ci: bump ubuntu to 22.04 and use newer compilers / analyzers #5275

reinerh · 2022-07-25T21:51:53Z

No description provided.

reinerh · 2022-07-28T17:48:15Z

I'm having a weird test failure related to dns resolution.

$ firejail --trace --dns=208.67.222.222 -- curl --silent --output /dev/null debian.org
3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:bash:stat /home/runner/work/firejail/firejail/test/environment:0
3:bash:stat .:0
3:bash:stat /home:0
3:bash:stat /home/runner:0
3:bash:stat /home/runner/work:0
3:bash:stat /home/runner/work/firejail:0
3:bash:stat /home/runner/work/firejail/firejail:0
3:bash:stat /home/runner/work/firejail/firejail/test:0
3:bash:stat /home/runner/work/firejail/firejail/test/environment:0
3:bash:stat /home/runner/work/firejail/firejail/test:0
3:bash:stat .:0
3:bash:stat /home/linuxbrew/.linuxbrew/bin/curl:-1
3:bash:stat /home/linuxbrew/.linuxbrew/sbin/curl:-1
3:bash:stat /home/runner/.local/bin/curl:-1
3:bash:stat /opt/pipx_bin/curl:-1
3:bash:stat /home/runner/.cargo/bin/curl:-1
3:bash:stat /home/runner/.config/composer/vendor/bin/curl:-1
3:bash:stat /usr/local/.ghcup/bin/curl:-1
3:bash:stat /home/runner/.dotnet/tools/curl:-1
3:bash:stat /snap/bin/curl:-1
3:bash:stat /usr/local/sbin/curl:-1
3:bash:stat /usr/local/bin/curl:-1
3:bash:stat /usr/sbin/curl:-1
3:bash:stat /usr/bin/curl:0
3:bash:stat /usr/bin/curl:0
3:curl:stat /etc/gnutls/config:-1
3:curl:exec /usr/bin/curl:0
3:curl:fopen64 /usr/lib/ssl/openssl.cnf:0x564a3a8d67c0
3:curl:open /home/runner/.config/.curlrc:-1
3:curl:open /home/runner/.curlrc:-1
3:curl:open /home/runner/.curlrc:-1
3:curl:socket AF_INET6 SOCK_DGRAM IPPROTO_IP:5
3:curl:socket AF_INET SOCK_STREAM IPPROTO_TCP:7
3:curl:connect 7 149.20.4.15 port 80:-1
3:curl:fopen /dev/null:0x564a3a8d67c0
runner@fv-az247-751:~/work/firejail/firejail/test/environment$ TESTING ERROR 6.2

curl (and also wget) is not contacting the specified (or any other) nameserver.
Does anyone have an idea how the lookup could else work?
(Obviously I'm not able to reproduce it locally)

@rusty-snake @kmk3 @glitsj16

glitsj16 · 2022-07-28T22:58:15Z

curl (and also wget) is not contacting the specified (or any other) nameserver.
Does anyone have an idea how the lookup could else work?

Nothing very helpful comes to mind at the moment I'm afraid. Is there anything different in /etc/nsswitch.conf in Ubuntu 22.04 perhaps?

rusty-snake · 2022-07-29T16:20:09Z

As @glitsj16 said nsswich.conf is worth looking into. AFAIK systemd-resolved uses D-Bus or a custom UNIX socket.

reinerh · 2022-07-29T17:26:19Z

Thanks for the ideas. nsswitch.conf looks harmless, almost like on my system:

2022-07-29T16:38:41.7265620Z # /etc/nsswitch.conf
2022-07-29T16:38:41.7266122Z #
2022-07-29T16:38:41.7267090Z # Example configuration of GNU Name Service Switch functionality.
2022-07-29T16:38:41.7267919Z # If you have the `glibc-doc-reference' and `info' packages installed, try:
2022-07-29T16:38:41.7268566Z # `info libc "Name Service Switch"' for information about this file.
2022-07-29T16:38:41.7268964Z 
2022-07-29T16:38:41.7269160Z passwd:         files systemd
2022-07-29T16:38:41.7269485Z group:          files systemd
2022-07-29T16:38:41.7269960Z shadow:         files
2022-07-29T16:38:41.7270276Z gshadow:        files
2022-07-29T16:38:41.7270396Z 
2022-07-29T16:38:41.7270524Z hosts:          files dns
2022-07-29T16:38:41.7270855Z networks:       files
2022-07-29T16:38:41.7271027Z 
2022-07-29T16:38:41.7271344Z protocols:      db files
2022-07-29T16:38:41.7271953Z services:       db files
2022-07-29T16:38:41.7272376Z ethers:         db files
2022-07-29T16:38:41.7272748Z rpc:            db files
2022-07-29T16:38:41.7273186Z 
2022-07-29T16:38:41.7273410Z netgroup:       nis

With strace I could now see that curl is indeed using systemd for resolving the host (opening stuff in /run/systemd/resolve/ and connecting to 127.0.0.53:53.). Actually it looks like /etc/resolv.conf is symlinked to /run/systemd/resolve/....
I tried to blacklist the systemd directory, but it was still not opening the specified nameserver.
I think I'll just disable this test for now. It looks like --dns= does not properly work with systemd-resolved.

kmk3

Nice work on upgrading the distro/tooling versions.

Could you move the following commit to be the last one in the branch?

CI: bump ubuntu to 22.04 and use newer compilers / analyzers

That should make all commits pass CI.

grep was returning non-zero exit code if it did NOT find the error marker, and zero if it did.

firejail is no longer detecting that /etc/hosts is getting opened. in strace it can still be seen that the file is opened via syscall, but on C library layer (which firejail is tracing) it's probably implemented differently now.

…on CI runner

…oo long to check

Relates to #5275 #5357 #5370.

Changes: * Name them all "usage_str" * Make them const For the latter item, see commit eb20f52 ("Make list of paths const to fix a false positive of gcc analyzer", 2022-07-27) / PR netblue30#5275.

reinerh force-pushed the ci_ubuntu_2204 branch 3 times, most recently from c8dfaf6 to 26e0e4c Compare July 28, 2022 17:15

reinerh force-pushed the ci_ubuntu_2204 branch 3 times, most recently from 57e22b3 to 9147689 Compare July 29, 2022 17:18

reinerh force-pushed the ci_ubuntu_2204 branch from 9147689 to 3c15348 Compare July 29, 2022 17:29

reinerh marked this pull request as ready for review July 29, 2022 17:38

kmk3 approved these changes Jul 29, 2022

View reviewed changes

rusty-snake approved these changes Jul 30, 2022

View reviewed changes

reinerh added 10 commits July 30, 2022 10:48

CI: build all jobs with apparmor / selinux to cover more code

3a5954c

zero-initialize two variables

e47bc3b

Make list of paths const to fix a false positive of gcc analyzer

eb20f52

CI: fix wrong matching for test errors

057f431

grep was returning non-zero exit code if it did NOT find the error marker, and zero if it did.

tests: drop checking for hosts file in trace test

e1cb7ce

firejail is no longer detecting that /etc/hosts is getting opened. in strace it can still be seen that the file is opened via syscall, but on C library layer (which firejail is tracing) it's probably implemented differently now.

tests: add alternative message for skipping test

b4f4444

tests: try curl instead of wget for tracing dns resolution

4221b15

tests: disable calling curl in dns test, as systemd-resolved is used …

c971903

…on CI runner

CI: bump ubuntu to 22.04 and use newer compilers / analyzers

cfc8547

CI: keep old cppcheck job and ignore two files in new job that take t…

53f0b39

…oo long to check

reinerh force-pushed the ci_ubuntu_2204 branch from 3c15348 to 53f0b39 Compare July 30, 2022 08:49

reinerh merged commit 364a565 into master Jul 30, 2022

reinerh deleted the ci_ubuntu_2204 branch July 30, 2022 23:06

kmk3 changed the title ~~CI: bump ubuntu to 22.04 and use newer compilers / analyzers~~ ci: bump ubuntu to 22.04 and use newer compilers / analyzers Sep 26, 2022

kmk3 added a commit that referenced this pull request Sep 26, 2022

RELNOTES: add build/ci items

ce92f82

Relates to #5275 #5357 #5370.

kmk3 mentioned this pull request May 14, 2023

modif: Improve --version/--help & print version on startup #5829

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: bump ubuntu to 22.04 and use newer compilers / analyzers #5275

ci: bump ubuntu to 22.04 and use newer compilers / analyzers #5275

reinerh commented Jul 25, 2022

reinerh commented Jul 28, 2022 •

edited

Loading

glitsj16 commented Jul 28, 2022

rusty-snake commented Jul 29, 2022

reinerh commented Jul 29, 2022

kmk3 left a comment

ci: bump ubuntu to 22.04 and use newer compilers / analyzers #5275

ci: bump ubuntu to 22.04 and use newer compilers / analyzers #5275

Conversation

reinerh commented Jul 25, 2022

reinerh commented Jul 28, 2022 • edited Loading

glitsj16 commented Jul 28, 2022

rusty-snake commented Jul 29, 2022

reinerh commented Jul 29, 2022

kmk3 left a comment

Choose a reason for hiding this comment

reinerh commented Jul 28, 2022 •

edited

Loading