From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=BkN8NZXr; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 8A6175A0276 for ; Mon, 22 Sep 2025 22:03:45 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1758571424; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qFnbVEP+fvI8QMJU3fS5LEsStiKnVkpW5S/ijABOaPU=; b=BkN8NZXr5WWPQjKuQMry+JmgNYcbWdD5oF7EUJLogyEzW5D/JiRnSvSExslOLQudRaBxzg lzF8pcIyG92XbktrTAeTuxfvOAOAUfZHzgsbry+E0SgGL30Sf5ryxUTapD2TrZfCxWABlz 9JA3THo0RkMbaU6WiKLOr4I+K8LWLHc= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-526-tb45QUQPPLiiN8krzPfSSA-1; Mon, 22 Sep 2025 16:03:43 -0400 X-MC-Unique: tb45QUQPPLiiN8krzPfSSA-1 X-Mimecast-MFC-AGG-ID: tb45QUQPPLiiN8krzPfSSA_1758571422 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-46e1ac7110eso4800615e9.2 for ; Mon, 22 Sep 2025 13:03:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758571422; x=1759176222; h=content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=5bsEb92xbsh+oy3OLGRIn+vaNMsy3lLom0L9ac3cz1c=; b=JD9VI4H5xGZkBo6fne/aFyJ8I+pUasiVMdlzK/y7b1sbBL837gNXUqLixp+/tldD8F sHMIp96v8ZdPlDY2lImSXU/zHdRg6vb1KoZ2IbjiwW3/PKnKADXq3mDDwM8r3la+Mcxe weQzGEva/gOTcm8niUf5oHsQT4cFdLaIp/gazFfgAi6TCY1kX0LsIVdO4H8yzXgEwcnw tKKF8A1aK6ncdEYlMgSsFrnmhifXxWEX/EYRo4C3LQ3O6jGXtBekRLjz0wPYfO8ScS/x V5Wq/3DRFl8aNBKmEO8aLuy9RUicedQANORvGJp03dEvgNIZoiQOHkcqpBuYNRdXFWc7 v+yQ== X-Gm-Message-State: AOJu0YxW5+LAP1EWn4Qtecdp5oENcr2Nyt7xqqS9YFirduO2pw+/VjeZ TOhgXvWtjKKpFH7m1pNR0DWjMdfR9vVf+CdkBumYeHapCL7mETm+xFHbr+WUUs9ZXGkFGTAd0F8 Kj4O1/6qhYWiSEBKliD01Zr5QVyEaREE1v4quaGea3GFaez4fTH3Nig== X-Gm-Gg: ASbGncvXAIzwjhJ2yg/Iyx4U0wErMWRxcj9UeK4IANTlHjZpnxSYB96/UAwOdM5vIXh Hl7xRV/lpf8sShy7zHRI+ybpg/t5gECAt9LsFIqd9VIiSPVq/RIYZZ6dpXNoAzjjk1mcMPJOVnT GoylBtp9J0EVEGmIFPkIjVMv1wOVjkG9WhDJQn8BKFsEjZua++camD3RurfeT3Av3PmJEAczdwu 2cRAX9o45keVtDWqVJTUUTEXN97ouEu9IIv4fj9Ha73/0lOIjDQFuNfCyAFBnbNmF/VKq8LHDkb GyRLpgGKb1r7EWWYv85914s2g3LF7tE1fxdVVb+OLi79jL+x5iNpiXIGvpqZ3Tm9H7X8 X-Received: by 2002:a05:600c:1906:b0:45c:b56c:4183 with SMTP id 5b1f17b1804b1-46e1dab6235mr1491385e9.18.1758571420166; Mon, 22 Sep 2025 13:03:40 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHD79Tj2dMRpcIrJlc329DXJGpYHFvI/LRIQt97RVkVQa/JUs2/MTAA5UFwAuUOyCSj31nK/A== X-Received: by 2002:a05:600c:1906:b0:45c:b56c:4183 with SMTP id 5b1f17b1804b1-46e1dab6235mr1491145e9.18.1758571419674; Mon, 22 Sep 2025 13:03:39 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-464f4f9f4e4sm240645105e9.13.2025.09.22.13.03.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Sep 2025 13:03:39 -0700 (PDT) Date: Mon, 22 Sep 2025 22:03:38 +0200 From: Stefano Brivio To: Yumei Huang Subject: Re: [PATCH] test: Update README.md Message-ID: <20250922220338.49013fce@elisabeth> In-Reply-To: References: <20250919014329.6007-1-yuhuang@redhat.com> <20250919115822.4e3aab21@elisabeth> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: F-ZHoVn2hEjwexKChucrrdDU6RShLmwy-Kjt8iCiw7w_1758571422 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: MT7L5J2YPS2LTEART4NWQOVPSMRBGKMF X-Message-ID-Hash: MT7L5J2YPS2LTEART4NWQOVPSMRBGKMF X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, david@gibson.dropbear.id.au X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, 22 Sep 2025 11:03:23 +0800 Yumei Huang wrote: > On Fri, Sep 19, 2025 at 5:58=E2=80=AFPM Stefano Brivio wrote: > > > > On Fri, 19 Sep 2025 09:43:29 +0800 > > Yumei Huang wrote: > > =20 > > > Signed-off-by: Yumei Huang > > > --- > > > test/README.md | 31 +++++++++++++++++++++++++++++-- > > > 1 file changed, 29 insertions(+), 2 deletions(-) > > > > > > diff --git a/test/README.md b/test/README.md > > > index 91ca603..e3e9d37 100644 > > > --- a/test/README.md > > > +++ b/test/README.md > > > @@ -32,7 +32,7 @@ Example for Debian, and possibly most Debian-based = distributions: > > > git go iperf3 isc-dhcp-common jq libgpgme-dev libseccomp-dev lin= ux-cpupower > > > lm-sensors lz4 netavark netcat-openbsd psmisc qemu-efi-aarch64 > > > qemu-system-arm qemu-system-misc qemu-system-ppc qemu-system-x86 > > > - qemu-system-x86 sipcalc socat strace tmux uidmap valgrind > > > + sipcalc socat strace tmux uidmap valgrind > > > > > > NOTE: the tests need a qemu version >=3D 7.2, or one that contains c= ommit > > > 13c6be96618c ("net: stream: add unix socket"): this change introduce= s support > > > @@ -81,7 +81,12 @@ The following additional packages are commonly nee= ded: > > > > > > ## Regular test > > > > > > -Just issue: > > > +Before running the tests, you need to prepare the required assets: > > > + > > > + cd test > > > + make assets > > > + > > > +Then issue: > > > > > > ./run > > > > > > @@ -91,6 +96,28 @@ variable settings: DEBUG=3D1 enables debugging mes= sages, TRACE=3D1 enables tracing > > > > > > PCAP=3D1 TRACE=3D1 ./run > > > > > > +**Note:** > > > + > > > +* It's recommended to run the commands as a non-root user. > > > + Due to [Bug 967509](https://bugzilla.redhat.com/show_bug.cgi?id=3D= 967509), > > > + if you switch users with `su` or `sudo`, the directory `/run/user/= ID` may > > > + not be created. In that case, `XDG_RUNTIME_DIR` will incorrectly p= oint to > > > + `/run/user/0` instead of `/run/user/ID`, which can cause error. = =20 > > > > Thanks for the research, I wasn't aware of that, and recently spent > > quite some time figuring that out (for other reasons): > > > > https://issues.redhat.com/browse/RHEL-70222 > > > > in that case, XDG_RUNTIME_DIR was simply not set. Things were working > > with 'machinectl shell' instead. > > > > At the same time: running this whole stuff as root sounds rather crazy, > > unless it's a throw-away VMs with absolutely nothing important on it. > > > > That is, regardless of the issue with XDG_RUNTIME_DIR. I would maybe > > make the wording stronger, something like: > > > > * Don't run the tests as root, it's not needed! > > * If you really need to, note that ... > > =20 > > > + **Workaround:** Log out and log back in as the intended user to en= sure the > > > + correct runtime directory is set up. =20 > > > > We could also suggest 'machinectl shell' if it's really needed for > > whatever reason. =20 >=20 > I'm not sure how 'machinectl shell' works here. The error happens when > running 'make assets', > which calls 'prepare-distro-img.sh' script, which calls 'virsh edit'. Ah, I didn't know! So this is actually similar to https://issues.redhat.com/browse/RHEL-70222. > If we run 'make assets' with root, the error is like this: >=20 > ./prepare-distro-img.sh prepared-debian-8.11.0-openstack-amd64.qcow2 > libguestfs: error: could not create appliance through libvirt. > Original error from libvirt: Cannot access storage file > '/home/test/passt/test/prepared-debian-8.11.0-openstack-amd64.qcow2' > (as uid:107, gid:107): Permission denied [code=3D38 int1=3D13] >=20 > If we switch to a non-root user via 'su', the error is like this: >=20 > ./prepare-distro-img.sh prepared-debian-8.11.0-openstack-amd64.qcow2 > libvirt: XML-RPC error : Cannot create user runtime directory > '/run/user/0/libvirt': Permission denied > libguestfs: error: could not connect to libvirt (URI =3D > qemu:///session): Cannot create user runtime directory > '/run/user/0/libvirt': Permission denied [code=3D38 int1=3D13] > make: *** [Makefile:115: prepared-debian-8.11.0-openstack-amd64.qcow2] Er= ror 1 >=20 > Do you mean to run 'make assets' with 'machinectl shell'? What's the > exact cmd here? I tried this, seems not work. >=20 > # machinectl shell --uid=3D$(id -u pat) .host > /home/test/passt/test/make assets > Connected to the local host. Press ^] three times within 1s to exit s= ession. >=20 > Connection to the local host terminated. No, I mean using 'machinectl shell' instead of 'su' (it's intended as a replacement), that is: $ machinectl shell # make assets ...because that one will set XDG_RUNTIME_DIR. > > > +* SELinux may prevent the tests from running correctly. To avoid thi= s, > > > + temporarily disable it by running: > > > + > > > + setenforce 0 =20 > > > > By the way, other than the DHCP client not working on Fedora in a > > namespace (which we should really fix, I can look into it if you share > > the messages you're getting from /var/log/audit/audit.log), did you hit > > any other issue with it? > > =20 >=20 > Sure, I will send you a link containing the audit.log. > BTW, if 'setenforce 1', the tests would get stuck at 'DHCPv6 > :address'. Looks like an endless loop there. So except the very first > few tests, other tests haven't been executed. >=20 > =3D=3D=3D pasta/dhcp > DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:DEBUG:D= EBUG:DEBUG:DEBUG:DEBUG:DEBUG:> =20 > Interface name > DEBUG:DEBUG:? [ -n "eno8303" ] > DEBUG:DEBUG:...passed. >=20 > > DHCP: address =20 > DEBUG:DEBUG:DEBUG:DEBUG:? [ @EMPTY@ =3D 10.72.136.30 ] < failed. > DEBUG:DEBUG:...failed. >=20 > > DHCP: route =20 > DEBUG:DEBUG:DEBUG:? [ @EMPTY@ =3D 10.72.139.254 ] < failed. > DEBUG:DEBUG:...failed. >=20 > > DHCP: MTU =20 > DEBUG:DEBUG:? [ 1500 =3D 65520 ] < failed. > DEBUG:DEBUG:...failed. >=20 > > DHCPv6: address =20 > DEBUG: Thanks, so it's the issue David recently mentioned with dhclient-script(8) being prevented by SELinux from setting up addresses and routes via ip(8), even though it's in a detached namespace and that should be allowed. We should probably add something like we do in contrib/selinux/pasta.te to https://github.com/fedora-selinux/selinux-policy: roleattribute user_r usernetctl_roles; role usernetctl_roles types ; Now, we can disable SELinux temporarily to run tests, but eventually we'll want to have tests with DHCP clients in unprivileged setups also as part of Fedora automated tests, and I'm fairly sure that those run with SELinux in enforcing mode. So we should really fix this. By the way, it would also be interesting to see if, once the test suite gets past this point, you get further messages in audit.log. If you do 'setenforce 0', SELinux switches to the so-called "complain mode", and warnings are still logged, but they won't block anything. So, with 'setenforce 0', we can find out from audit.log if we would hit further failures. Maybe also relevant: https://github.com/fedora-selinux/selinux-policy/pull/1838 ...but it's not being merged for some reason. --=20 Stefano