Projet

Général

Profil

Demande #37569

samba addc en erreur 2.10 (scribe-amonecole)

Ajouté par Ludwig Seys il y a environ 2 mois. Mis à jour il y a 13 jours.

Statut:
Classée sans suite
Priorité:
Normal
Assigné à:
-
Catégorie:
-
Version cible:
-
Début:
28/07/2026
Echéance:
% réalisé:

0%

Description

Après instance etb3.amonecole-2.10-avecimport, et aca.scribe-2.10-avecimport, puis Maj-Auto -C => samba-ad-dc est en erreur et ne démarre plus.

il semblerait qu'apparmor bloque le démarrage des conteneurs (pas de droits) une mise à jours de sécu serait à l'origine ?

retour sur scribe :

root@addc:~# systemctl status samba-ad-dc
× samba-ad-dc.service - Samba AD Daemon
     Loaded: loaded (/usr/lib/systemd/system/samba-ad-dc.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Tue 2026-07-28 14:21:08 CEST; 7min ago
   Duration: 16ms
       Docs: man:samba(8)
             man:samba(7)
             man:smb.conf(5)
    Process: 924 ExecCondition=/usr/share/samba/is-configured samba (code=exited, status=0/SUCCESS)
    Process: 926 ExecStart=/usr/sbin/samba --foreground --no-process-group $SAMBAOPTIONS (code=exited, status=1/FAILURE)
   Main PID: 926 (code=exited, status=1/FAILURE)
     Status: "samba: ready to serve connections..." 
        CPU: 1.381s

juil. 28 14:21:07 addc systemd[1]: Started samba-ad-dc.service - Samba AD Daemon.
juil. 28 14:21:07 addc samba[926]:   prefork_child_pipe_handler: Parent 926, Child 935 exited with status 0
juil. 28 14:21:07 addc samba[926]: [2026/07/28 14:21:07.492583,  0] source4/samba/server.c:403(samba_terminate)
juil. 28 14:21:07 addc samba[926]:   samba_terminate: samba_terminate of samba 926: Cannot create NTP signd pipe directory: /var/lib/samba/ntp_signd
juil. 28 14:21:07 addc smbd[933]: [2026/07/28 14:21:07.493448,  0] source3/smbd/server.c:1746(main)
juil. 28 14:21:07 addc smbd[933]:   smbd version 4.19.5-Ubuntu started.
juil. 28 14:21:07 addc smbd[933]:   Copyright Andrew Tridgell and the Samba Team 1992-2023
juil. 28 14:21:07 addc systemd[1]: samba-ad-dc.service: Main process exited, code=exited, status=1/FAILURE
juil. 28 14:21:08 addc systemd[1]: samba-ad-dc.service: Failed with result 'exit-code'.
juil. 28 14:21:08 addc systemd[1]: samba-ad-dc.service: Consumed 1.381s CPU time.

journactl -xfe sur scribe :

juil. 28 14:10:06 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:11 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:16 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:19 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:10:19] "GET /get/creole?variable=adresse_ip_gw HTTP/1.1" 200 40 "" "python-requests/2.31.0" 
juil. 28 14:10:19 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:10:19] "GET /get/creole?variable=container_ip_fichier HTTP/1.1" 200 38 "" "python-requests/2.31.0" 
juil. 28 14:10:20 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:10:20] "GET /get/creole?variable=container_ip_fichier HTTP/1.1" 200 38 "" "python-requests/2.31.0" 
juil. 28 14:10:21 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:26 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:31 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:36 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:41 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:46 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:51 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:10:56 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:00 scribe imapd[19803]: Connection, ip=[::ffff:192.168.0.26], port=[36788]
juil. 28 14:11:00 scribe imapd[19803]: Disconnected, ip=[::ffff:192.168.0.26], port=[36788], time=0
juil. 28 14:11:01 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:06 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:11 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:16 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:21 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:26 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:31 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:36 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:41 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:46 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:51 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:11:56 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:01 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:06 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:11 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:16 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:19 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:12:19] "GET /get/creole?variable=container_ip_fichier HTTP/1.1" 200 38 "" "python-requests/2.31.0" 
juil. 28 14:12:19 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:12:19] "GET /get/creole?variable=adresse_ip_gw HTTP/1.1" 200 40 "" "python-requests/2.31.0" 
juil. 28 14:12:19 scribe creoled[9269]: 127.0.0.1 - - [28/Jul/2026:14:12:19] "GET /get/creole?variable=container_path_mail HTTP/1.1" 200 29 "" "python-requests/2.31.0" 
juil. 28 14:12:22 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:27 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:32 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:37 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:42 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:47 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:52 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:12:55 scribe imapd[19803]: Connection, ip=[::ffff:192.168.0.26], port=[44132]
juil. 28 14:12:55 scribe imapd[19803]: Disconnected, ip=[::ffff:192.168.0.26], port=[44132], time=0
juil. 28 14:12:57 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas
juil. 28 14:13:02 scribe waitsmb[24921]: Le service samba-ad-dc ne répond pas

Point pertinent dans dmesg :

[  317.405080] kauditd_printk_skb: 15 callbacks suppressed
[  317.405087] audit: type=1400 audit(1785236063.713:356): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/" pid=22486 comm="(sd-gens)" flags="ro, remount, bind" 
[  317.573802] audit: type=1400 audit(1785236063.882:357): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/dev/" pid=22510 comm="(sd-gens)" flags="ro, remount, bind" 
[  317.573994] audit: type=1400 audit(1785236063.882:358): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/" pid=22510 comm="(sd-gens)" flags="ro, remount, bind" 
[  317.725969] audit: type=1400 audit(1785236064.034:359): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/dev/" pid=22556 comm="(sd-gens)" flags="ro, remount, bind" 
[  317.726031] audit: type=1400 audit(1785236064.035:360): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/" pid=22556 comm="(sd-gens)" flags="ro, remount, bind" 
[  446.339554] audit: type=1400 audit(1785236192.655:361): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/slapd" name="/run/samba/winbindd/pipe" pid=24711 comm="slapd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0
[ 5525.145808] audit: type=1400 audit(1785241271.666:362): apparmor="DENIED" operation="connect" class="file" profile="/usr/sbin/slapd" name="/run/samba/winbindd/pipe" pid=35258 comm="slapd" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

coté amonecole :

ssh addc
root@addc:~# systemctl status samba-ad-dc 
× samba-ad-dc.service - Samba AD Daemon
     Loaded: loaded (/usr/lib/systemd/system/samba-ad-dc.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Tue 2026-07-28 14:27:59 CEST; 877ms ago
   Duration: 13ms
       Docs: man:samba(8)
             man:samba(7)
             man:smb.conf(5)
    Process: 3556 ExecCondition=/usr/share/samba/is-configured samba (code=exited, status=0/SUCCESS)
    Process: 3559 ExecStart=/usr/sbin/samba --foreground --no-process-group $SAMBAOPTIONS (code=exited, status=1/FAILURE)
   Main PID: 3559 (code=exited, status=1/FAILURE)
     Status: "samba: ready to serve connections..." 
        CPU: 1.485s

juil. 28 14:27:58 addc samba[3598]: [2026/07/28 14:27:58.830081,  0] source4/samba/service_task.c:36(task_server_terminate)
juil. 28 14:27:58 addc samba[3598]:   task_server_terminate: task_server_terminate: [Cannot create NTP signd pipe directory: /var/lib/samba/ntp_signd]

### dmesg partie intéressante : 

[  624.849064] audit: type=1400 audit(1785236423.265:580): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/" pid=33258 comm="(sd-gens)" flags="ro, remount, bind" 
[  625.581137] audit: type=1400 audit(1785236423.997:581): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-addc_</var/lib/lxc>" name="/" pid=33300 comm="(sd-gens)" flags="ro, remount, bind" 
[  635.158188] audit: type=1400 audit(1785236433.574:582): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-internet_</var/lib/lxc>" name="/" pid=33488 comm="(sd-gens)" flags="ro, remount, bind" 
[  636.554431] audit: type=1400 audit(1785236434.970:583): apparmor="DENIED" operation="mount" class="mount" info="failed perms check" error=-13 profile="lxc-partage_</var/lib/lxc>" name="/" pid=33660 comm="(sd-gens)" flags="ro, remount, bind" 
[ 5526.596870] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30855]
[ 5526.597015] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30856]
[ 5526.598985] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[1002]
[ 5526.599093] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30853]
[ 5526.599440] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30855]
[ 5526.599508] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30856]
[ 5526.599781] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[1002]
[ 5526.599855] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30853]
[ 5526.600097] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30855]
[ 5526.600151] ptrace attach of "pgrep ^samba$"[52773] was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"[30856]
[ 5651.752397] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.752409] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.752412] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.752414] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.760225] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.760232] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.760235] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.760237] __vm_enough_memory: pid: 54731, comm: setfacl, not enough memory for the allocation
[ 5651.771474] __vm_enough_memory: pid: 54733, comm: setfacl, not enough memory for the allocation
[ 5651.771480] __vm_enough_memory: pid: 54733, comm: setfacl, not enough memory for the allocation
[ 5656.760478] __vm_enough_memory: 2086 callbacks suppressed
[ 5656.760503] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.760509] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.760512] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.760515] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.768390] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.768396] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.768399] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.768401] __vm_enough_memory: pid: 55260, comm: setfacl, not enough memory for the allocation
[ 5656.779639] __vm_enough_memory: pid: 55262, comm: setfacl, not enough memory for the allocation
[ 5656.779646] __vm_enough_memory: pid: 55262, comm: setfacl, not enough memory for the allocation

### journalctl -xfe partie intéressante 

juil. 28 14:27:58 addc (samba)[3559]: samba-ad-dc.service: Referenced but unset environment variable evaluates to an empty string: SAMBAOPTIONS
juil. 28 14:27:58 addc samba[3559]: [2026/07/28 14:27:58.553770,  0] source4/samba/server.c:633(binary_smbd_main)
juil. 28 14:27:58 addc samba[3559]:   samba version 4.19.5-Ubuntu started.
juil. 28 14:27:58 addc samba[3559]:   Copyright Andrew Tridgell and the Samba Team 1992-2023
juil. 28 14:27:58 addc samba[3559]: [2026/07/28 14:27:58.554017,  0] lib/util/become_daemon.c:150(daemon_status)
juil. 28 14:27:58 addc samba[3559]:   daemon 'samba' : Starting process...
juil. 28 14:27:58 addc samba[3575]: [2026/07/28 14:27:58.782646,  0] source4/lib/tls/tlscert.c:55(tls_cert_generate)
juil. 28 14:27:58 addc samba[3575]:   TLS autogeneration skipped - some TLS files already exist
juil. 28 14:27:58 addc smbd[3565]: [2026/07/28 14:27:58.817131,  0] source3/smbd/server.c:1746(main)
juil. 28 14:27:58 addc smbd[3565]:   smbd version 4.19.5-Ubuntu started.
juil. 28 14:27:58 addc smbd[3565]:   Copyright Andrew Tridgell and the Samba Team 1992-2023
juil. 28 14:27:58 addc samba[3598]: [2026/07/28 14:27:58.830081,  0] source4/samba/service_task.c:36(task_server_terminate)
juil. 28 14:27:58 addc samba[3598]:   task_server_terminate: task_server_terminate: [Cannot create NTP signd pipe directory: /var/lib/samba/ntp_signd]
juil. 28 14:27:58 addc systemd[1]: Started samba-ad-dc.service - Samba AD Daemon.
░░ Subject: L'unité (unit) samba-ad-dc.service a terminé son démarrage
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ L'unité (unit) samba-ad-dc.service a terminé son démarrage, avec le résultat done.
juil. 28 14:27:58 addc samba[3559]: [2026/07/28 14:27:58.852321,  0] source4/samba/process_prefork.c:630(prefork_child_pipe_handler)
juil. 28 14:27:58 addc samba[3559]:   prefork_child_pipe_handler: Parent 3559, Child 3567 exited with status 0
juil. 28 14:27:58 addc samba[3559]: [2026/07/28 14:27:58.852993,  0] source4/samba/server.c:403(samba_terminate)
juil. 28 14:27:58 addc samba[3559]:   samba_terminate: samba_terminate of samba 3559: Cannot create NTP signd pipe directory: /var/lib/samba/ntp_signd
juil. 28 14:27:58 addc systemd[1]: samba-ad-dc.service: Main process exited, code=exited, status=1/FAILURE

problème rencontré durant un test de migration 2.8.1 to 2.10
il semble que faire Maj-Auto -C provoque cette cascade d'erreur, et rend samba hors service

Historique

#2 Mis à jour par Ludwig Seys il y a environ un mois

C'est possible. Il existe un problème documenté entre LXCFS et les restrictions ptrace de Yama.
L'issue LXCFS #636 rapporte notamment exactement le même type de message noyau :

ptrace attach of "..." was attempted by "/usr/bin/lxcfs /var/lib/lxcfs"

Un correctif a d'ailleurs été intégré à LXCFS pour tenir compte de la politique ptrace/Yama.

Ça semble donc être une piste sérieuse à vérifier, notamment avec la modification qui positionne kernel.yama.ptrace_scope=3.

cf :
https://github.com/lxc/lxcfs/issues/636
https://github.com/lxc/lxcfs/pull/639

#3 Mis à jour par Joël Cuissinat il y a 13 jours

  • Statut changé de Nouveau à Classée sans suite

Formats disponibles : Atom PDF