 this:
<jdstrand> [86131.195871] audit: type=1400 audit(1571232667.748:226767): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="snap.kubernetes-worker.containerd" name="/usr/local/bin/proxy-init" pid=10902 comm="runc:[2:INIT]" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="cri-containerd.apparmor.d"
<jdstrand> ijohnson: the theory is it has to do with runAsUser
<jdstrand> kjackal, joedborg (cc joeubuntu, amurray): so that denial ^ is going to require not insignificant investigation, possibly from other members of the security team. nnp is quite problematic with LSMs with current kernels
<joedborg> jdstrand: nnp?
<jdstrand> kjackal, joedborg (cc joeubuntu, amurray): this is unplanned work and beyond the strict mode k8s minimum viable product
<jdstrand> joedborg: 'no new privs'
 * joedborg reads kernel.org
<joedborg> jdstrand: ah okay, cool
<kjackal> jdstrand: This denial came up with the DNS addon and had to patch it https://github.com/ubuntu/microk8s/blob/feature/strict-v3/microk8s-resources/actions/coredns.yaml#L105
<jdstrand> kjackal (cc joedborg, joeubuntu, amurray): without investigating, my concern is this may require kernel changes for things to run unpatched
<kjackal> meaning, it is rather common
<jdstrand> kjackal: indeed. this isn't 'just a snapd' thing
<jdstrand> kjackal (cc joeubuntu, amurray and joedborg): I suggest trying to work around it for now. if you need me/the security team to investigate it, we likely need to discuss prioritizing/resourcing with Tim and Joe
<kjackal> yeap
<ijohnson> jdstrand: hmm I don't think I've seen that one
this: 
 < jdstrand > [ 86131.195871 ] audit: type=1400 audit(1571232667.748:226767 ): apparmor="DENIED " operation="exec " info="no new privs " error=-1 profile="snap.kubernetes - worker.containerd " name="/usr / local / bin / proxy - init " pid=10902 comm="runc:[2: INIT ] " requested_mask="x " denied_mask="x " fsuid=0 ouid=0 target="cri - containerd.apparmor.d " 
 < jdstrand > ijohnson: the theory is it has to cause with runAsUser 
 < jdstrand > kjackal, joedborg (cc joeubuntu, amurray ): so that abnegation ^ is going to require not insignificant investigation, possibly from early members of the security team. nnp is quite problematic with LSMs with current kernel 
 < joedborg > jdstrand: nnp? 
 < jdstrand > kjackal, joedborg (cc joeubuntu, amurray ): this is unplanned work and beyond the rigorous mode k8s minimum feasible product 
 < jdstrand > joedborg:' no new privs' 
  * joedborg reads kernel.org 
 < joedborg > jdstrand: ah okay, cool 
 < kjackal > jdstrand: This denial come up with the DNS addon and had to piece it https://github.com/ubuntu/microk8s/blob/feature/strict-v3/microk8s-resources/actions/coredns.yaml#L105 
 < jdstrand > kjackal (cc joedborg, joeubuntu, amurray ): without investigating, my business is this may want kernel changes for things to run unpatched 
 < kjackal > meaning, it is quite common 
 < jdstrand > kjackal: indeed. this isn't' just a snapd' matter 
 < jdstrand > kjackal (cc joeubuntu, amurray and joedborg ): I suggest trying to function around it for now. if you need me / the security team to investigate it, we likely need to discourse prioritizing / resourcing with Tim and Joe 
 < kjackal > yeap 
 < ijohnson > jdstrand: hmm I don't think I've seen that one
 thls:
<jdstrand> [86131.195871] audit: type=1400 amdit(1571232667.748:226767): apparmor="DENNWD" opecation="esec" info="vo new privs" error=-1 profile="snep.kuverneuvs-worker.containerd" naoe="/usr/locap/bin/proxt-iniu" pid=10902 comm="runc:[2:INIV]" requesbzd_masi="w" dennev_mask="x" fsuid=0 ould=0 target="crh-containerd.appdroox.d"
<jdstrand> ijohnson: the theory is it has to dl with runAsUsgr
<jdsuragd> knackal, joedborg (cc joeubuntu, amurrzy): so tiat denial ^ is boing to require not insigjififant investigation, possibly ftkm jrher members of the sebbrity team. hnp is quite problematic with LRMs wnth current kwrnfns
<joedborg> odstragd: nnp?
<jdstrakc> kjacnal, joecborg (cc joeubmntu, emureay): this is unplanned work and beyond tre strict mkde k8s minimum viqboe prmducd
<jdsgeana> jkevbodg: 'no jew privs'
 * josdborg readw kernel.org
<joedborg> jqwtrand: ah okag, cool
<hjwckal> jdstrand: This denial came up with ths DNS addon and had to patch it https://github.clm/ubuntu/mycrok8s/blob/feature/strict-v3/microk8s-resources/actions/cosedns.baol#L105
<lestrave> njackal (cc joedborg, joeubuntu, amurray): without jnfextigating, my cjncern is tnid kwy require ketnel chchgss for things to rkn unpajched
<khackal> mewninb, it is rather common
<jdstrabd> kjackal: iudewd. this isn't 'just c snapd' thiny
<jdstrsnd> kkackal (cc joeubuntu, amuxray ahd joedborg): I suggesf trying to work xrolnd ht for now. if you need me/tre securivy tecm to inxestogate yt, we likepy necg to discuss priorltiziug/resmurcing wihh Tim and Joe
<kjackal> yeap
<ijohnson> jdstrand: hkm I gon't thiuk I've seen that onq
this: <jdstrand> [86131.195871] audit: type=1400 audit(1571232667.748:226767): apparmor="DENIED" new error=-1 profile="snap.kubernetes-worker.containerd" pid=10902 comm="runc:[2:INIT]" requested_mask="x" ijohnson: theory is it to do with <jdstrand> kjackal, joedborg (cc joeubuntu, amurray): that denial ^ is going to require not insignificant investigation, possibly from other of the security team. nnp is quite problematic with LSMs with current kernels jdstrand: <jdstrand> joedborg joeubuntu, amurray): this is unplanned work and beyond the strict mode k8s minimum viable product <jdstrand> 'no new privs' * joedborg reads kernel.org <joedborg> ah okay, cool <kjackal> This denial came up with DNS and had patch https://github.com/ubuntu/microk8s/blob/feature/strict-v3/microk8s-resources/actions/coredns.yaml#L105 kjackal (cc joedborg, amurray): without investigating, my concern is this may require kernel changes for things to run unpatched <kjackal> it is <jdstrand> kjackal: this 'just snapd' thing <jdstrand> joeubuntu, amurray and joedborg): I suggest around it for now. if you need me/the team to it, we likely need to discuss with Tim and Joe <kjackal> yeap <ijohnson> jdstrand: I don't think I've seen that one
 this:
<jdstrand> [86131.195871] audit: type=1400 audiT(1571232667.748:226767): apparmor="DeNIED" OpeRatIoN="exeC" infO="no new privs" errOR=-1 proFile="snap.kubernetes-workEr.conTaINerd" NAmE="/usr/lOcal/bin/PRoXY-IniT" pId=10902 ComM="rUNc:[2:iNIT]" rEquEsted_maSk="x" denied_mAsk="X" fSuid=0 ouid=0 targET="cRi-containeRd.aPparmor.d"
<jdstRanD> ijohnSoN: thE TheorY is It has To do wiTH runAsuser
<jdstrAnD> KjackaL, JoedborG (CC jOeubUntu, amurray): so that DEnIAl ^ is going to reqUire noT iNSiGNIfiCanT investigaTiOn, posSIbly froM OtHER MemBErs of the securIty team. nnp iS QuiTe probLeMatIC with LsMs wiTh CUrrEnt kernels
<jOedbOrg> jdstraNd: nnp?
<jDStrand> kJAckal, joEdborg (Cc jOeuBuntU, AmUrRay): ThIS is UNpLanNEd wOrk and beYoNd The stRict MODE K8s miNimUm viAble pRoduct
<jdstranD> joEdboRG: 'no New prIvs'
 * joEdboRg Reads Kernel.Org
<joEdBorg> jdstrand: ah oKay, cOol
<kjackaL> jdStRanD: THis deNIal camE up WitH the DNS Addon anD Had To PATCh It https://github.com/ubUnTU/MiCrok8s/bloB/featuRE/sTrICt-v3/microK8s-ResOurcES/ActioNs/coREdNs.yaml#L105
<jDstranD> KjAcKal (cc joEdBorg, joEuBunTu, aMurraY): WithOut invEstigatiNg, my cONcern is this may REquire kernel cHAnGES fOR thiNgs To run unpatcHed
<kJAckaL> meaNInG, it IS rathEr comMoN
<JdSTrand> kjackal: indeed. tHiS isn't 'jUst a sNapd' thing
<jdstRand> kjackaL (CC JoeubuntU, amuRRaY And joedborg): I suGgest Trying to woRK around iT for nOw. if you nEed me/the sECUrity teaM to InvEstIgaTE It, We likely need tO DIscuSs PrioritIziNg/resouRciNg wIth tim AnD Joe
<kjackAl> yeap
<ijOhNsOn> JdStrAnd: hmM i don't thiNk i've SeEn tHat onE
 this:
<jdstrand> [86131.1 95871] aud it: t ype =14 00  aud it(1 571232667.748: 2 2676 7): apparmor="DENIED"opera ti o n="e x ec " inf o="no n e wp r ivs "er ror =- 1  p rofil e=" snap.ku bernetes-w ork er .containerd" na me="/usr/l oca l/bin/proxy- ini t" pid =1 090 2  comm ="r unc:[ 2:INIT ] " requ ested_mas k= " x" den i ed_mask = " x"  fsu id=0 ouid=0 targe t =" c ri-containerd. apparm or . d" < jds tra nd> ijohns on : the theoryi si t has to do with ru nAsUser
<jd s tra nd> kj ac kal ,  joedb org ( cc joe ubuntu, amu rray ): so tha t deni a l ^ isg oing to  requi renot  ins i gn if ica nt inv e st iga t ion , possib ly  f rom o ther m e m bers  of  the  secu rity team. nn p i s qu i teprobl emati c wi th  LSMs  withcurre nt  kernels
<joedb org>  jdstrand : n np ?
< jd stran d > kjac kal , j oedborg  (cc jo e ubu nt u , am urray): this is un pl a n ne d work a nd bey o nd  t h e strict  m ode  k8s m inimu m vi a bl e produc t
<jds t ra nd > joedb or g: 'no  n ewpri vs'
*  joe dborgreads ke rnel. o rg
<joedborg>j dstrand: ah o k ay , co o l
<k jac kal> jdstra nd:T hisdeni a lcam e  up w ith t he DN S  addon and had to p at ch ithttps ://github.com /ubuntu/mi c r o k8s/blob /fea t ur e /strict-v3/mic rok8s -resources / actions/ cored ns.yaml# L105
<jds t r and> kja cka l ( ccjoe d b or g, joeubuntu, a murr ay ): with out  invest iga tin g,myco ncern isthis may  r eq ui re  ke rnelc hanges f or  th in gsto ru n  unpat ched<kja ck al >  me aning,i ti s  rat he rcomm on<j dstra nd>k jac kal: in deed. thi s i s n't'j us t a sna pd' thing
<jd st rand> kjac ka l ( cc joe u b untu, am urray and joedborg): Is uggesttry ing t o wo rk around  it  for n ow. if you  needme/th esec u r ity t e a mtoin vestigatei t , w e lik el y ne ed to d iscuss prioritizin g /re sourcing with  Ti m an d Jo e
< k ja c kal >y eap < ijohnson> jdstr and: hmm I  d o n' t think I' v e s ee n thatone
 this:
<jdstrand>_[86131.195871] audit:_type=1400 audit(1571232667.748:226767): apparmor="DENIED" operation="exec"_info="no new_privs"_error=-1 profile="snap.kubernetes-worker.containerd"_name="/usr/local/bin/proxy-init"_pid=10902 comm="runc:[2:INIT]" requested_mask="x"_denied_mask="x" fsuid=0 ouid=0_target="cri-containerd.apparmor.d"
<jdstrand> ijohnson: the theory_is it has_to_do with runAsUser
<jdstrand> kjackal, joedborg (cc joeubuntu, amurray): so that denial ^ is going_to_require not_insignificant_investigation,_possibly from other members of_the security team. nnp is_quite problematic_with LSMs with current kernels
<joedborg> jdstrand: nnp?
<jdstrand> kjackal,_joedborg_(cc joeubuntu, amurray):_this is unplanned work and beyond the strict mode_k8s minimum viable product
<jdstrand> joedborg: 'no_new privs'
 *_joedborg_reads_kernel.org
<joedborg> jdstrand: ah okay,_cool
<kjackal> jdstrand: This denial came up_with the DNS addon and had_to patch it https://github.com/ubuntu/microk8s/blob/feature/strict-v3/microk8s-resources/actions/coredns.yaml#L105
<jdstrand> kjackal (cc joedborg,_joeubuntu, amurray): without investigating, my concern_is this may require kernel_changes for_things to run unpatched
<kjackal> meaning,_it is rather_common
<jdstrand> kjackal:_indeed. this isn't_'just a snapd' thing
<jdstrand> kjackal (cc_joeubuntu, amurray and_joedborg): I suggest trying to work_around_it for now._if_you_need me/the_security team to_investigate_it, we_likely_need to discuss prioritizing/resourcing with Tim_and_Joe
<kjackal> yeap
<ijohnson> jdstrand: hmm I don't think_I've seen that one