Hello
on a pve node at boot we get kernel messages kernel: landlock: Disabled but requested by user space. The log messages before/after all belong to corosync. There are no VMs running on the node.
Does corosync or any other PVE related service use landlock? Should we enable it, or enable it in any case?
The current versions are given below. But I see the messages since May 26, this was kernel 7.0.2-6-pve
I did stop PVE and started again, this didn't trigger the kernel message:
systemctl stop pvedaemon
systemctl stop pveproxy
systemctl stop pve-cluster
versions
on a pve node at boot we get kernel messages kernel: landlock: Disabled but requested by user space. The log messages before/after all belong to corosync. There are no VMs running on the node.
Does corosync or any other PVE related service use landlock? Should we enable it, or enable it in any case?
The current versions are given below. But I see the messages since May 26, this was kernel 7.0.2-6-pve
Code:
Jul 24 11:20:32 systemd[1]: Started pmlogger_farm_check.timer - Half-hourly check of pmlogger farm instances.
Jul 24 11:20:32 systemd[1]: Reached target timers.target - Timer Units.
Jul 24 11:20:32 corosync[3706]: [TOTEM ] totemknet initialized
Jul 24 11:20:32 corosync[3706]: [KNET ] pmtud: MTU manually set to: 0
Jul 24 11:20:32 corosync[3706]: [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so
Jul 24 11:20:33 kernel: landlock: Disabled but requested by user space. You should enable Landlock at boot time: https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration
Jul 24 11:20:33 corosync[3706]: [SERV ] Service engine loaded: corosync configuration map access [0]
Jul 24 11:20:33 corosync[3706]: [QB ] server name: cmap
Jul 24 11:20:33 corosync[3706]: [SERV ] Service engine loaded: corosync configuration service [1]
Jul 24 11:20:33 corosync[3706]: [QB ] server name: cfg
Jul 24 11:20:33 corosync[3706]: [SERV ] Service engine loaded: corosync cluster closed process group service v1.01 [2]I did stop PVE and started again, this didn't trigger the kernel message:
systemctl stop pvedaemon
systemctl stop pveproxy
systemctl stop pve-cluster
versions
Code:
# pveversion --verbose
proxmox-ve: 9.2.0 (running kernel: 7.0.14-6-pve)
pve-manager: 9.2.5 (running version: 9.2.5/20242970da7fbcef)
proxmox-kernel-helper: 9.2.0
proxmox-kernel-7.0.14-6-pve-signed: 7.0.14-6
proxmox-kernel-7.0: 7.0.14-6
proxmox-kernel-7.0.14-4-pve-signed: 7.0.14-4
proxmox-kernel-7.0.14-3-pve-signed: 7.0.14-3
proxmox-kernel-6.17.13-19-pve-signed: 6.17.13-19
proxmox-kernel-6.17: 6.17.13-19
proxmox-kernel-6.17.13-15-pve-signed: 6.17.13-15
proxmox-kernel-6.17.2-1-pve-signed: 6.17.2-1
DEBIAN_VERSION_FULL=13.6