbd-26510 [001] 10861828.204290: funcgraph_exit:         2.409 us   |          }
smbd-26510 [001] 10861828.204290: funcgraph_exit:         3.351 us   |        }
smbd-26510 [001] 10861828.204291: funcgraph_entry:                   |        capable() {
smbd-26510 [001] 10861828.204291: funcgraph_entry:                   |          security_capable() {
smbd-26510 [001] 10861828.204292: funcgraph_entry:                   |            selinux_capable() {
smbd-26510 [001] 10861828.204292: funcgraph_entry:        0.451 us   |              cap_capable();
smbd-26510 [001] 10861828.204293: funcgraph_exit:         1.349 us   |            }
smbd-26510 [001] 10861828.204293: funcgraph_exit:         2.232 us   |          }
smbd-26510 [001] 10861828.204294: funcgraph_exit:         3.114 us   |        }
smbd-26510 [001] 10861828.204294: funcgraph_exit:       + 10.922 us  |      }
smbd-26510 [001] 10861828.204295: funcgraph_exit:       + 12.024 us  |    }
smbd-26510 [001] 10861828.204295: funcgraph_entry:                   |    path_put() {
smbd-26510 [001] 10861828.204296: funcgraph_entry:        0.455 us   |      dput();
smbd-26510 [001] 10861828.204297: funcgraph_entry:        0.455 us   |      mntput_no_expire();
smbd-26510 [001] 10861828.204297: funcgraph_exit:         2.243 us   |    }
smbd-26510 [001] 10861828.204298: funcgraph_exit:       ! 136.819 us |  }
[...]

Now the real problem down to earth problem. I have a RHEL 6.5 64bit with SELinux enabled and enforced. I want to share the httpd logs via a read-only samba share. I have tried to give proper access to both apache and samba with:

setsebool -P allow_httpd_anon_write=1
semanage fcontext -a -t public_content_rw_t '/var/log/httpd(/.*)?'
restorecon -R /var/log/httpd

The samba share configuration for this particular share is:

[apache-logs]
    path = /var/log/httpd/
    writable = no

Nothing is logged in SELinux audit file /var/log/audit/audit.log for this chdir(2). Any help would appreciated.

My CentOS LXC containers are not starting anymore on an Ubuntu 14.10 machine. I think that the problem started after a reboot, but I am not sure.

I had a similar problem after an yum update, when the init scripts were replaced with stock ones that are not LXC aware. They were trying to start udev, etc... But this timeI have this problem for all CentOS instances, even for those newly created.

Host OS: Ubuntu14.10 64bit
Guest OS: Centos 6.5 64bit

root@ubuntu-mvutcovici:~# lxc-start --logfile stash-lxc.log --logpriority DEBUG -dn stash
lxc-start: lxc_start.c: main: 337 The container failed to start.
lxc-start: lxc_start.c: main: 339 To get more details, run the container in foreground mode.
lxc-start: lxc_start.c: main: 341 Additional information can be obtained by setting the --logfile and --logpriority options.
root@ubuntu-mvutcovici:~#

Here is the content of stash-lxc.log file:

lxc-start 1416596262.928 INFO     lxc_start_ui - lxc_start.c:main:265 - using rcfile /var/lib/lxc/stash/config
lxc-start 1416596262.928 WARN     lxc_confile - confile.c:config_pivotdir:1685 - lxc.pivotdir is ignored.  It will soon become an error.
lxc-start 1416596262.928 WARN     lxc_log - log.c:lxc_log_init:316 - lxc_log_init called with log already initialized
lxc-start 1416596262.929 INFO     lxc_start - start.c:lxc_check_inherited:209 - closed inherited fd 4
lxc-start 1416596262.934 INFO     lxc_lsm - lsm/lsm.c:lsm_init:48 - LSM security driver AppArmor
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .[all].
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .kexec_load errno 1.
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:358 - Adding non-compat rule for kexec_load action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:369 - Adding compat rule for kexec_load action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:382 - Really adding compat rule bc nr1 == nr2 (283, 246)
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .open_by_handle_at errno 1.
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:358 - Adding non-compat rule for open_by_handle_at action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:369 - Adding compat rule for open_by_handle_at action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:382 - Really adding compat rule bc nr1 == nr2 (342, 304)
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .init_module errno 1.
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:358 - Adding non-compat rule for init_module action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:369 - Adding compat rule for init_module action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:382 - Really adding compat rule bc nr1 == nr2 (128, 175)
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .finit_module errno 1.
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:358 - Adding non-compat rule for finit_module action 327681
lxc-start 1416596262.934 WARN     lxc_seccomp - seccomp.c:do_resolve_add_rule:196 - Seccomp: got negative # for syscall: finit_module
lxc-start 1416596262.934 WARN     lxc_seccomp - seccomp.c:do_resolve_add_rule:197 - This syscall will NOT be blacklisted
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:369 - Adding compat rule for finit_module action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:377 - Adding non-compat rule bc nr1 == nr2 (-10085, -10085)
lxc-start 1416596262.934 WARN     lxc_seccomp - seccomp.c:do_resolve_add_rule:196 - Seccomp: got negative # for syscall: finit_module
lxc-start 1416596262.934 WARN     lxc_seccomp - seccomp.c:do_resolve_add_rule:197 - This syscall will NOT be blacklisted
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:285 - processing: .delete_module errno 1.
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:358 - Adding non-compat rule for delete_module action 327681
lxc-start 1416596262.934 INFO     lxc_seccomp - seccomp.c:parse_config_v2:369 - Adding compat rule for delete_module action 327681
lxc-start 1416596262.935 INFO     lxc_seccomp - seccomp.c:parse_config_v2:382 - Really adding compat rule bc nr1 == nr2 (129, 176)
lxc-start 1416596262.935 INFO     lxc_seccomp - seccomp.c:parse_config_v2:390 - Merging in the compat seccomp ctx into the main one
lxc-start 1416596262.935 DEBUG    lxc_conf - conf.c:lxc_create_tty:3504 - allocated pty '/dev/pts/2' (5/6)
lxc-start 1416596262.935 DEBUG    lxc_conf - conf.c:lxc_create_tty:3504 - allocated pty '/dev/pts/4' (7/8)
lxc-start 1416596262.935 DEBUG    lxc_conf - conf.c:lxc_create_tty:3504 - allocated pty '/dev/pts/5' (9/10)
lxc-start 1416596262.935 DEBUG    lxc_conf - conf.c:lxc_create_tty:3504 - allocated pty '/dev/pts/7' (11/12)
lxc-start 1416596262.935 INFO     lxc_conf - conf.c:lxc_create_tty:3515 - tty's configured
lxc-start 1416596262.935 DEBUG    lxc_start - start.c:setup_signal_fd:247 - sigchild handler set
lxc-start 1416596262.935 DEBUG    lxc_console - console.c:lxc_console_peer_default:536 - no console peer
lxc-start 1416596262.935 INFO     lxc_start - start.c:lxc_init:443 - 'stash' is initialized
lxc-start 1416596262.936 DEBUG    lxc_start - start.c:__lxc_start:1061 - Not dropping cap_sys_boot or watching utmp
lxc-start 1416596262.936 INFO     lxc_start - start.c:lxc_check_inherited:209 - closed inherited fd 4
lxc-start 1416596262.940 INFO     lxc_monitor - monitor.c:lxc_monitor_sock_name:177 - using monitor sock name lxc/ad055575fe28ddd5//var/lib/lxc
lxc-start 1416596262.943 DEBUG    lxc_conf - conf.c:instanciate_veth:2842 - instanciated veth 'vethF4JUT8/vethVOPS0P', index is '11'
lxc-start 1416596262.943 INFO     lxc_cgroup - cgroup.c:cgroup_init:62 - cgroup driver cgmanager initing for stash
lxc-start 1416596262.948 INFO     lxc_cgmanager - cgmanager.c:cgm_setup_limits:1241 - cgroup limits have been setup
lxc-start 1416596262.977 DEBUG    lxc_conf - conf.c:lxc_assign_network:3259 - move '(null)' to '11664'
lxc-start 1416596262.978 DEBUG    lxc_conf - conf.c:setup_rootfs:1536 - mounted '/var/lib/lxc/stash/rootfs' on '/usr/lib/x86_64-linux-gnu/lxc'
lxc-start 1416596262.978 INFO     lxc_conf - conf.c:setup_utsname:896 - 'stash' hostname has been setup
lxc-start 1416596263.005 DEBUG    lxc_conf - conf.c:setup_hw_addr:2392 - mac address 'fe:fb:95:37:ac:3c' on 'eth0' has been setup
lxc-start 1416596263.005 DEBUG    lxc_conf - conf.c:setup_netdev:2619 - 'eth0' has been setup
lxc-start 1416596263.005 INFO     lxc_conf - conf.c:setup_network:2640 - network has been setup
lxc-start 1416596263.005 INFO     lxc_conf - conf.c:setup_ttydir_console:1688 - created /usr/lib/x86_64-linux-gnu/lxc/dev/lxc
lxc-start 1416596263.005 INFO     lxc_conf - conf.c:setup_ttydir_console:1734 - console has been setup on lxc/console
lxc-start 1416596263.006 INFO     lxc_conf - conf.c:setup_tty:1023 - 4 tty(s) has been setup
lxc-start 1416596263.006 INFO     lxc_conf - conf.c:do_tmp_proc_mount:3809 - I am 1, /proc/self points to '1'
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_rootfs_pivot_root:1078 - pivot_root syscall to '/usr/lib/x86_64-linux-gnu/lxc' successful
lxc-start 1416596263.029 INFO     lxc_conf - conf.c:setup_pts:1605 - created new pts instance
lxc-start 1416596263.029 INFO     lxc_conf - conf.c:setup_personality:1622 - set personality to '0x0'
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'mac_admin' (33)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'mac_override' (32)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'sys_time' (25)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'sys_module' (16)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'setfcap' (31)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'setpcap' (8)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'sys_nice' (23)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'sys_pacct' (20)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2303 - drop capability 'sys_rawio' (17)
lxc-start 1416596263.029 DEBUG    lxc_conf - conf.c:setup_caps:2312 - capabilities have been setup
lxc-start 1416596263.029 NOTICE   lxc_conf - conf.c:lxc_setup:4144 - 'stash' is setup.
lxc-start 1416596263.029 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.deny' set to 'a'
lxc-start 1416596263.029 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c *:* m'
lxc-start 1416596263.030 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'b *:* m'
lxc-start 1416596263.030 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 1:3 rwm'
lxc-start 1416596263.030 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 1:5 rwm'
lxc-start 1416596263.030 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 1:7 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 5:0 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 5:1 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 5:2 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 1:8 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 1:9 rwm'
lxc-start 1416596263.031 DEBUG    lxc_cgmanager - cgmanager.c:cgm_setup_limits:1237 - cgroup 'devices.allow' set to 'c 136:* rwm'
lxc-start 1416596263.031 INFO     lxc_cgmanager - cgmanager.c:cgm_setup_limits:1241 - cgroup limits have been setup
lxc-start 1416596263.031 ERROR    lxc_apparmor - lsm/apparmor.c:mount_feature_enabled:61 - Permission denied - Error mounting securityfs
lxc-start 1416596263.032 WARN     lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:184 - Incomplete AppArmor support in your kernel
lxc-start 1416596263.032 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:186 - If you really want to start this container, set
lxc-start 1416596263.032 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:187 - lxc.aa_allow_incomplete = 1
lxc-start 1416596263.032 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:188 - in your container configuration file
lxc-start 1416596263.032 ERROR    lxc_sync - sync.c:__sync_wait:51 - invalid sequence number 1. expected 4
lxc-start 1416596263.032 ERROR    lxc_start - start.c:__lxc_start:1087 - failed to spawn 'stash'
lxc-start 1416596263.032 WARN     lxc_commands - commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to receive response
lxc-start 1416596263.032 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.032 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing name=systemd:lxc/stash-3
lxc-start 1416596263.032 WARN     lxc_cgmanager - cgmanager.c:cgm_get:946 - do_cgm_get exited with error
lxc-start 1416596263.032 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.032 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing perf_event:lxc/stash-3
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing net_prio:lxc/stash-3
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing net_cls:lxc/stash-3
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing memory:lxc/stash-3
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing hugetlb:lxc/stash-3
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.033 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing freezer:lxc/stash-3
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing devices:lxc/stash-3
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing cpuset:lxc/stash-3
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing cpuacct:lxc/stash-3
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.034 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing cpu:lxc/stash-3
lxc-start 1416596263.035 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:503 - call to cgmanager_remove_sync failed: invalid request
lxc-start 1416596263.035 ERROR    lxc_cgmanager - cgmanager.c:cgm_remove_cgroup:505 - Error removing blkio:lxc/stash-3
lxc-start 1416596268.038 ERROR    lxc_start_ui - lxc_start.c:main:337 - The container failed to start.
lxc-start 1416596268.038 ERROR    lxc_start_ui - lxc_start.c:main:339 - To get more details, run the container in foreground mode.
lxc-start 1416596268.038 ERROR    lxc_start_ui - lxc_start.c:main:341 - Additional information can be obtained by setting the --logfile and --logpriority options.

To create all those CentOS instances I've used:

root@ubuntu-mvutcovici:~# lxc-create -t centos -f lxc-mircea.conf -n stash
root@ubuntu-mvutcovici:~# cat lxc-mircea.conf
lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up

EDIT: It seems that adding lxc.aa_allow_incomplete = 1 into /var/lib/lxc/stash/config file is a workaround for the start problem. How can I make app armor coexist again with CentOS LXC?

From lxc.container.conf man page:

   lxc.aa_allow_incomplete
          Apparmor profiles are pathname based. Therefore many file restrictions require mount restrictions to be effective against a determined attacker. However, these  mount  restrictions  are  not  yet  implemented  in  the
          upstream kernel. Without the mount restrictions, the apparmor profiles still protect against accidental damager.

          If  this  flag is 0 (default), then the container will not be started if the kernel lacks the apparmor mount features, so that a regression after a kernel upgrade will be detected. To start the container under partial
          apparmor protection, set this flag to 1.

EDIT2: added original /var/lib/lxc/stash/config file:

# Template used to create this container: /usr/share/lxc/templates/lxc-centos
# Parameters passed to the template:
# For additional config options, please look at lxc.container.conf(5)
lxc.network.type = veth
lxc.network.link = br0
lxc.network.hwaddr = fe:98:41:37:ca:3d
lxc.network.flags = up
lxc.rootfs = /var/lib/lxc/stash/rootfs

# Include common configuration
lxc.include = /usr/share/lxc/config/centos.common.conf

lxc.arch = x86_64
lxc.utsname = stash

lxc.autodev = 0

# When using LXC with apparmor, uncomment the next line to run unconfined:
#lxc.aa_profile = unconfined

# example simple networking setup, uncomment to enable
#lxc.network.type = veth
#lxc.network.flags = up
#lxc.network.link = lxcbr0
#lxc.network.name = eth0
# Additional example for veth network type
#    static MAC address,
#lxc.network.hwaddr = 00:16:3e:77:52:20
#    persistent veth device name on host side
#        Note: This may potentially collide with other containers of same name!
#lxc.network.veth.pair = v-stash-e0

I have an old Solaris 10U1 that does not have zoneadm detach command. Only the following subcommands are supported:

• help
• boot
• halt
• ready
• reboot
• list
• verify
• install
• uninstall

I need this to move the zones to a Solaris10U9.

I have a bunch of RedHat VMs that I need to set a static IPv4 routing table. I want to centralize this configuration and it came to my mind the DHCP service that could provide this information (see RFC3442).

• Does any of the DHCP clients that came with RHEL 5, and RHEL6 supports this feature?
• Is there any other alternative for doing routing table provisioning?
• Switching to IPv6 would ease this configurations?

Any other idea is welcome.

See: RFC3442 - Classless Static Route Option for DHCPv4

Is it possible to add in the routing table a description for a route?

Something like:

ip route add 192.168.10.1/24 via 192.168.1.1 description "route to the example network"

I would like when I am running ip route show to see these descriptions to be able to manage easier the routing table.

How can I see the MAC address table of a Windows network bridge? Is it possible trough command line to find this information?

EDIT: I am interested to see the same table that it is possible to see in the managed switches (e.g. like the Cisco's show mac-address-table or Linux brctl showmacs br0)

I would like to configure the terminal type by detecting it. For example when I am connecting to a Solaris box with PuTTY, the $TERM variable is set to vt100. I would like to negotiate this so, when the terminal emulator is PuTTY, to set $TERM to xterm.

I've noticed that at ^E PuTTY answers back with PuTTY. But I think that the best method is to use tput to try to detect the terminal emulator type. The problem is that I could not find any reference in the terminfo or tput manual how to do this.

Otherwise I will try with something based on:

unset remote_term;echo $'\cE';read -rt 1 -n5 remote_term ;echo remote_term=$remote_term

I want to have different mounts that are seen only by a specific process or user. One use case I am thinking about is when I want to mount a unionfs or aufs that will be available for one user. So I can have multiple mounts on the same mount point that are different for different users.

I would like to assign multiple IP addresses via DHCP on the same interface. Does the DHCP protocol and DHCP servers allowing this?

I am having a hard time to find where it is documented that the source port should be random and in the range 1024-65535.

In which RFC is this documented?

Edit:
First reference for privileged ports is in RFC2623
It seems that this is depending more on the TCP/IP implementation and it is a de-facto standard.

IANA is assigning the port numbers (RFC1700)

VMware vSphere Client can not run in wine. Neither in Mono.

What tools are you using to create, start/stop new VMs, connect on the console without VMware vSphere Client?

What rule do you follow when buying disks for RAID arrays:

• to buy the disk as similar as possible?
• to buy the disks from different manufacturers?

Some people chose the same type for performance and compatibility reasons. Some chose different manufacturers to lower the chances for 2 disk to fail at the same time.