Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stop-edgex.sh script generates lots of apparmor denials #4

Open
tonyespy opened this issue Apr 10, 2018 · 3 comments
Open

stop-edgex.sh script generates lots of apparmor denials #4

tonyespy opened this issue Apr 10, 2018 · 3 comments

Comments

@tonyespy
Copy link
Owner

The current edgex-core snap (0.5.1+cali-20180322) stop script generates lots of AppArmor denials due to its use of the 'ps' command.

Adding the interfaces system-observe (auto-connectable) and process-control should get rid of most of these denials.

Tested on an Ubuntu 16.04 LTS Desktop system.

@tonyespy
Copy link
Owner Author

Note, adding plugs: [system-observe, process-control] gets rid of all but three AppArmor denials for stop-edgex.sh for "operation=capable".

@tonyespy
Copy link
Owner Author

And what I think now may be a regression is that when the stop-script now throws an error when it tries to kill device-virtual using "kill". The process-control interface is connected, and I'm pretty sure this previously worked. Here's the error generated:

+ kill_service 24463 device-virtual
+ echo sending SIGKILL to device-virtual (24463) service
sending SIGKILL to device-virtual (24463) service
+ kill -9 24463
/snap/edgexfoundry-core/x24/bin/stop-edgex.sh: 10: kill: Operation not permitted

This was the lazy way to take down the JRE, we may need to investigate whether or not java will exit in response to other signals.

Snap version: 0.5.2+cali-20180612 x24 run on Ubuntu 16.04 LTS running core snap 16-2.32.8 4650.

@tonyespy
Copy link
Owner Author

Hmmm, looks 'sudo' fixes the afore-mentioned problem with 'kill'. duh.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant