1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195 | alan@hal:~$ SNAP_CONFINE_DEBUG=yes snap run --shell hiri
DEBUG: security tag: snap.hiri.hiri
DEBUG: executable: /usr/lib/snapd/snap-exec
DEBUG: confinement: non-classic
DEBUG: base snap: core
DEBUG: apparmor label on snap-confine is: /snap/core/3017/usr/lib/snapd/snap-confine
DEBUG: apparmor mode is: enforce
DEBUG: checking if the current process shares mount namespace with the init process
DEBUG: re-associating is not required
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: opening lock file: /run/snapd/lock/.lock
DEBUG: sanity timeout initialized and set for three seconds
DEBUG: acquiring exclusive lock (scope (global))
DEBUG: sanity timeout reset and disabled
DEBUG: ensuring that snap mount directory is shared
DEBUG: unsharing snap namespace directory
DEBUG: creating namespace group directory /run/snapd/ns
DEBUG: namespace group directory does not require intialization
DEBUG: releasing lock (scope: (global))
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: opening lock file: /run/snapd/lock/hiri.lock
DEBUG: sanity timeout initialized and set for three seconds
DEBUG: acquiring exclusive lock (scope hiri)
DEBUG: sanity timeout reset and disabled
DEBUG: initializing mount namespace: hiri
DEBUG: opening namespace group directory /run/snapd/ns
DEBUG: initializing new namespace group hiri
DEBUG: forking support process for mount namespace capture
DEBUG: forked support process has pid 23600
DEBUG: unsharing the mount namespace
DEBUG: forked support process has pid 0
DEBUG: changing apparmor hat of the support process for mount namespace capture
DEBUG: changing apparmor hat to mount-namespace-capture-helper
DEBUG: ensuring that parent process is still alive
DEBUG: waiting for a eventfd data from the parent process to continue
DEBUG: sanity timeout initialized and set for three seconds
DEBUG: scratch directory for constructing namespace: /tmp/snap.rootfs_5COh2K
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: opening file describing nvidia driver version
DEBUG: parsed nvidia driver version: 375.66
DEBUG: bind mounting nvidia driver /usr/lib/nvidia-375 -> /tmp/snap.rootfs_5COh2K/var/lib/snapd/lib/gl
DEBUG: performing operation: pivot_root /tmp/snap.rootfs_5COh2K /tmp/snap.rootfs_5COh2K//var/lib/snapd/hostfs
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: rmdir /var/lib/snapd/hostfs//tmp/snap.rootfs_5COh2K
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: (disabled) use debug build to see details
DEBUG: performing operation: mount --move /var/lib/snapd /tmp/snapd.quirks_mJHTaW
DEBUG: creating writable mimic directory /var/lib based on /snap/core/current//var/lib
DEBUG: mounting tmpfs at /var/lib
DEBUG: bind-mounting all the files from the reference directory
DEBUG: creating empty directory at /var/lib/apparmor
DEBUG: performing operation: mount /snap/core/current//var/lib/apparmor /var/lib/apparmor -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/classic
DEBUG: performing operation: mount /snap/core/current//var/lib/classic /var/lib/classic -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/cloud
DEBUG: performing operation: mount /snap/core/current//var/lib/cloud /var/lib/cloud -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/console-conf
DEBUG: performing operation: mount /snap/core/current//var/lib/console-conf /var/lib/console-conf -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/dbus
DEBUG: performing operation: mount /snap/core/current//var/lib/dbus /var/lib/dbus -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/dhcp
DEBUG: performing operation: mount /snap/core/current//var/lib/dhcp /var/lib/dhcp -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/extrausers
DEBUG: performing operation: mount /snap/core/current//var/lib/extrausers /var/lib/extrausers -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/initramfs-tools
DEBUG: performing operation: mount /snap/core/current//var/lib/initramfs-tools /var/lib/initramfs-tools -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/initscripts
DEBUG: performing operation: mount /snap/core/current//var/lib/initscripts /var/lib/initscripts -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/insserv
DEBUG: performing operation: mount /snap/core/current//var/lib/insserv /var/lib/insserv -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/logrotate
DEBUG: performing operation: mount /snap/core/current//var/lib/logrotate /var/lib/logrotate -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/machines
DEBUG: performing operation: mount /snap/core/current//var/lib/machines /var/lib/machines -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/misc
DEBUG: performing operation: mount /snap/core/current//var/lib/misc /var/lib/misc -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/pam
DEBUG: performing operation: mount /snap/core/current//var/lib/pam /var/lib/pam -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/python
DEBUG: performing operation: mount /snap/core/current//var/lib/python /var/lib/python -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/resolvconf
DEBUG: performing operation: mount /snap/core/current//var/lib/resolvconf /var/lib/resolvconf -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/snapd
DEBUG: performing operation: mount /snap/core/current//var/lib/snapd /var/lib/snapd -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/sudo
DEBUG: performing operation: mount /snap/core/current//var/lib/sudo /var/lib/sudo -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/systemd
DEBUG: performing operation: mount /snap/core/current//var/lib/systemd /var/lib/systemd -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/ubuntu-fan
DEBUG: performing operation: mount /snap/core/current//var/lib/ubuntu-fan /var/lib/ubuntu-fan -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/ucf
DEBUG: performing operation: mount /snap/core/current//var/lib/ucf /var/lib/ucf -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/update-rc.d
DEBUG: performing operation: mount /snap/core/current//var/lib/update-rc.d /var/lib/update-rc.d -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/urandom
DEBUG: performing operation: mount /snap/core/current//var/lib/urandom /var/lib/urandom -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/vim
DEBUG: performing operation: mount /snap/core/current//var/lib/vim /var/lib/vim -o ro,nosuid,nodev,rbind,rslave
DEBUG: creating empty directory at /var/lib/waagent
DEBUG: performing operation: mount /snap/core/current//var/lib/waagent /var/lib/waagent -o ro,nosuid,nodev,rbind,rslave
DEBUG: performing operation: umount /var/lib/snapd
DEBUG: performing operation: mount --move /tmp/snapd.quirks_mJHTaW /var/lib/snapd
DEBUG: performing operation: rmdir /tmp/snapd.quirks_mJHTaW
DEBUG: sc_setup_mount_profiles: hiri
DEBUG: opening current mount profile /run/snapd/ns/snap.hiri.fstab
DEBUG: opening desired mount profile /var/lib/snapd/mount/snap.hiri.fstab
DEBUG: asking support process for mount namespace capture (pid: 23600) to perform the capture
DEBUG: waiting for the support process for mount namespace capture to exit
DEBUG: sanity timeout reset and disabled
DEBUG: capturing mount namespace of process 23591 in namespace group hiri
DEBUG: successfully captured mount namespace in namespace group hiri
DEBUG: support process for mount namespace capture exited normally
DEBUG: releasing resources associated with namespace group hiri
DEBUG: releasing lock (scope: hiri)
DEBUG: resetting PATH to values in sync with core snap
DEBUG: snappy_udev_init
DEBUG: setup_devices_cgroup
DEBUG: write_string_to_file /sys/fs/cgroup/devices/snap.hiri.hiri/tasks 23591
DEBUG: write_string_to_file /sys/fs/cgroup/devices/snap.hiri.hiri/devices.deny a
DEBUG: run_snappy_app_dev_add: /sys/class/mem/null snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/mem/full snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/mem/zero snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/mem/random snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/mem/urandom snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/tty/tty snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/tty/console snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/class/tty/ptmx snap_hiri_hiri
DEBUG: run_snappy_app_dev_add: /sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/drm/card0 snap_hiri_hiri
DEBUG: creating user data directory: /home/alan/snap/hiri/15
DEBUG: requesting changing of apparmor profile on next exec to snap.hiri.hiri
DEBUG: loading bpf program for security tag snap.hiri.hiri
DEBUG: read 5952 bytes from /var/lib/snapd/seccomp/bpf//snap.hiri.hiri.bin
DEBUG: raising privileges to load seccomp profile
DEBUG: dropping privileges after loading seccomp profile
DEBUG: execv(/usr/lib/snapd/snap-exec, /usr/lib/snapd/snap-exec...)
DEBUG: argv[1] = --command=shell
DEBUG: argv[2] = hiri
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.
alan@hal:/home/alan$ sudo SNAP_NAME=hiri strace /snap/core/current/usr/lib/snapd/snap-confine snap.hiri.hiri -o snap-confine.strace
bash: /usr/bin/sudo: Permission denied
alan@hal:/home/alan$
|