#1115397 passt: Segmentation fault when running pasta

Package:
passt
Source:
passt
Description:
user-mode networking daemons for virtual machines and namespaces
Submitter:
ChangZhuo Chen
Date:
2025-09-17 12:17:02 UTC
Severity:
normal
#1115397#5
Date:
2025-09-16 16:28:32 UTC
From:
To:
Hi,

I cannot run pasta command because it always crashes with segmentation
fault.

    at 2025-09-17T00:27:04+08:00 ❯ pasta
    [1]    2824607 segmentation fault  pasta
#1115397#10
Date:
2025-09-16 16:54:47 UTC
From:
To:
Hi,

Thanks for reporting this. My apologies, I have only tested things with
older kernel and glibc versions. I'm trying to reproduce this right now.
#1115397#15
Date:
2025-09-16 16:54:47 UTC
From:
To:
Hi,

Thanks for reporting this. My apologies, I have only tested things with
older kernel and glibc versions. I'm trying to reproduce this right now.
#1115397#20
Date:
2025-09-16 17:33:07 UTC
From:
To:
On Tue, 16 Sep 2025 18:54:47 +0200 Stefano Brivio <sbrivio@redhat.com> wrote:

Sorry, I can't reproduce this with the glibc and kernel versions you
mentioned:
#1115397#25
Date:
2025-09-16 17:33:07 UTC
From:
To:
On Tue, 16 Sep 2025 18:54:47 +0200 Stefano Brivio <sbrivio@redhat.com> wrote:

Sorry, I can't reproduce this with the glibc and kernel versions you
mentioned:
#1115397#30
Date:
2025-09-17 02:59:11 UTC
From:
To:
The following is output. I am not sure how to fix the Permission denied
error. The strace works with other binary like `ls`.

    $ strace -f pasta -- true
    execve("/usr/bin/pasta", ["pasta", "--", "true"], 0x7fff4d848cd8 /* 108
    vars */) = -1 EACCES (Permission denied)
    +++ killed by SIGSEGV +++
    [1]    2981418 segmentation fault  strace -f pasta -- true

I also try to load it with gdb without success. The following is gdb
output.

    $ gdb pasta
    Type "apropos word" to search for commands related to "word"...
    Reading symbols from pasta...
    Reading symbols from
    /usr/lib/debug/.build-id/af/ac0d87c7eccf786d9dad134b37290f3ae70719.debug...
    (gdb) r
    Starting program: /usr/bin/pasta
    During startup program terminated with signal SIGSEGV, Segmentation fault.
    (gdb)
#1115397#35
Date:
2025-09-17 10:49:26 UTC
From:
To:
[Note that you didn't answer on the ticket, I'm not sure if it's
intentional, but I'm replying to you directly in case it was. Feel free
to copy / quote my reply in public]

On Wed, 17 Sep 2025 10:59:11 +0800 ChangZhuo Chen (陳昌倬) <czchen@czchen.org> wrote:

I can't explain the SIGSEGV as a result of execve() being denied, but
the issue starts smelling like either AppArmor or something wrong with
the binary as currently stored on the filesystem.

Could you try:

1. 'ls -l /usr/bin/pasta'

2. 'file /usr/bin/pasta'

3. 'aa-enforce pasta', and then start it again?

4. if 3. doesn't change anything, disable AppArmor altogether
   (temporarily, just for the test!) with 'aa-teardown', and try again?
#1115397#40
Date:
2025-09-17 11:47:05 UTC
From:
To:
Opps, good catch. The discuss shall be in public.

$ ls -l /usr/bin/pasta
-rwxr-xr-x 2 root root 292K Sep 11 23:47 /usr/bin/pasta*

$ file /usr/bin/pasta
/usr/bin/pasta: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bc7ade7fef69c77ec50487ee226033e9922f1cc8, for GNU/Linux 3.2.0, stripped

Try with normal user:

    $  aa-enforce pasta
    Cannot write to profile directory.
    Please run as a user with appropriate permissions.

    ERROR: Cannot write to profile directory: /etc/apparmor.d

Try with sudo

    $ sudo aa-enforce pasta
    Setting /usr/bin/pasta to enforce mode.
    Warning: profile pasta represents multiple programs

It works after `aa-teardown`:

    $ sudo aa-teardown
    Unloading AppArmor profiles

    $ pasta -- true
    No interfaces with usable IPv4 routes
    No interfaces with usable IPv6 routes
#1115397#45
Date:
2025-09-17 12:00:31 UTC
From:
To:
On Wed, 17 Sep 2025 19:47:05 +0800 ChangZhuo Chen (陳昌倬) <czchen@czchen.org> wrote:

So it's AppArmor, but I can't reproduce this with the current policy (I
still have to try with a fresh re-install of the package though).

...oops, sorry, I meant to ask if you could try with
'aa-complain pasta' instead of aa-enforce (also as root or with sudo,
I forgot to mention).

That is, now that we know it's something off with the AppArmor policy,
I'm trying to understand if it's the correct profile being applied, at
least. If it is, 'aa-complain pasta' would also make things work.

We had some related glitches in the past, solved here:

https://salsa.debian.org/sbrivio/passt/-/commit/5bb812e79143670a57440cd8aa7f2979583c5a0a
https://salsa.debian.org/sbrivio/passt/-/commit/b52557fedcb1772ed47b05c095d81f7aac9657d9
https://salsa.debian.org/sbrivio/passt/-/commit/4a77ef55c34c579d4845aa2dfd003abf2195ea9b
#1115397#50
Date:
2025-09-17 12:10:35 UTC
From:
To:
pasta does not creash with SIGSEGV after I successful run it after
`aa-teardown`, even with AppArmor enabled (check via `systemctl
status apparmor`).
Setting /usr/bin/pasta to complain mode.
Warning: profile pasta represents multiple programs
Warning: profile pasta represents multiple programs
#1115397#55
Date:
2025-09-17 12:14:45 UTC
From:
To:
On Wed, 17 Sep 2025 20:10:35 +0800 ChangZhuo Chen (陳昌倬) <czchen@debian.org> wrote:

It's actually not pasta itself crashing, as it doesn't even start. It
seems to be the shell, for whatever reason. But anyway, that doesn't
matter much.

...and, sorry, I took it for granted: try to run pasta after 'sudo
aa-complain pasta'?