plugin fails if disable_mlock is enabled

[immutability-io]

plugin fails if disable_mlock is enabled

[cypherhat]

Can you give me your Vagrantfile?

[cypherhat]

Also, what is your host OS?

[cypherhat]

Just saw this - https://www.vaultproject.io/docs/configuration/index.html#disable_mlock

sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))

Testing with that...

[shayangz]

my Vagrant file is tied to a bunch internal infrastructure.

I am testing on Ubuntu 16.04

$ uname -a
Linux vagrant-vbox-1 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

[cypherhat]

Ok. After I saw the setcap call, I figured out what was going on...

Basically, this sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault)) allows the vault process to read memory without being root. So, the only thing that needs to be done is to allow the plugin to do the same. (Since it is a separate process.)

$ sudo setcap cap_ipc_lock=+ep $(readlink -f /home/vagrant/etc/vault.d/vault_plugins/vault-ethereum)

Of course, replace /home/vagrant/etc/vault.d/vault_plugins/vault-ethereum with the location of your plugin.

Please let me know if that works for you.

[shayangz]

ah clever! That got me over the cannot allocate memory error. But now I am hitting this error when starting vault:

Mar 15 23:29:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:29:53.252994 [DEBUG] plugin.metadata: starting plugin: path=/etc/vault/plugins/vault-ethereum args=[/etc/vault/plugins/vault-ethereum]
Mar 15 23:29:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:29:53.253577 [DEBUG] plugin.metadata: waiting for RPC address: path=/etc/vault/plugins/vault-ethereum
Mar 15 23:29:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:29:53.283952 [DEBUG] plugin.metadata.vault-ethereum: plugin address: address=/tmp/plugin983040137 network=unix
Mar 15 23:29:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:29:53.285918 [WARN ] plugin.metadata: error closing client during Kill: err=rpc error: code = Canceled desc = grpc: the client connection is closing
Mar 15 23:29:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:29:53.289647 [DEBUG] plugin.metadata: plugin process exited: path=/etc/vault/plugins/vault-ethereum

and attempting to write to accounts gets me this error

$ vault write ethereum/test4 chain_id=1977
Error writing data to ethereum/accounts/test4: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/ethereum/accounts/test4
Code: 500. Errors:

* 1 error occurred:

* rpc error: code = Unavailable desc = transport is closing

corresponding to this in the vault logs:

Mar 15 23:31:16 vagrant-vbox-1 vault[8870]: 2018/03/15 23:31:16.621148 [DEBUG] plugin: plugin process exited: path=/etc/vault/plugins/vault-ethereum
Mar 15 23:31:53vagrant-vbox-1 vault[8870]: 2018/03/15 23:31:53.300739 [WARN ] plugin: error closing client during Kill: err=rpc error: code = Canceled desc = grpc: the client connection is closing
Mar 15 23:31:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:31:53.470534 [DEBUG] plugin: starting plugin: path=/etc/vault/plugins/vault-ethereum args=[/etc/vault/plugins/vault-ethereum]
Mar 15 23:31:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:31:53.472178 [DEBUG] plugin: waiting for RPC address: path=/etc/vault/plugins/vault-ethereum
Mar 15 23:31:53 vagrant-vbox-1 vault[8870]: 2018/03/15 23:31:53.558112 [DEBUG] plugin.vault-ethereum: plugin address: address=/tmp/plugin093062371 network=unix

Incidentally, running vault read ethereum/test1 on an existing account works fine.

again setting disable_mlock to true makes the error go away.

[cypherhat]

I was able to successfully execute vault write ethereum/test4 chain_id=1977 with mlock with the above setcap commands. However, I am running with TLS.

If you want to run in a production setting, then you should use TLS. I haven't tested much without TLS of late because I never use vault without it.

You can see how I configure vault with TLS (and install the plugin) here

[shayangz]

fair enough on TLS. Once I turned TLS on, everything works fine.

I see the follow error logs when starting vault, but plugin seems to still function.

Mar 16 00:36:36 vault-i-x vault[28310]: 2018/03/16 00:36:36.248995 [DEBUG] plugin.metadata: starting plugin: path=/etc/vault/plugins/vault-ethereum args=[/etc/vault/plugins/vault-ethereum --ca-cert=/etc/ssl/certs/ca.pem --client-cert=/etc/vault/ssl/certs/vault.crt --client-key=/etc/vault/ssl/private/vault.key]
Mar 16 00:36:36 vault-i-x vault[28310]: 2018/03/16 00:36:36.249913 [DEBUG] plugin.metadata: waiting for RPC address: path=/etc/vault/plugins/vault-ethereum
Mar 16 00:36:36 vault-i-x vault[28310]: 2018/03/16 00:36:36.289086 [DEBUG] plugin.metadata.vault-ethereum: plugin address: address=/tmp/plugin033840308 network=unix
Mar 16 00:36:36 vault-i-x vault[28310]: 2018/03/16 00:36:36.296467 [WARN ] plugin.metadata: error closing client during Kill: err=rpc error: code = Canceled desc = grpc: the client connection is closing
Mar 16 00:36:36 vault-i-x vault[28310]: 2018/03/16 00:36:36.301168 [DEBUG] plugin.metadata: plugin process exited: path=/etc/vault/plugins/vault-ethereum