1

I have a laptop running xenial on. I do not have debug kerneol symbols installed because I can't seem to find them. I am in the stapdev and stapusr groups uname -a is as follows:

Linux zippy1981-Inspiron-15-7568 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

It seems to be an issue of a lack of ssl certificates but I'm not sure how to rectify it. Running a simple stap one liner outputs the following:

zippy1981@zippy1981-Inspiron-15-7568:~$ stap -e 'probe kernel.function("sys_open") {log("hello world") exit()}'
Using a compile server.
Error initializing NSS for dbm:/etc/systemtap/ssl/client
(-8015) Database has the wrong format.
Unable to find a suitable compile server.  [man stap-server]
The following servers are online:
 host=zippy1981-Inspiron-15-7568.local address=fe80::881:e05c:d69d:de29%enx00e08f008e53 port=37512 sysinfo="4.4.0-21-generic x86_64" version=2.9 certinfo="00:a6:b9:e1:85"
 host=zippy1981-Inspiron-15-7568.local address=172.17.0.1 port=37512 sysinfo="4.4.0-21-generic x86_64" version=2.9 certinfo="00:a6:b9:e1:85"
 host=zippy1981-Inspiron-15-7568.local address=192.168.0.211 port=37512 sysinfo="4.4.0-21-generic x86_64" version=2.9 certinfo="00:a6:b9:e1:85"
No servers matched the selection criteria of online,trusted,compatible.
Passes: via server failed.  Try again with another '-v' option.
The kernel on your system requires modules to be signed for loading.
The module created by compiling your script must be signed by a systemtap compile-server.  [man stap-server]
--use-server was automatically selected in order to request compilation by a compile-server.
Tip: /usr/share/doc/systemtap/README.Debian should help you get started.
zippy1981@zippy1981-Inspiron-15-7568:~$

What should I do?

1 Answer 1

2

The error message from this older version of systemtap is not specific enough about the problem. The key line is "Using a compile server.". Why is it using such a server? Because your account does not have the privileges required to build & run an arbitrary systemtap script. Systemtap is hoping that by using a compile server that has been authorized by your local sysadmin, your unprivileged user may be able to run the script. Then that effort fails because none of the servers it found are so authorized.

So, what to do? The easiest thing to do is to run systemtap as root: sudo stap ..... The second easiest thing to do is to get your userid put into the stapdev and stapusr UNIX groups, which is roughly root-equivalent in power. In both these cases, you can locally build & run arbitrary stap scripts. The third easiest thing to do is to set up the remote compilation & limited privilege stuff; for that see man stap-server.

4
  • The thing is I am sure I am in stapdev and stapusr though. Groups outputs the following adm cdrom sudo dip plugdev lpadmin sambashare docker stapdev stapusr. Also, even running it with sudo produces the same results. Is there some SELinux or other thing stopping me? Jun 22, 2016 at 15:00
  • Another possibility is that you have SecureBoot turned on. In that case, a stap compilation server needs to be set up to sign modules with a Machine Owner Key. Details at sourceware.org/systemtap/wiki/SecureBoot .
    – fche
    Jun 22, 2016 at 17:35
  • Ah, yes that's probably it. I have UEFI secureboot turned on. Do newer versions give a better error if UEFI is on? If not should I make a feature request? Jun 22, 2016 at 17:47
  • Yeah, we really should improve those messages.
    – fche
    Jun 22, 2016 at 20:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .