/etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied

Bug #2040924 reported by Steve Langasek
16
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Landscape Client
In Progress
Undecided
Mitch Burton
landscape-client (Ubuntu)
Fix Released
High
Mitch Burton
Focal
Fix Committed
Undecided
Unassigned
Jammy
Fix Committed
Undecided
Unassigned
Mantic
Fix Committed
Undecided
Unassigned

Bug Description

landscape-common in mantic has regressed the autopkgtests for update-motd. The landscape-common package is installed in the cloud images, and as a result its update-motd hook is called as part of the autopkgtest. And for whatever reason, in mantic and later, this hook now produces an error message on stdout that evidently was not there before:

[...]
416s /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
417s autopkgtest [23:07:30]: test show-motd: -----------------------]
421s autopkgtest [23:07:34]: test show-motd: - - - - - - - - - - results - - -
- - - - - - -
421s show-motd FAIL stderr: /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
421s autopkgtest [23:07:34]: test show-motd: - - - - - - - - - - stderr - - - - - - - - - -
421s /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied

https://autopkgtest.ubuntu.com/packages/u/update-motd/mantic/amd64

The existence of the show-motd package implies that users are meant to be able to execute the update-motd hooks. So these hooks should not spew error messages when run as non-root.

[ Impact ]

 * landscape-common's sysinfo motd executable relies on a cache file in a
   location where permissions that are too strict - a user cannot execute
   the update-motd hooks without errors.

 * backporting is justified because this permissions issue exists in previous
   versions, but it only manifests if the cache is old enough. It breaks
   show-motd tests if the cache file is more than 60s old by the time its tests
   run.

 * fixing this includes not attempting to create the cache file in
   landscape-sysinfo when permission issues prevent doing so.

[ Test Plan ]

To reproduce, ensure that /var/lib/landscape-sysinfo.cache does not exist, then
run

     run-parts /etc/update-motd.d/

 as a non-root user. The output will contain the line:

       /etc/update-motd.d//50-landscape-sysinfo: 17: cannot create /var/lib/landscape-sysinfo.cache: Permission denied

When fixed, the run-parts output will not contain the Permission denied error
and the autopkgtest for show-motd should not fail on stderr output.

[ Where problems could occur ]

Changes to landscape-sysinfo could potential break motd in other ways. This
would manifest as other error messages in the motd or the motd failing to be
displayed or updated.

[ Other Info ]

 * Related upstream changes:
   * https://github.com/canonical/landscape-client/pull/201
   * https://github.com/canonical/landscape-client/pull/219

Related branches

Changed in landscape-client (Ubuntu):
assignee: nobody → Mitch Burton (mitchburton)
Changed in landscape-client (Ubuntu):
status: New → Confirmed
Changed in landscape-client (Ubuntu):
status: Confirmed → In Progress
Changed in landscape-client:
assignee: nobody → Mitch Burton (mitchburton)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package landscape-client - 23.08-0ubuntu2

---------------
landscape-client (23.08-0ubuntu2) noble; urgency=medium

  * d/landscape-common.postint: ensure sysinfo cache file exists and is globally
    read-write (LP: #2040924)

 -- Mitch Burton <email address hidden> Thu, 23 Nov 2023 14:28:14 -0800

Changed in landscape-client (Ubuntu):
status: In Progress → Fix Released
Changed in landscape-client:
status: New → In Progress
Revision history for this message
Mitch Burton (mitchburton) wrote :

Per discussion https://github.com/canonical/landscape-client/pull/198.

I'd like to know why this suddenly became a problem in >=mantic. What changed in show-motd? It exits in jammy as the same version (3.10) and this wasn't an issue then. Without knowing this it's hard to be sure that the fix in https://code.launchpad.net/~mitchburton/ubuntu/+source/landscape-client/+git/landscape-client/+merge/456212 is correct.

Revision history for this message
Andreas Hasenack (ahasenack) wrote :
Download full text (3.7 KiB)

Some findings:

a) the bug won't manifest itself it bin:landscape-common is not installed (obviously: just to note it's not a dependency of the test, maybe it should be)
b) bin:landscape-common's postinst runs update-motd once, which generates the /var/lib/landscape/landscape-sysinfo.cache file
c) the landscape-sysinfo motd script checks the age of the cache file. If it's less than 1min old, it WON'T regenerate it, and just display it[1]:

stamp="/var/lib/landscape/landscape-sysinfo.cache"
NEED_UPDATE="FALSE"
[ -z "$(find "$stamp" -newermt 'now-1 minutes' 2> /dev/null)" ] && NEED_UPDATE="TRUE"

Given (c), if the debian/tests/show-motd is reached quickly enough, the bug won't manifest itself. This, maybe with (a), might explain why the bug hasn't shown itself since now.

To test this, I ran the dep8 tests in a jammy container. First, without any changes, it passed. Then I added a sleep 60s, like so:

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

And now it fails:
autopkgtest [11:05:10]: test show-motd: [-----------------------
Sleeping 60s
Continuing
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 6.5.0-13-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

                         .--._ _.--.
                        ( \ / )
                         \ /\ /
                          \_ \/ _/
                           / \
                          ( /\ )
                           `--' `--'

                           FreedomBox

FreedomBox is a pure blend of Debian GNU/Linux. Web interface is available at
https://localhost/ . FreedomBox manual is available in /usr/share/doc/freedombox
and from the web interface.

  System information as of Mon Dec 4 14:04:30 UTC 2023

  System load: 1.66357421875 Temperature: 76.0 C
  Usage of /home: unknown Processes: 27
  Memory usage: 0% Users logged in: 0
  Swap usage: 0% IPv4 address for eth0: 10.0.102.17

If the empty file ~/.hushlogin exists on the server, login to the server
will be super quiet. Only the bash prompt is displayed.

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

*** System restart required ***

This message is shown once a day. To disable it please create the
/home/test/.hushlogin file.
/etc/update-motd.d/50-landscape-sysinfo: 17: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
autopkgtest [11:06:11]: test show-motd: -----------------------]
autopkgtest [11:06:11]: test show-motd: - - - - - - - - - - results - - - - - - - - - -
show-motd FAIL stderr: /etc/update-motd.d/50-landscape-sysinfo: 17: ca...

Read more...

Changed in landscape-client (Ubuntu):
status: Fix Released → Confirmed
importance: Undecided → High
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Related to this, look what I found while testing it...

https://bugs.launchpad.net/ubuntu/+source/landscape-client/+bug/1855544

postinst has been calling update-motd since at least 2009. I don't know if udpate-motd's behavior changed since then, but this is causing the landscape-sysinfo output to be displayed on package upgrade or reinstall. And only landscape-sysinfo, not any of the other scripts' output (from /etc/udpate-motd.d).

The update-motd(8) manpage states:
NAME
       update-motd - immediately update the dynamic MOTD and print it to stdout

This "stdout" component is not desired in the package maintainer script. We should either suppress it, or perhaps better, not use update-motd in the maintainer scripts and find some other way to update the sysinfo cache on install/upgrade.

Revision history for this message
Mitch Burton (mitchburton) wrote :

Directly calling landscape-sysinfo in the maintainer scripts should be enough to update the sysinfo cache. I don't think there's any need to call update-motd there. I'll produce a fix upstream, I think.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package landscape-client - 23.08-0ubuntu4

---------------
landscape-client (23.08-0ubuntu4) noble; urgency=medium

  * d/p/0003-fix-cpuinfo-and-tests.patch: fix ARM and RISCV cpuinfo parsing;
    fix environment var-modifying tests, increase timeout on tests that can
    be slow on these arches (LP: #2046620).

 -- Mitch Burton <email address hidden> Thu, 04 Jan 2023 17:06:26 -0800

Changed in landscape-client (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Dan Bungert (dbungert) wrote :

Hi Mitch,

I went looking for this upstream on master branch and the 24.02 release PR, I think this fix isn't included there yet? If I've missed it please pass that info along, or I suggest incorporating that so that the SRU requirement for fixes being present in devel is retained.

Otherwise LGTM.

Revision history for this message
Mitch Burton (mitchburton) wrote (last edit ):

The fix has been included in upstream. It was included in the following PRs:
https://github.com/canonical/landscape-client/pull/201
https://github.com/canonical/landscape-client/pull/219

Revision history for this message
Mitch Burton (mitchburton) wrote :

Updated description to include SRU bug template.

description: updated
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

About the test plan:
- it should also show the good case, i.e., what's expected to happen with the fixed package
- it should include checking the autopkgtest failure that was the trigger for this bug to be opened, i.e., make sure that that autopkgtest now does not fail

Also either [impact] or [other info] should include a *brief* description about what the fix is.

Revision history for this message
Mitch Burton (mitchburton) wrote :

Updated description to add the "good case" to the test plan and a mention of fixed autopkgtest. Added a brief description of the fix to [impact] section.

description: updated
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Steve, or anyone else affected,

Accepted landscape-client into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.08-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in landscape-client (Ubuntu Mantic):
status: New → Fix Committed
tags: added: verification-needed verification-needed-mantic
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Steve, or anyone else affected,

Accepted landscape-client into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.02-0ubuntu1~22.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in landscape-client (Ubuntu Jammy):
status: New → Fix Committed
tags: added: verification-needed-jammy
Changed in landscape-client (Ubuntu Focal):
status: New → Fix Committed
tags: added: verification-needed-focal
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Steve, or anyone else affected,

Accepted landscape-client into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.02-0ubuntu1~20.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Mitch Burton (mitchburton) wrote :

Tested in mantic using landscape-client and landscape-common versions 23.08-0ubuntu1.1, as ubuntu user in a fresh container: - lxc launch ubuntu:mantic

$ sudo rm -f /var/lib/landscape-sysinfo.cache # just to be sure
$ run-parts /etc/update-motd.d/
Welcome to Ubuntu 23.10 (GNU/Linux 6.5.0-25-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information disabled due to load higher than 1.0

0 updates can be applied immediately.

No errors in motd output, no /var/lib/landscape-sysinfo.cache created.

Tested in focal using landscape-client and landscape-common versions 23.02-0ubuntu1~20.04.2, with same results.

Tested in jammy using landscape-client and landscape-common versions 23.02-0ubuntu1~22.04.2, with same results.

Revision history for this message
Mitch Burton (mitchburton) wrote :

Ran show-motd autopkgtest with the following diff (as mentioned by Andreas previously to reproduce the bug)

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

On mantic, focal, and jammy with -proposed enabled. Results were identical, with tests passing:

autopkgtest [13:15:52]: @@@@@@@@@@@@@@@@@@@@ summary
show-motd PASS
update-motd PASS

tags: added: verification-done verification-done-focal verification-done-jammy verification-done-mantic
removed: verification-needed verification-needed-focal verification-needed-jammy verification-needed-mantic
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Steve, or anyone else affected,

Accepted landscape-client into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.08-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

tags: added: verification-needed verification-needed-mantic
removed: verification-done verification-done-mantic
Revision history for this message
Mitch Burton (mitchburton) wrote :

Tested in mantic using landscape-client and landscape-common versions 23.08-0ubuntu1.2, as ubuntu user in a fresh container: - lxc launch ubuntu:mantic

ubuntu@powerful-lion:~$ sudo rm -f /var/lib/landscape-sysinfo.cache # just to be sure
ubuntu@powerful-lion:~$ run-parts /etc/update-motd.d/
Welcome to Ubuntu 23.10 (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information disabled due to load higher than 1.0

25 updates can be applied immediately.
19 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable

--------

Ran show-motd autopkgtest with the following diff (as mentioned by Andreas previously to reproduce the bug)

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

On mantic with -proposed enabled and landscape-common=23.08-0ubuntu1.2. Tests passed:

autopkgtest [15:51:54]: @@@@@@@@@@@@@@@@@@@@ summary
show-motd PASS
update-motd PASS

tags: added: verification-done verification-done-mantic
removed: verification-needed verification-needed-mantic
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.