Request for classic confinement SPDK snap

Hello,

I would like to request classic confinement for the SPDK snap. Storage Performance Development Kit (SPDK) consists of scripts in bash and python and elf64 binaries, these utilities needs access to system commands and resources. For example the setup script reads/writes to /sys file system, unbinds native modules, sets up hugetlbfs etc. The snap would be used in a cloud/server environment.

For example when the confinement is set to strict. I get the following (please note this snap package was built with kernel-module-control and kernel-module-observe plugs for setup) :
ubuntu@sst100:~$ snap connections
Interface Plug Slot Notes
home spdk:home :home -
network spdk:network :network -
network-bind spdk:network-bind :network-bind -

ubuntu@sst100:~$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup config
lspci: Cannot open /sys/bus/pci/devices
/snap/spdk/x1/opt/spdk/scripts/setup.sh: line 210: /sbin/modprobe: Permission denied
ubuntu@sst100:~$

The yaml for the snap can be found here: https://github.com/manjo-git/snaps/tree/master/spdk-snap you can also find an example for how to setup NVMe-of over TCP using the snapped (using classic confinement) utilities. This example simply demonstrates how the utilities can be used on both ARM and Intel systems.

Thank you.

These sorts of requests are now meant to be filed in the #store-requests category. I seem to have lost my ability to recategorize posts though, so I can’t move it for you, but you should be able to move it yourself :slight_smile:

Sorry about that… I moved it.

Can I please get some review comments on this request ?

We have a number of interfaces for interacting with /sys, kernel-module-control for dealing with modules, etc. https://github.com/snapcore/snapd/pull/8271 will add configuration of hugepages (but hardware-observe allows read today). It appears that you didn’t connect all of the interfaces when testing. I suggest adding to plugs ‘kernel-module-control’, installing the snap in devmode, then doing:

$ for i in system-observe system-trace log-observe kernel-module-control ; do sudo snap connect spdk:$i ; done

then posting any policy violations here (preferably installing snappy-debug and examining its recommendations and applying them to the snap first).

Built spdk snap as stable strict, and the snap package installs ok.

ubuntu@sst100:~/Downloads$ sudo snap install --dangerous spdk_20.04_arm64.snap 
Mount snap "spdk" (unset)                                                      .
Mount snap "spdk" (unset)                                                      .
spdk 20.04 installed
ubuntu@sst100:~/Downloads$

Manual connections made as per your suggestion, I also added hardware-observe

ubuntu@sst100:~$ for i in system-observe system-trace log-observe kernel-module-control hardware-observe; do sudo snap connect spdk:$i ; done
[sudo] password for ubuntu: 

Need to use vfio-pci module with no-iommu. Load the module before running the setup script. This is documented in my readme.

ubuntu@sst100:~$ sudo modprobe vfio-pci
ubuntu@sst100:~$ lsmod | grep vfio
vfio_pci               61440  0
vfio_virqfd            20480  1 vfio_pci
vfio_iommu_type1       36864  0
vfio                   40960  2 vfio_iommu_type1,vfio_pci

Run the SPDK setup script. It fails accessing /sys/bus/pci/devices/. One of the functions that the script does is, it disassociates the inbox kernel driver for NVMe and associates it with userspace vfio driver.

ubuntu@sst100:~$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup config
/snap/spdk/x1/opt/spdk/scripts/setup.sh: line 104: /sys/bus/pci/devices/0007:01:00.0/driver/remove_id: Permission denied
/snap/spdk/x1/opt/spdk/scripts/setup.sh: line 105: /sys/bus/pci/devices/0007:01:00.0/driver/unbind: Permission denied

Check for connections.

ubuntu@sst100:~$ snap connections | grep spdk
hardware-observe       spdk:hardware-observe       :hardware-observe       manual
home                   spdk:home                   :home                   -
kernel-module-control  spdk:kernel-module-control  :kernel-module-control  manual
log-observe            spdk:log-observe            :log-observe            manual
network                spdk:network                :network                -
network-bind           spdk:network-bind           :network-bind           -
system-observe         spdk:system-observe         :system-observe         manual
system-trace           spdk:system-trace           :system-trace           manual
ubuntu@sst100:~$ 

Thanks for the additional information, but it seems you didn’t install the snap with --devmode. This will allow your snap all the accesses it needs but logging policy violations (which you can paste here) which will allow us to see the bigger picture for what your snap’s requirements are. When installing in devmode, please be sure to connect the interfaces after so the logged items are just new things your snap would need over what currently exists.

oops sorry about that. Yes I can redo with --devmode. Also could you please tell me if my for loop to make the connections above is correct? If I understand you correctly. I have to repeat the steps above after installing the snap with devmode collect the logs and post it here?

Remove existing SPDK snap

ubuntu@sst100:~/Downloads$ sudo snap remove spdk
spdk removed

Install the snap with --devmode

ubuntu@sst100:~/Downloads$ sudo snap install --devmode spdk_20.04_arm64.snap
spdk 20.04 installed

Make connections

ubuntu@sst100:~/Downloads$ for i in system-observe system-trace log-observe kernel-module-control hardware-observe; do sudo snap connect spdk:$i ; done

Modprobe vfio-pci in noiommu mode, and run the setup script. The setup script worked this time, please ignore the modprobe fatal message at the end. That module does not exist on ARM64.

ubuntu@sst100:~/Downloads$ sudo modprobe vfio-pci
ubuntu@sst100:~/Downloads$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup config
0007:01:00.0 (144d a808): nvme -> vfio-pci

Current user memlock limit: 16 MB

This is the maximum amount of memory you will be
able to use with DPDK and VFIO if run as current user.
To change this, please adjust limits.conf memlock limit for current user.

## WARNING: memlock limit is less than 64MB
## DPDK with VFIO may not be able to initialize if run as current user.
modprobe: FATAL: Module msr not found in directory /lib/modules/5.4.0-29-generic

I believe you will have to redo the loop after installing in devmode (but you can always check ‘snap connections spdk’).

What are the security policy violations from journald at the time you ran the snap?

In my post above I did re-run the for loop. Also snap connections for spdk are as follows:

ubuntu@sst100:~/build/git/build$ snap connections | grep spdk
hardware-observe       spdk:hardware-observe       :hardware-observe       manual
home                   spdk:home                   :home                   -
kernel-module-control  spdk:kernel-module-control  :kernel-module-control  manual
log-observe            spdk:log-observe            :log-observe            manual
network                spdk:network                :network                -
network-bind           spdk:network-bind           :network-bind           -
system-observe         spdk:system-observe         :system-observe         manual
system-trace           spdk:system-trace           :system-trace           manual
ubuntu@sst100:~/build/git/build$

There were no logs in journalctl. Here is what it looks like when I run the snap app.

ubuntu@sst100:~/build/git/build$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup reset 
0007:01:00.0 (144d a808): vfio-pci -> nvme

ubuntu@sst100:~/build/git/build$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup config
0007:01:00.0 (144d a808): nvme -> vfio-pci

Current user memlock limit: 16 MB

This is the maximum amount of memory you will be
able to use with DPDK and VFIO if run as current user.
To change this, please adjust limits.conf memlock limit for current user.

## WARNING: memlock limit is less than 64MB
## DPDK with VFIO may not be able to initialize if run as current user.
modprobe: FATAL: Module msr not found in directory /lib/modules/5.4.0-29-generic
ubuntu@sst100:~/build/git/build$

Here is the journalctl output when I run the snap app. There are no violations listed in the journald output.

May 20 20:32:40 sst100 audit[16636]: AVC apparmor="ALLOWED" operation="truncate"
May 20 20:32:40 sst100 audit[17039]: AVC apparmor="ALLOWED" operation="open" pro
May 20 20:32:40 sst100 audit[17040]: SECCOMP auid=1000 uid=0 gid=0 ses=3 pid=170
May 20 20:32:40 sst100 audit[17040]: AVC apparmor="ALLOWED" operation="chown" pr
May 20 20:32:40 sst100 audit[17041]: AVC apparmor="ALLOWED" operation="chmod" pr
May 20 20:32:40 sst100 sudo[16635]: pam_unix(sudo:session): session closed for u
lines 979-1001/1001 (END)[19543.364820] nvme nvme0: failed to set APST feature )

The “ALLOWED” entries are policy violations. Since you installed with --devmode, that puts the apparmor and seccomp profiles into complain mode, which allows but logs policy violations.

These log entries are truncated. Can you provide the full log output?

Sorry about that noise … I was also testing a VPP snap that I was working on. I rebooted the system and ran it fresh.

Snap app setup command.

ubuntu@sst100:~$ sudo modprobe vfio-pci
[sudo] password for ubuntu: 
ubuntu@sst100:~$ sudo HUGEMEM=8192 DRIVER_OVERRIDE=vfio-pci spdk.setup config
0007:01:00.0 (144d a808): nvme -> vfio-pci

Current user memlock limit: 16 MB

This is the maximum amount of memory you will be
able to use with DPDK and VFIO if run as current user.
To change this, please adjust limits.conf memlock limit for current user.

## WARNING: memlock limit is less than 64MB
## DPDK with VFIO may not be able to initialize if run as current user.
modprobe: FATAL: Module msr not found in directory /lib/modules/5.4.0-29-generic
ubuntu@sst100:~$ 

Full journalctl command output:

ubuntu@sst100:~$ journalctl -e 
May 20 22:32:57 sst100 vpp.vpp[507]: vpp[507]: dpdk_config: rte_eal_init returne
May 20 22:32:57 sst100 vpp[507]: dpdk_config: rte_eal_init returned -1
May 20 22:33:01 sst100 login[566]: pam_unix(login:session): session opened for u
May 20 22:33:01 sst100 systemd-logind[509]: New session 1 of user ubuntu.
May 20 22:33:01 sst100 systemd[1]: Created slice User Slice of ubuntu.
May 20 22:33:01 sst100 systemd[1]: Started Session 1 of user ubuntu.
May 20 22:33:01 sst100 systemd[1]: Starting User Manager for UID 1000...
May 20 22:33:01 sst100 systemd[783]: pam_unix(systemd-user:session): session ope
May 20 22:33:01 sst100 systemd[783]: Listening on GnuPG network certificate mana
May 20 22:33:01 sst100 systemd[783]: Listening on GnuPG cryptographic agent and 
May 20 22:33:01 sst100 systemd[783]: Listening on GnuPG cryptographic agent and 
May 20 22:33:01 sst100 systemd[783]: Listening on GnuPG cryptographic agent and 
May 20 22:33:01 sst100 systemd[783]: Reached target Paths.
May 20 22:33:01 sst100 systemd[783]: Listening on REST API socket for snapd user
May 20 22:33:01 sst100 systemd[783]: Listening on GnuPG cryptographic agent (ssh
May 20 22:33:01 sst100 systemd[783]: Reached target Sockets.
May 20 22:33:01 sst100 systemd[783]: Reached target Timers.
May 20 22:33:01 sst100 systemd[783]: Reached target Basic System.
May 20 22:33:01 sst100 systemd[1]: Started User Manager for UID 1000.
May 20 22:33:01 sst100 systemd[783]: Reached target Default.
May 20 22:33:01 sst100 systemd[783]: Startup finished in 83ms.
May 20 22:33:45 sst100 kernel: random: crng init done
May 20 22:33:45 sst100 kernel: random: 7 urandom warning(s) missed due to rateli
lines 1000-1022/1022 (END)[  108.466045] nvme nvme0: failed to set APST feature)
lines 1000-1022/1022 (END)

Please let me know what the next steps are?

The output you posted is still truncated (each line appears to be cut off at the end) and it doesn’t appear to list any policy violations. If you are still experiencing issues, can you please open a terminal, and capture the output - something like the following should work:

journalctl --boot | grep spdk | grep '\(AVC\|SECCOMP\)'

$ sudo journalctl --boot | grep spdk | grep '\(AVC\|SECCOMP\)' Jun 15 19:58:37 ps1100r audit[2047]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap-update-ns.spdk" pid=2047 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2048]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.accel-perf" pid=2048 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2049]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.gen-nvme" pid=2049 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2052]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.iscsi-top" pid=2052 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2054]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2054 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2051]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2051 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2056]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.setup" pid=2056 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2055]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.rpc" pid=2055 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2053]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.nvme-perf" pid=2053 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2050]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.ioat-perf" pid=2050 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2057]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2057 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2058]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2058 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2060]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdk-trace" pid=2060 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2059]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdk-top" pid=2059 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2063]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.vhost" pid=2063 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2061]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2061 comm="apparmor_parser" Jun 15 19:58:37 ps1100r audit[2062]: AVC apparmor="STATUS" operation="profile_load" profile="unconfined" name="snap.spdk.spdkcli" pid=2062 comm="apparmor_parser" Jun 15 19:58:39 ps1100r audit[2162]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.gen-nvme" pid=2162 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2168]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.rpc" pid=2168 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2164]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2164 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2165]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-top" pid=2165 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2163]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.ioat-perf" pid=2163 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2167]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2167 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2169]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2169 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2161]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.accel-perf" pid=2161 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2166]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvme-perf" pid=2166 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2170]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2170 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2172]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-top" pid=2172 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2171]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2171 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2173]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace" pid=2173 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2174]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2174 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2175]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdkcli" pid=2175 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2176]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.vhost" pid=2176 comm="apparmor_parser" Jun 15 19:58:40 ps1100r audit[2179]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2179 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2293]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.gen-nvme" pid=2293 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2298]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2298 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2295]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2295 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2292]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.accel-perf" pid=2292 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2297]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvme-perf" pid=2297 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2296]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-top" pid=2296 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2299]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.rpc" pid=2299 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2294]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.ioat-perf" pid=2294 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2300]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2300 comm="apparmor_parser" Jun 15 19:58:53 ps1100r audit[2303]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-top" pid=2303 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2302]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2302 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2301]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2301 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2304]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace" pid=2304 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2305]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2305 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2307]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.vhost" pid=2307 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2306]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdkcli" pid=2306 comm="apparmor_parser" Jun 15 19:58:54 ps1100r audit[2309]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2309 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2427]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-top" pid=2427 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2423]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.accel-perf" pid=2423 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2429]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2429 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2424]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.gen-nvme" pid=2424 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2430]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.rpc" pid=2430 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2425]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.ioat-perf" pid=2425 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2426]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2426 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2428]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvme-perf" pid=2428 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2432]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2432 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2433]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2433 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2431]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2431 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2434]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-top" pid=2434 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2436]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2436 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2435]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace" pid=2435 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2437]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdkcli" pid=2437 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2438]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.vhost" pid=2438 comm="apparmor_parser" Jun 15 19:58:56 ps1100r audit[2441]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2441 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2464]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.gen-nvme" pid=2464 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2469]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2469 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2463]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.accel-perf" pid=2463 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2470]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.rpc" pid=2470 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2466]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2466 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2465]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.ioat-perf" pid=2465 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2473]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2473 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2467]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.iscsi-top" pid=2467 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2471]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2471 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2472]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2472 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2475]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace" pid=2475 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2474]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-top" pid=2474 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2468]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.nvme-perf" pid=2468 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2476]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2476 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2478]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.vhost" pid=2478 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2477]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.spdkcli" pid=2477 comm="apparmor_parser" Jun 15 19:58:57 ps1100r audit[2480]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2480 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2538]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2538 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2540]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2540 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2541]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.accel-perf" pid=2541 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2544]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2544 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2543]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.ioat-perf" pid=2543 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2542]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.gen-nvme" pid=2542 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2548]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.rpc" pid=2548 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2547]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2547 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2545]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.iscsi-top" pid=2545 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2549]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2549 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2551]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-top" pid=2551 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2550]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2550 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2546]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.nvme-perf" pid=2546 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2552]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-trace" pid=2552 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2554]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdkcli" pid=2554 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2555]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.vhost" pid=2555 comm="apparmor_parser" Jun 15 19:58:58 ps1100r audit[2553]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2553 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2583]: AVC apparmor="STATUS" operation="profile_replace" profile="unconfined" name="snap.spdk.setup" pid=2583 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2585]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap-update-ns.spdk" pid=2585 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2587]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.gen-nvme" pid=2587 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2586]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.accel-perf" pid=2586 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2590]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.iscsi-top" pid=2590 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2592]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.nvmf-tgt" pid=2592 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2591]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.nvme-perf" pid=2591 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2589]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.iscsi-tgt" pid=2589 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2588]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.ioat-perf" pid=2588 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2593]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.rpc" pid=2593 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2594]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-lspci" pid=2594 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2595]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-tgt" pid=2595 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2597]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-trace" pid=2597 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2596]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-top" pid=2596 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2598]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdk-trace-record" pid=2598 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2600]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.vhost" pid=2600 comm="apparmor_parser" Jun 15 19:58:59 ps1100r audit[2599]: AVC apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" profile="unconfined" name="snap.spdk.spdkcli" pid=2599 comm="apparmor_parser"

Thanks - the output is not truncated this time but I cannot see any evidence that strict confinement is causing any issues for spdk from this output - there are no policy violations - is spdk operating correctly?

@manjo - ping, can you answer @alexmurray’s question?

@manjo - since we’ve not heard back from you, we are removing this request from our review queue. When you have more time to respond, simply do so here and we can add the request back to the queue. Thanks

Sorry, for the delayed response. With strict confinement SPDK works partially, ie NVMEof over TCP works, but for NVMEof over RDMA to work it needs to access the _re0 devices etc and that fails. But using a classic confinement I am able to use all the features of SPDK.