Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

apparmor should be disabled by default on Ubuntu #10015

Open
4 of 14 tasks
DaanDeMeyer opened this issue Jun 7, 2024 · 4 comments
Open
4 of 14 tasks

apparmor should be disabled by default on Ubuntu #10015

DaanDeMeyer opened this issue Jun 7, 2024 · 4 comments
Assignees
@gdryke
Labels
Area: Common Tools bug report OS: Ubuntu

Comments

@DaanDeMeyer
Copy link
Contributor

Description

apparmor.service being enabled by default in the images causes various issues (e.g. https://gitlab.com/apparmor/apparmor/-/issues/402). Given these are ephemeral build VMs where users have full root access already and can trivially disable apparmor anyway, there's no real point in having apparmor enabled. It only serves to cause hard to debug issues. To avoid others running into these issues, I propose to disable apparmor in the runner images.

Platforms affected

  • Azure DevOps
  • GitHub Actions - Standard Runners
  • GitHub Actions - Larger Runners

Runner images affected

  • Ubuntu 20.04
  • Ubuntu 22.04
  • Ubuntu 24.04
  • macOS 11
  • macOS 12
  • macOS 13
  • macOS 13 Arm64
  • macOS 14
  • macOS 14 Arm64
  • Windows Server 2019
  • Windows Server 2022

Image version and build link

latest

Is it regression?

no

Expected behavior

apparmor is disabled by default

Actual behavior

apparmor is enabled by default

Repro steps

  • Run job
  • systemctl status apparmor will show that it is running
@DaanDeMeyer DaanDeMeyer changed the title apparmor should be disable by default on Ubuntu apparmor should be disabled by default on Ubuntu Jun 7, 2024
@ijunaidm ijunaidm self-assigned this Jun 10, 2024
@ijunaidm
Copy link
Contributor

@DaanDeMeyer - Thank you for bringing this issue to us, we are investigating on this issue and we will update you on this issue after our findings.

@mikhailkoliada mikhailkoliada mentioned this issue Jun 10, 2024
Merged
4 tasks
@GergelyKalmar GergelyKalmar mentioned this issue Oct 28, 2024
Merged
@ljmotta ljmotta mentioned this issue Dec 13, 2024
Merged
@kit-ty-kate
Copy link

any update?

kit-ty-kate added a commit to kit-ty-kate/opam that referenced this issue Dec 17, 2024
@kit-ty-kate
GHA: Fix CI by disabling apparmor
bff3894 
See actions/runner-images#10015 and ocaml#5968
kit-ty-kate added a commit to kit-ty-kate/opam that referenced this issue Dec 17, 2024
@kit-ty-kate
GHA: Fix CI by disabling apparmor
9002d47 
See actions/runner-images#10015 and ocaml#5968
@aloisklink aloisklink mentioned this issue Jan 9, 2025
Merged
3 tasks
@connor-baer connor-baer mentioned this issue Jan 13, 2025
Merged
5 tasks
@hartwork
Copy link

Here's the two projects (or pull requests) where I needed to tame AppArmor to unbreak CI for Ubuntu >=24.04 so far:

@jsf9k
Copy link

jsf9k commented Jan 21, 2025

FWIW, AppArmor also bit me.

praveenkumar added a commit to praveenkumar/minp that referenced this issue Jan 30, 2025
@praveenkumar
CI: Disable apparmor because of following error
bce8211 
- actions/runner-images#10015
```
[1/2] STEP 15/16: RUN echo '{"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}}' > /tmp/.pull-secret &&    /src/scripts/devenv-builder/configure-vm.sh --no-build --no-set-release-version --skip-dnf-update /tmp/.pull-secret &&    /src/okd/src/use_okd_assets.sh --replace ${OKD_REPO} ${OKD_VERSION_TAG}
sudo: PAM account management error: Authentication service cannot retrieve authentication info
```
praveenkumar added a commit to praveenkumar/minp that referenced this issue Jan 30, 2025
@praveenkumar
CI: Disable apparmor because of following error
89c8cab 
- actions/runner-images#10015
```
[1/2] STEP 15/16: RUN echo '{"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}}' > /tmp/.pull-secret &&    /src/scripts/devenv-builder/configure-vm.sh --no-build --no-set-release-version --skip-dnf-update /tmp/.pull-secret &&    /src/okd/src/use_okd_assets.sh --replace ${OKD_REPO} ${OKD_VERSION_TAG}
sudo: PAM account management error: Authentication service cannot retrieve authentication info
```
praveenkumar added a commit to praveenkumar/minp that referenced this issue Jan 30, 2025
@praveenkumar
CI: Disable apparmor because of following error
c87aacb 
- actions/runner-images#10015
```
[1/2] STEP 15/16: RUN echo '{"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}}' > /tmp/.pull-secret &&    /src/scripts/devenv-builder/configure-vm.sh --no-build --no-set-release-version --skip-dnf-update /tmp/.pull-secret &&    /src/okd/src/use_okd_assets.sh --replace ${OKD_REPO} ${OKD_VERSION_TAG}
sudo: PAM account management error: Authentication service cannot retrieve authentication info
```
@UdjinM6 UdjinM6 mentioned this issue Feb 6, 2025
Merged
5 tasks
PastaPastaPasta added a commit to dashpay/dash that referenced this issue Feb 7, 2025
@PastaPastaPasta
Merge #6560: ci: Disable apparmor user namespace restrictions in GH G…
53529cc 
…uix action

df34f0e ci: Disable apparmor user namespace restrictions in GH Guix action (UdjinM6)

Pull request description:

  ## Issue being fixed or feature implemented
  actions/runner-images#10015

  ## What was done?
  actions/runner-images#10443 (comment)

  ## How Has This Been Tested?
  develop: https://github.com/UdjinM6/dash/actions/runs/13187780750
  this PR: https://github.com/UdjinM6/dash/actions/runs/13187795136

  ## Breaking Changes
  n/a

  ## Checklist:
  - [ ] I have performed a self-review of my own code
  - [ ] I have commented my code, particularly in hard-to-understand areas
  - [ ] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

ACKs for top commit:
  PastaPastaPasta:
    utACK df34f0e

Tree-SHA512: 9353e5c74e46e829f36db168f425bd1f26e3bd6ca630fe915f5cbe66565517a2794c5c87dfd996d56ec2aad28da4ad0fca9aa088188d53f20e73a2387ed22643
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gdryke gdryke

Labels
Area: Common Tools bug report OS: Ubuntu
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@hartwork @kit-ty-kate @jsf9k @DaanDeMeyer @gdryke @mikhailkoliada @ijunaidm @kishorekumar-anchala