Page MenuHomePhabricator

firejail for mediawiki converter leaks to stderr: "Reading profile /etc/firejail/mediawiki-converters.profile"
Closed, ResolvedPublic

Description

The mediawiki-firejail-* scripts wrap various commands with firejail --profile=/etc/firejail/mediawiki-converters.profile. Firejails emits to STDERR a message stating it is loading the profile:

Reading profile /etc/firejail/mediawiki-converters.profile

Since MediaWiki does not shallow stderr (T157646), the message ends up to HHVM and thus to the hhvm log bucket in logstash causing unneeded spam.

Making firejail quiet would fix it.

Event Timeline

hashar created this task.Feb 21 2017, 2:52 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 21 2017, 2:52 PM
hashar claimed this task.Feb 21 2017, 3:08 PM
hashar triaged this task as Low priority.

Change 338978 had a related patch set uploaded (by Hashar):
mediawiki-firejail: lint python scripts

https://gerrit.wikimedia.org/r/338978

Change 338979 had a related patch set uploaded (by Hashar):
mediawiki-firejail: explicitly signal end of options

https://gerrit.wikimedia.org/r/338979

Change 338980 had a related patch set uploaded (by Hashar):
mediawiki-firejail: quiet firejail

https://gerrit.wikimedia.org/r/338980

Change 338978 abandoned by Hashar:
mediawiki-firejail: lint python scripts

https://gerrit.wikimedia.org/r/338978

Change 338979 abandoned by Hashar:
mediawiki-firejail: explicitly signal end of options

https://gerrit.wikimedia.org/r/338979

Change 338980 abandoned by Hashar:
mediawiki-firejail: quiet firejail

Reason:
Lets keep it verbose so. Maybe upstream will make the logging easier to tweak.

https://gerrit.wikimedia.org/r/338980

Change 348228 had a related patch set uploaded (by Hashar):
[mediawiki/core@master] Shallow stderr when running convert --version

https://gerrit.wikimedia.org/r/348228

I have found a straightforward case: MediaWiki invokes convert --version but lets stderr untouched. By capturing it I guess that will get rid of most of the "Reading profile /etc/firejail/mediawiki-converters.profile" log spam :}

Change 348228 merged by Krinkle:
[mediawiki/core@master] media: Capture stderr when running 'convert --version'

https://gerrit.wikimedia.org/r/348228

Apparently the log entry is gone from beta cluster which is encouraging.

Change 350203 had a related patch set uploaded (by Hashar):
[mediawiki/core@wmf/1.29.0-wmf.20] media: Capture stderr when running 'convert --version'

https://gerrit.wikimedia.org/r/350203

Change 350203 merged by Hashar:
[mediawiki/core@wmf/1.29.0-wmf.20] media: Capture stderr when running 'convert --version'

https://gerrit.wikimedia.org/r/350203

Mentioned in SAL (#wikimedia-operations) [2017-04-25T13:37:11Z] <hashar@naos> Synchronized php-1.29.0-wmf.20/includes/media/TransformationalImageHandler.php: media: Capture stderr when running convert --version - T158649 (duration: 00m 47s)

They should be gone from production cluster now.

hashar closed this task as Resolved.Apr 25 2017, 2:05 PM

Change 338979 restored by Hashar:
mediawiki-firejail: explicitly signal end of options

https://gerrit.wikimedia.org/r/338979

Change 338979 abandoned by Hashar:
mediawiki-firejail: explicitly signal end of options

https://gerrit.wikimedia.org/r/338979