1132837 - [Nexus 5] phone cannot startup correctly when flashing pvt "User" build

Status: VERIFIED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Hermes Cheng (inactive after July 27, 2015)]

*Description:
When I flash "user" build from pvt, my device cannot startup correctly.

*pvt link:
https://pvtbuilds.mozilla.org/pvt/mozilla.org/b2gotoro/nightly/mozilla-central-nexus-5-l/latest/

*flash log:
finished. total time: 0.001s
erasing 'cache'...
OKAY [  0.640s]
formatting 'cache' partition...
Creating filesystem with parameters:
    Size: 734003200
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 7472
    Inode size: 256
    Journal blocks: 2800
    Label: 
    Blocks: 179200
    Block groups: 6
    Reserved block group size: 47
Created filesystem with 11/44832 inodes and 5813/179200 blocks
sending 'cache' (13348 KB)...
writing 'cache'...
OKAY [  1.917s]
finished. total time: 2.558s
erasing 'userdata'...
OKAY [  8.562s]
formatting 'userdata' partition...
Creating filesystem with parameters:
    Size: 13725835264
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 8144
    Inode size: 256
    Journal blocks: 32768
    Label: 
    Blocks: 3351034
    Block groups: 103
    Reserved block group size: 823
Created filesystem with 11/838832 inodes and 93654/3351034 blocks
sending 'userdata' (137318 KB)...
writing 'userdata'...
OKAY [ 13.935s]
finished. total time: 22.497s
target reported max download size of 1073741824 bytes
erasing 'userdata'...
OKAY [  7.194s]
sending 'userdata' (137322 KB)...
OKAY [  4.531s]
writing 'userdata'...
OKAY [  9.175s]
finished. total time: 20.900s
target reported max download size of 1073741824 bytes
erasing 'cache'...
OKAY [  0.557s]
sending 'cache' (13348 KB)...
OKAY [  0.640s]
writing 'cache'...
OKAY [  1.078s]
finished. total time: 2.275s
target reported max download size of 1073741824 bytes
sending 'boot' (8784 KB)...
OKAY [  0.497s]
writing 'boot'...
OKAY [  0.745s]
finished. total time: 1.242s
target reported max download size of 1073741824 bytes
erasing 'system'...
OKAY [  0.723s]
sending 'system' (226948 KB)...
OKAY [  7.411s]
writing 'system'...
OKAY [ 16.535s]
finished. total time: 24.669s
rebooting...

Comment 1

[Hermes Cheng (inactive after July 27, 2015)]

Attachment: screenshot of the hanging screen.jpg

The phone hangs on this screenshot.

Comment 2

[[e-mail] (:bhearsum)]

James, I'm not sure if you're the right person to help here, but you probably know who is.

Comment 3

[Kai-Zhen Li [:seinlin][:kli]]

I verified that my local build (user images) does work properly; But after flash pvt build (user images) I can see the same error.

Comment 4

[Kai-Zhen Li [:seinlin][:kli]]

I found the difference, in my local build VARIANT=userdebug, and in pvt build VARIANT=user. When VARIANT=user, disable selinux is not allowed and we doesn't have sepolicy for b2g.

Comment 5

[Kai-Zhen Li [:seinlin][:kli]]

Attachment: User VARIANT=userdebug for nexus-5-l.

nhirata, could you review this patch?

Comment 6

[Kai-Zhen Li [:seinlin][:kli]]

An alternative solution is allow disable Selinux in [1] when VARIANT=user.

[1] https://github.com/mozilla-b2g/platform_system_core/blob/b2g-5.0.0_r6/init/Android.mk#L27

Comment 7

[Kai-Zhen Li [:seinlin][:kli]]

Jed, How do you think about the alternative solution in comment 6? Thanks!

Comment 8

[Paul Theriault [:pauljt] (no longer reading bugmail)]

(In reply to Kai-Zhen Li [:kli][:seinlin] from comment #6)
> An alternative solution is allow disable Selinux in [1] when VARIANT=user.
> 
> [1]
> https://github.com/mozilla-b2g/platform_system_core/blob/b2g-5.0.0_r6/init/
> Android.mk#L27

I'd much prefer that we just created a policy - even if it doesn't restrict b2g at all it could be useful to protect from other compromised processes. Once SELinux is turned off it will hard to get it turned back on again (as we saw in the past with Seccomp-bpf)

Comment 9

[Guillaume Destuynder [:kang] [this account is no longer active]]

we could have an selinux domain for b2g and b2g-related processes that is unrestricted, so that we get the default android policy for the other processes.
if useful, we can then improve the policy for b2g over time.

Comment 10

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

I tend to agree with comment #8 and comment #9.

Comment 11

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Comment on attachment 8565298 [details] [diff] [review]
User VARIANT=userdebug for nexus-5-l.

lgtm.

Comment 12

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Comment on attachment 8565298 [details] [diff] [review]
User VARIANT=userdebug for nexus-5-l.

Review of attachment 8565298 [details] [diff] [review]:
-----------------------------------------------------------------

https://bugzilla.mozilla.org/show_bug.cgi?id=1121577#c36 might be a blocker though.

Comment 13

[Kai-Zhen Li [:seinlin][:kli]]

Thanks! I think we can use VARIANT=userdebug for pvt build. But for VARIANT=user, it would be better to have a policy for b2g.

Comment 14

[Kai-Zhen Li [:seinlin][:kli]]

https://hg.mozilla.org/integration/b2g-inbound/rev/74874130dd25

Comment 15

[Kai-Zhen Li [:seinlin][:kli]]

Comment on attachment 8565298 [details] [diff] [review]
User VARIANT=userdebug for nexus-5-l.

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): disable selinux is not allowed in user build
User impact if declined: pvt user build will not work
Testing completed: verified on m/c
Risk to taking this patch (and alternatives if risky): low, use 'userdebug' instead of 'user'.
String or UUID changes made by this patch: none

Comment 16

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Used b2g-inbound build : it boots up! \o/
20150219023005

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/74874130dd25

Comment 18

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/8607670f0555

Comment 19

[Parul Mathur [:pragmatic] - out of office - please ni? [:bajaj] instead]

Verified that the Nexus 5 L master nightly build can be flashed on a Nexus device, after which the device reboots successfully into Firefox OS.

Steps to Reproduce
1. Take a Nexus device and use the Taiwan QA flashing tool to full flash the latest nightly master build:
https://github.com/Mozilla-TWQA/B2G-flash-tool
$ ./flash_pvt -w
Flashing paramaters: nexus-5-l, mozilla-central, User, images, latest 
https://pvtbuilds.mozilla.org/pvt/mozilla.org/b2gotoro/nightly/mozilla-central-nexus-5-l/latest/

2. Verify that after flashing the phone reboots into Firefox OS.

3. Run the check_versions.sh script to determine the test environment:
$ ./check_versions.sh

This is the output:
Gaia-Rev        e4f7c67378e33e83f88d38ddb4a6c2cabf1423c3
Gecko-Rev       https://hg.mozilla.org/mozilla-central/rev/1b4c5daa7b7a
Build-ID        20150220010206
Version         38.0a1
Device-Name     hammerhead
FW-Release      5.0
FW-Incremental  eng.cltbld.20150220.043517
FW-Date         Fri Feb 20 04:35:32 EST 2015
Bootloader      HHZ11n

Comment 20

[Hermes Cheng (inactive after July 27, 2015)]

verify v2.2

Gaia-Rev        ca64f2fe145909f31af266b1730874051ba76c78
Gecko-Rev       https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/16804008c29f
Build-ID        20150224162516
Version         37.0
Device-Name     hammerhead
FW-Release      5.0
FW-Incremental  eng.cltbld.20150224.201252
FW-Date         Tue Feb 24 20:13:07 EST 2015
Bootloader      HHZ12d