Ubuntu
lxc package

rsyslogd fails to start in cloud template

Bug #978147 reported by Kapil Thangavelu
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
lxc (Ubuntu)
Fix Released
High
Unassigned
rsyslog (Ubuntu)
Won't Fix
Undecided
Unassigned

Bug Description

Attempting to use the cloud-init functionality of the new 'ubuntu-cloud' template fails due to a rsyslog not starting.

Looking at the rsyslog upstart job, it appears that the app armor profile here is causing the issue. Part of this is might be due to the lack of containerization around syslog call as noted by hallyn.

Commenting out rsyslogd app armor usage, allows it to start, and cloud-init proceeds.

Kapil Thangavelu (hazmat)
Changed in lxc (Ubuntu):
importance: Undecided → High
status: New → Confirmed
Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

The problem is that rsyslog does

/lib/init/apparmor-profile-load usr.sbin.rsyslogd

in pre-start and isn't allowed to.

What's the best thing to do? not do that in a container? Ignore -EPERM failures?

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

It seems rsyslog's policy is by default disabled.

The actual bug is because apparmor-profile-load isn't allowed to read /sys/module/apparmor/parameters/enabled, and then returns failure.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Upstart and apparmor should be updated, not rsyslog. See bug #978297.

Changed in rsyslog (Ubuntu):
status: New → Won't Fix
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Should this bug be updated now that the upstart part of 978297 is fixed?

Revision history for this message
Serge Hallyn (serge-hallyn) wrote :

Yes. Thanks, Jamie.

Kapil,. can you re-try your experiment and see if everything now works?

I"ll optimistically mark the bug Fix Released. Please re-open if rsyslog still does not start, or open a new bug if you find new barriers to using the cloud template.

Changed in lxc (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.