Bug 1759597

Summary:	Settings in /usr/lib/sysctl.d take precedence over settings in tuned profiles in /etc/tuned.
Product:	Red Hat Enterprise Linux 8	Reporter:	Jiří Mencák <jmencak>
Component:	tuned	Assignee:	Jaroslav Škarvada <jskarvad>
Status:	CLOSED ERRATA	QA Contact:	Robin Hack <rhack>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.0	CC:	jeder, josorior, jskarvad, olysonek, psklenar, rhack, thozza
Target Milestone:	rc	Keywords:	AutoVerified, Patch, Upstream
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	tuned-2.13.0-0.1.rc1.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	1776149 (view as bug list)		Environment:
Last Closed:	2020-04-28 16:59:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1776149

Description Jiří Mencák 2019-10-08 15:38:30 UTC

Description of problem:
Tuned fails to set certain sysctls (e.g. kernel.yama.ptrace_scope).

Version-Release number of selected component (if applicable):
[root@b8 ~]# rpm -qi tuned
Name        : tuned
Version     : 2.12.0
Release     : 3.el8
Architecture: noarch
Install Date: Tue 08 Oct 2019 11:26:12 AM EDT
Group       : Unspecified
Size        : 732634
License     : GPLv2+
Signature   : RSA/SHA256, Fri 16 Aug 2019 01:11:51 PM EDT, Key ID 199e2f91fd431d51
Source RPM  : tuned-2.12.0-3.el8.src.rpm
Build Date  : Fri 16 Aug 2019 12:19:45 PM EDT
Build Host  : x86-vm-08.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://www.tuned-project.org/
Summary     : A dynamic adaptive system tuning daemon
Description :
The tuned package contains a daemon that tunes system settings dynamically.
It does so by monitoring the usage of several system components periodically.
Based on that information components will then be put into lower or higher
power saving modes to adapt to the current usage. Currently only ethernet
network and ATA harddisk devices are implemented.


How reproducible:
Always

Steps to Reproduce:
[root@b8 ~]# sysctl kernel.kptr_restrict
kernel.kptr_restrict = 0
[root@b8 ~]# sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 0

[root@b8 ~]# cat /etc/tuned/kernel-sec-cc/tuned.conf 
[main]
summary=A custom profile for kernel sysctl settings related to the CC profile

[sysctl]
kernel.kptr_restrict=1
#kernel.dmesg_restrict=1
#kernel.perf_event_paranoid=2
#kernel.kexec_load_disabled=1
kernel.yama.ptrace_scope=1

[root@b8 ~]# tuned --debug --no-dbus
...

2019-10-08 11:31:46,323 INFO     tuned.daemon.daemon: Using 'kernel-sec-cc' profile
2019-10-08 11:31:46,323 INFO     tuned.profiles.loader: loading profile: kernel-sec-cc
2019-10-08 11:31:46,324 INFO     tuned.daemon.controller: starting controller
2019-10-08 11:31:46,324 INFO     tuned.daemon.daemon: starting tuning
2019-10-08 11:31:46,324 DEBUG    tuned.plugins.repository: creating plugin sysctl
2019-10-08 11:31:46,325 DEBUG    tuned.utils.plugin_loader: loading module tuned.plugins.plugin_sysctl
2019-10-08 11:31:46,325 DEBUG    tuned.units.manager: creating 'sysctl' (sysctl)
2019-10-08 11:31:46,325 DEBUG    tuned.plugins.base: initializing instance sysctl (sysctl)
2019-10-08 11:31:46,325 DEBUG    tuned.hardware.inventory: starting monitor observer
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.kptr_restrict' is '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.kptr_restrict' to '1'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Value of sysctl parameter 'kernel.yama.ptrace_scope' is '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '1'
2019-10-08 11:31:46,326 INFO     tuned.plugins.plugin_sysctl: reapplying system sysctl
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.yama.ptrace_scope' to '0'
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/10-default-yama-scope.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf
2019-10-08 11:31:46,326 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_pattern' to '|/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-coredump.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.sysrq' to '16'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'kernel.core_uses_pid' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.rp_filter' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.accept_source_route' to '0'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.ipv4.conf.all.promote_secondaries' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.default_qdisc' to 'fq_codel'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_hardlinks' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'fs.protected_symlinks' to '1'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-default.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Setting sysctl parameter 'net.core.optmem_max' to '81920'
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /usr/lib/sysctl.d/50-libkcapi-optmem_max.conf
2019-10-08 11:31:46,327 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.d/99-sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Applying sysctl settings from file /etc/sysctl.conf
2019-10-08 11:31:46,328 DEBUG    tuned.plugins.plugin_sysctl: Finished applying sysctl settings from file /etc/sysctl.conf
2019-10-08 11:31:46,328 INFO     tuned.daemon.daemon: static tuning from profile 'kernel-sec-cc' applied

In another window:

[root@b8 ~]# sysctl kernel.kptr_restrict
kernel.kptr_restrict = 1
[root@b8 ~]# sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 0

Actual results:
kernel.yama.ptrace_scope = 0

Expected results:
kernel.yama.ptrace_scope = 1

Additional info:
I suspected this might be something to do with:
https://github.com/redhat-performance/tuned/pull/160
but when I reverted, I got the same problem.

Setting the sysctl directly on the host works fine.

Comment 1 Jiří Mencák 2019-10-08 15:47:29 UTC

Actually I think I see the problem looking at the debug now... /usr/lib/sysctl.d/10-default-yama-scope.conf  Why would /usr/lib/sysctl.d have a precedence over a profile in /etc/tuned ?

Comment 2 Ondřej Lysoněk 2019-10-09 13:58:25 UTC

No, it's not caused by that pull request. This is old behaviour, introduced in commit https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f.

You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would be nice if it was possible to override it directly in the profile as well.

I'm not sure what is the exact reason for this behaviour. Perhaps something can be digged up in the bug linked from the commit - bug#1302953.

Comment 3 Jiří Mencák 2019-10-09 15:06:08 UTC

(In reply to Ondřej Lysoněk from comment #2)
> No, it's not caused by that pull request. This is old behaviour, introduced
> in commit
> https://github.com/redhat-performance/tuned/commit/d1986f20f9913cc2f.
> 
> You can set 'reapply_sysctl=0' to override the behaviour. Perhaps it would
> be nice if it was possible to override it directly in the profile as well.
> 
> I'm not sure what is the exact reason for this behaviour. Perhaps something
> can be digged up in the bug linked from the commit - bug#1302953.

Right, BZ1302953 is a great find!  So are we basically saying this is a feature?
While I agree that we probably want the default behaviour reapply_sysctl=1 for
/etc/sysctl.conf and /etc/sysctl.d/*.conf, I'm not quite convinced profiles in
/etc/tuned/ should be overriden by sysctl.conf files (such as
/usr/lib/sysctl.d/10-default-yama-scope.conf) owned by system packages even when
reapply_sysctl=1.  Perhaps the logic can stay, but exclude /usr/lib/sysctl.d/*.conf
when reapply_sysctl=1?  Thoughts?

Comment 9 Ondřej Lysoněk 2019-11-27 11:43:16 UTC

Upstream PR:
https://github.com/redhat-performance/tuned/pull/226

Comment 17 errata-xmlrpc 2020-04-28 16:59:29 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1883