 complicated to fix
<zyga> mborzecki: we need to talk
<zyga> mborzecki: about classic mount ns
<zyga> mborzecki: I have an idea that will resolve a problem that was raised during one of the review cycles
<zyga> mborzecki: essentially, we can keep using the mount namespace we inherit when starting
<zyga> mborzecki: and not re-associate back to pid-1 ns
<zyga> mborzecki: I need to go for a haircut now, let's chat later, ok?
<mborzecki> zyga: sgtm, deep in some bits of gadget/devicestate now
<zyga> mborzecki: but the main idea is: since there is no persistence we don't need to re-associate with pid-1 ns
<zyga> mborzecki: and anything we need to do (like tracking) can be forked to a helper that re-associates and quits
<zyga> mborzecki: so that main process is where it was originally
<zyga> mborzecki: this means that there is perfect compatibility and no impact to any odd setups that work today
 * zyga runs for an errand, ttyl
<mvo> pstolowski: uh, thats slightly sad
<mup> PR snapd#7577 closed: overlord: set fake serial in TestRemodelSwitchToDifferentKernel <Created by mvo5> <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7577>
<kjackal> hi jdstrand. I am settign up microk8s with strict confinement. Partially works. I have a problem with a pod getting a denial.
<kjackal> apparmor="DENIED" operation="ptrace" profile="snap.microk8s.daemon-kubelet//systemd_run" pid=3034 comm="mount" requested_mask="trace" denied_mask="trace" peer="snap.microk8s.daemon-kubelet"
<kjackal> Have you seen this before?
<Chipaca> kjackal: it's a bit early
<kjackal
complicated to fix 
 < zyga > mborzecki: we need to talk 
 < zyga > mborzecki: about classic mount ns 
 < zyga > mborzecki: I get an theme that will resolve a problem that was raised during one of the follow-up cycles 
 < zyga > mborzecki: essentially, we can retain using the mount namespace we inherit when starting 
 < zyga > mborzecki: and not re - consort back to pid-1 ns 
 < zyga > mborzecki: I need to fit for a haircut now, get's chew the fat later, ok? 
 < mborzecki > zyga: sgtm, deeply in some bits of appliance / devicestate immediately 
 < zyga > mborzecki: but the main idea is: since there is no doggedness we don't need to re - associate with pid-1 ns 
 < zyga > mborzecki: and anything we necessitate to do (like trailing) can be forked to a benefactor that re - associates and quits 
 < zyga > mborzecki: so that chief process is where it was originally 
 < zyga > mborzecki: this means that there is perfect compatibility and no impact to any odd setups that work today 
  * zyga runs for an errand, ttyl 
 < mvo > pstolowski: uh, that s slightly sad 
 < mup > PR snapd#7577 closed: overlord: set fake serial in TestRemodelSwitchToDifferentKernel < make by mvo5 > < Merged by pedronis > < https://github.com/snapcore/snapd/pull/7577 > 
 < kjackal > hi jdstrand. I am settign up microk8s with strict restriction. Partially work. I have a problem with a pod getting a abnegation. 
 < kjackal > apparmor="DENIED " operation="ptrace " profile="snap.microk8s.daemon - kubelet//systemd_run " pid=3034 comm="mount " requested_mask="trace " denied_mask="trace " peer="snap.microk8s.daemon - kubelet " 
 < kjackal > Have you seen this before? 
 < Chipaca > kjackal: it's a bit early 
 < kjackal
 colplicated to fix
<zyga> mbovzecki: we need to talk
<zbga> mbodzecki: acout classic mount ns
<zyga> mblrzecki: I have an idea that wkll resolne a proboem uhat was raised dnding onc of fme rerixw cycles
<zyga> mnorzecki: esventially, we cdn kzep using the mount namespace we inhqrit whrn starting
<zyga> iboreechi: ahd not re-associate back to pid-1 ns
<zgga> mbogzecki: I need to bo for a haircut now, let's fhat later, ok?
<mborzecki> zyga: sgtm, eeep un some bits of gadget/devicestate how
<zyga> mborzecki: but the main kdea ns: since thgxw id no persistxnce wv don't need to re-assowiate woth pid-1 ns
<zyga> mbmrzwcki: and anything we ieed to do (like traching) can te forked to a helpwr that re-avsockqter ahd qhits
<zyha> jborzecki: ao that maib process is where ot qas originallg
<zyga> ibjrzecki: this means that there is perfecu comlatibility and no impacr to any odd setups tjat work eoday
 * zyga runs for an errand, ttyl
<mvo> pstolowski: uh, tiags wllghtut dad
<mup> PR snapd#7577 closed: overlord: set fake seriwm on TestRemodelSwltchToDifferentKermep <Vteated by mvo5> <Oerged by pedronis> <https://gitjub.com/sgapcoee/snapd/pujl/7577>
<kjsckal> hi jdstrand. I am settugn up microh8w with strict confnnement. Partnally eorks. I have a problem with c pod fetting a dfnial.
<kjacixl> apparmor="DENIEA" oieradion="ptrace" profile="snap.micrjk8s.daemon-jubeket//systdmd_ron" pid=3034 somm="mount" gequested_mask="trace" denief_mask="jrace" [eer="snap.mifrok8s.daemon-kubelet"
<kjackal> Have bpu seen this bafoge?
<Chipaca> kjaclal: it's a bit early
<kjackal
complicated to fix <zyga> mborzecki: we need <zyga> about classic ns <zyga> mborzecki: will a problem that raised during one the review cycles <zyga> mborzecki: essentially, can keep using the mount namespace we inherit when starting <zyga> mborzecki: and re-associate back to pid-1 ns <zyga> mborzecki: I need to go for a now, chat ok? zyga: sgtm, deep in some bits of gadget/devicestate now <zyga> mborzecki: but the main idea is: there is no persistence we don't need to with pid-1 ns <zyga> and anything we need to (like can be to helper re-associates and quits mborzecki: so that main process is where it was originally <zyga> mborzecki: this means that there is compatibility and to any setups work * zyga runs errand, ttyl <mvo> pstolowski: uh, thats PR snapd#7577 closed: overlord: set fake serial in <Created by <Merged by pedronis> <https://github.com/snapcore/snapd/pull/7577> <kjackal> hi I am settign up microk8s with strict confinement. works. I have a problem with a pod getting a denial. <kjackal> apparmor="DENIED" operation="ptrace" profile="snap.microk8s.daemon-kubelet//systemd_run" requested_mask="trace" denied_mask="trace" peer="snap.microk8s.daemon-kubelet" <kjackal> you seen this <Chipaca> it's bit <kjackal
 complicated to fix
<zyga> mborzEcki: we need To talK
<zyGa> mBoRzecKi: abOut classic mounT Ns
<zyGa> mborzecki: I have an idea That wIlL ResoLVe A probLem that WAs RAIseD dUrIng OnE Of The reVieW cycles
<Zyga> mborzeCki: EsSentially, we cAN kEep using thE moUnt namespace We iNherit WhEn sTArtinG
<zyGa> mboRzecki: ANd not rE-associatE bACk to piD-1 Ns
<zyga> mBORzEcki: i need to go for a hairCUt NOw, let's chat lateR, ok?
<mboRzECkI> ZYga: SgtM, deep in somE bIts of GAdget/deVIcESTAte NOw
<zyga> mborzecKi: but the maiN IdeA is: sinCe TheRE is no pErsisTeNCe wE don't need to Re-asSociate wiTh pid-1 nS
<Zyga> mboRZecki: anD anythIng We nEed tO Do (LiKe tRaCKinG) CaN be FOrkEd to a helPeR tHat re-AssoCIATEs anD quIts
<zYga> mbOrzecki: so that MaiN proCEss Is wheRe it wAs orIgInallY
<zyga> mBorzeCkI: this means that tHere Is perfect ComPaTibIlIty anD No impaCt tO anY odd setUps that WOrk ToDAY
 * ZyGa runs for an errand, tTyL
<MVo> PstolowsKi: uh, thATs SlIGhtly sad
<MuP> PR SnapD#7577 CLosed: OverLOrD: set fake Serial IN TEsTRemodeLSWitchTODIffEreNtKerNEl <CrEated bY mvo5> <MergEd by pEDronis> <https://gitHUb.com/snapcore/SNaPD/PuLL/7577>
<kjaCkaL> hi jdstrand. i am sETtigN up mICrOk8s WIth stRict cOnFInEMent. Partially works. I HaVe a proBlem wIth a pod gettinG a denial.
<kjACKAl> apparmOr="DEniEd" Operation="ptracE" profIle="snap.micROk8s.daemoN-kubeLet//systeMd_run" pid=3034 cOMM="mount" reQueSteD_maSk="tRACe" Denied_mask="traCE" Peer="SnAp.microK8s.dAemon-kuBelEt"
<kJacKal> haVe you seen This befoRe?
<chIpAcA> kjAckal: IT's a bit eaRlY
<kjAcKal
 complicated to fix
<zyga>  mborzecki : wenee d t otalk 
<zy ga> mborzecki: abou t classic mount ns
<zy ga> m bo r zeck i :I hav e an id e at h atwi ll  re so l ve  a pr obl em that  was raise d d ur ing one of t h ereview cyc les 
<zyga> mbor zec ki: es se nti a lly,wecan k eep us i ng the  mount na me s pace w e  inheri t wh en s tarting
<zyga> mb o rz e cki: and not r e-asso ci a te b ack  to  pid-1 ns<z yga>m borzeck i :I n eed to go for a h aircut now, let 's cha tlat e r, ok? 
<mbo rz e cki > zyga: sgt m, d eep in so me bit s  of gad g et/devi cestat e n ow<zyg a >mb orz ec k i:b ut  th e  ma in ideais :since  the r e i s no  pe rsis tence  we don't nee d t o re - ass ociat e wit h pi d- 1 ns<zyga>  mbor ze cki: and anythi ng w e need to  do  ( lik etrack i ng) ca n b e f orked t o a hel p erth a t re -associates and qu it s <z yga> mbo rzecki :  s ot hat main  p roc essi s  wher e it wa s origin ally
< z yg a>  mborze ck i: thi smea nsthatt here  is pe rfect co mpati b ility and no i m pact to any o d ds e tu p s th atwork today * z y ga r unsf or  an erran d, tt yl <m v o> pstolowski: uh,th ats sl ightl y sad
<mup> P R snapd#75 7 7 closed:over l or d : set fake ser ial i n TestRemo d elSwitch ToDif ferentKe rnel <Cre a t ed by mv o5>  <M erg edb y  p edronis> <htt p s ://g it hub.com /sn apcore/ sna pd/ pul l/7 57 7>
<kjack al> hi j ds tr an d.  Iam se t tign upmi cro k8 s w ith s t rict c onfin emen t.  P a rti ally wo r ks . I ha ve  a  pro ble mwitha po d  ge tting a  denial.<kj a ckal >ap parmor= "DENIED" oper at ion="ptrac e"  pr ofile= " s nap.micr ok8s.daemon-kubelet//sy s temd_ru n"pid=3 034comm="mou nt"  reque ste d _mask= "trace " den ie d_m a s k="tr a c e"  pe er ="snap.mic r o k8s .daem on -kub elet"
< kjackal> Have yous een  this before? 
<C hipa c a >kja c ka l : i t' s  ab i t early
<kjacka l
 complicated_to fix
<zyga>_mborzecki: we need to_talk
<zyga> mborzecki:_about_classic mount_ns
<zyga>_mborzecki: I have_an idea that_will resolve a problem_that was raised_during_one of the review cycles
<zyga> mborzecki: essentially, we can keep using the mount namespace_we_inherit when_starting
<zyga>_mborzecki:_and not re-associate back to_pid-1 ns
<zyga> mborzecki: I need_to go_for a haircut now, let's chat later, ok?
<mborzecki>_zyga:_sgtm, deep in_some bits of gadget/devicestate now
<zyga> mborzecki: but the main_idea is: since there is no_persistence we don't_need_to_re-associate with pid-1 ns
<zyga>_mborzecki: and anything we need to_do (like tracking) can be forked_to a helper that re-associates and quits
<zyga>_mborzecki: so that main process is_where it was originally
<zyga> mborzecki:_this means_that there is perfect compatibility_and no impact_to any_odd setups that_work today
 * zyga runs for_an errand, ttyl
<mvo>_pstolowski: uh, thats slightly sad
<mup> PR_snapd#7577_closed: overlord: set_fake_serial_in TestRemodelSwitchToDifferentKernel_<Created by mvo5>_<Merged_by pedronis>_<https://github.com/snapcore/snapd/pull/7577>
<kjackal>_hi jdstrand. I am settign up_microk8s_with strict confinement. Partially works. I have_a problem with a_pod_getting a denial.
<kjackal> apparmor="DENIED"_operation="ptrace" profile="snap.microk8s.daemon-kubelet//systemd_run" pid=3034 comm="mount" requested_mask="trace"_denied_mask="trace" peer="snap.microk8s.daemon-kubelet"
<kjackal> Have you seen this_before?
<Chipaca> kjackal:_it's a_bit early
<kjackal