[Bug 1611603] Re: fails to start when confined in a snap
celso.providelo at canonical.com
Thu Feb 23 02:50:54 UTC 2017
Using snap 2.22.5 and still getting:
Time: Feb 22 23:45:01
Log: auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=6630 comm="python3" exe="/usr/bin/python3.5" sig=31 arch=c000003e 92(chown) compat=0 ip=0x7f2e7d6d6717 code=0x0
* don't copy ownership of files (eg, use 'cp -r --preserve=mode' instead of 'cp -a')
* adjust program to not use 'chown'
running `gunicorn ... -u 1000 -g 1000 --worker-tmp-dir $SNAP_USER_DATA`
(-u & -g doesn't make any difference)
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to gunicorn in Ubuntu.
fails to start when confined in a snap
Status in gunicorn package in Ubuntu:
I attempted to package a simple WSGI app in an Ubuntu snap with
gunicorn, and ran into a problem with gunicorn vs. the Snap security
The policy forbids calling chown at all, whereas the
workers.workertmp.WorkerTmp class relies on the default and
historically unproblematic behaviour of silently succeeding when the
UID/GID are the same as the calling process's.
I've attached a patch that attempts to short-circuit chown when it
would be a no-op, which is the case when gunicorn is run as root in a
snap, and this patch lets my app work when confined.
snaps also do not currently allow setuid, etc., and so there's no sense in trying to create a gunicorn-using snap that starts as root and then drops privileges. For more information on the snap security policy, please visit: https://developer.ubuntu.com/en/snappy/guides/security/
To manage notifications about this bug go to:
More information about the Ubuntu-openstack-bugs