Skip to content

Try to disable apparmor for ntpd during add-topo#2674

Closed
wangxin wants to merge 1 commit intosonic-net:masterfrom
wangxin:disable-ntp-apparmor-pr
Closed

Try to disable apparmor for ntpd during add-topo#2674
wangxin wants to merge 1 commit intosonic-net:masterfrom
wangxin:disable-ntp-apparmor-pr

Conversation

@wangxin
Copy link
Collaborator

@wangxin wangxin commented Dec 16, 2020

Description of PR

Summary:
Fixes # (issue) sonic-net/sonic-buildimage#5975

Type of change

  • Bug fix
  • Testbed and Framework(new/improvement)
  • Test case(new/improvement)

Approach

What is the motivation for this PR?

This is to address the NTP testing failed issue reported here:
sonic-net/sonic-buildimage#5975
The reason is that apparmor is enabled for ntpd.

How did you do it?

The workaround is to always try to disable apparmor for ntpd during add-topo.
If disabling failed, generally it is because apparmor is not enabled for NTP on
the test server. So, 'ignore_errors: yes' is added to the tasks.

How did you verify/test it?

Test run the added tasks on test servers:

- hosts: servers:&vm_host
  gather_facts: no
  tasks:

  - name: Create link for disabling apparmor for ntpd
    file:
      src: /etc/apparmor.d/usr.sbin.ntpd
      dest: /etc/apparmor.d/disable/usr.sbin.ntpd
      state: link
    become: yes
    ignore_errors: yes

  - name: Disable apparmor for ntpd
    command: apparmor_parser -R /etc/apparmor.d/usr.sbin.ntpd
    become: yes
    ignore_errors: yes

Any platform specific information?

Supported testbed topology if it's a new test case?

Documentation

This is to address the NTP testing failed issue reported here:
sonic-net/sonic-buildimage#5975
The reason is that apparmor is enabled for ntpd. The workaround
is to always try to disable apparmor for ntpd during add-topo.
If disabling failed, generally it is because apparmor is not
enabled for NTP on the test server. So, 'ignore_errors: yes' is
added to the tasks.

Signed-off-by: Xin Wang <[email protected]>
@wangxin wangxin requested a review from a team December 16, 2020 03:45
@bingwang-ms
Copy link
Collaborator

retest vsimage, please

@wangxin
Copy link
Collaborator Author

wangxin commented Dec 16, 2020

retest vsimage please

become: yes
ignore_errors: yes

- name: Disable apparmor for ntpd
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't this task make use of the result of the previous task? what happens if you just run this command without the link in place?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The apparmor_parser command is required to disable apparmor for a service.
https://www.cyberciti.biz/faq/ubuntu-linux-howto-disable-apparmor-commands/

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how do we ensure that apparmor is disabled for ntp since we seem to ignore errors in both the task?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most of the test setups have apparmor disabled for NTP. In this case running the tasks would fail. These are just two best effort tasks. So, 'ignore_errors' is required.

@prsunny
Copy link
Contributor

prsunny commented Dec 17, 2020

@sumukhatv for viz

@lguohan
Copy link
Contributor

lguohan commented Dec 17, 2020

why is not an image fix? check this one?

https://github.com/Azure/sonic-buildimage/pull/6040/files

@wangxin
Copy link
Collaborator Author

wangxin commented Dec 18, 2020

We are using NTP server in the PTF container for testing. This is to fix the starting NTP server on PTF failed issue. The issue is not related with SONiC image. This PR is to change the configuration on test server.

@wangxin
Copy link
Collaborator Author

wangxin commented May 6, 2021

No such issue for a long time. This fix is unnecessary.

@wangxin wangxin closed this May 6, 2021
kazinator-arista pushed a commit to kazinator-arista/sonic-mgmt that referenced this pull request Mar 4, 2026
…sonic-net#14120)

linkmgrd:
* 046bdd0 2023-03-06 | [active-active] add state transition handler for (LinkProber: Unknown, MuxState: Active, LinkState: Down) (sonic-net#179) (HEAD -> 202205) [Jing Zhang]
* 15ba715 2023-03-06 | loose link down swithcover condition (sonic-net#178) [Jing Zhang]

utilities:
* 51d9c9f6 2023-03-06 | [warm/fast-reboot] Backup logs from tmpfs to disk during fast/warm shutdown (sonic-net#2714) (HEAD -> 202205) [Vaibhav Hemant Dixit]
* 03aa77b3 2023-03-02 | [ci] Fix pipeline issue caused by sonic-slave-* change. (sonic-net#2709) [Liu Shilong]
* 4bd7d4f1 2023-03-03 | [db_migrator] Add missing attribute 'weight' to route entries in APPL DB (sonic-net#2691) [Vaibhav Hemant Dixit]
* 69a60397 2023-03-01 | removed duplicates and resolved conflicts (sonic-net#2674) (github/202205) [kannankvs]

platform-daemon:
* 10bc119 2023-03-06 | [ycable] add changes for correcting telemetry values for 'active-active' (sonic-net#341) (HEAD -> 202205) [vdahiya12]

Signed-off-by: Ying Xie <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants