packages (multiple) failed to install/upgrade: unable to open 'xxxxx.dpkg-new': Operation not permitted

[Joshua Samuel]

Happening with VSCode install, linux-image-extra-4.8.0 and more.

ProblemType: Package
DistroRelease: Ubuntu 16.04
Package: linux-image-4.8.0-49-generic (not installed)
ProcVersionSignature: Ubuntu 4.8.0-46.49~16.04.1-generic 4.8.17
Uname: Linux 4.8.0-46-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
Date: Tue Apr 25 13:34:27 2017
DuplicateSignature:
 package:linux-image-4.8.0-49-generic:(not installed)
 Unpacking linux-image-4.8.0-49-generic (4.8.0-49.52~16.04.1) ...
 dpkg: error processing archive /var/cache/apt/archives/linux-image-4.8.0-49-generic_4.8.0-49.52~16.04.1_amd64.deb (--unpack):
  unable to open '/boot/vmlinuz-4.8.0-49-generic.dpkg-new': Operation not permitted
ErrorMessage: unable to open '/boot/vmlinuz-4.8.0-49-generic.dpkg-new': Operation not permitted
InstallationDate: Installed on 2017-04-18 (6 days ago)
InstallationMedia: Ubuntu 16.04.2 LTS "Xenial Xerus" - Release amd64 (20170215.2)
RelatedPackageVersions:
 dpkg 1.18.4ubuntu1.1
 apt 1.2.19
SourcePackage: linux-hwe
Title: package linux-image-4.8.0-49-generic (not installed) failed to install/upgrade: unable to open '/boot/vmlinuz-4.8.0-49-generic.dpkg-new': Operation not permitted
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[iczero (iczero)]

This bug also affects me, but apt segfaults sometimes:

Preparing to unpack .../linux-image-extra-4.13.0-21-generic_4.13.0-21.24_amd64.deb ...
Unpacking linux-image-extra-4.13.0-21-generic (4.13.0-21.24) ...
dpkg: error processing archive /var/cache/apt/archives/linux-image-extra-4.13.0-21-generic_4.13.0-21.24_amd64.deb (--unpack):
 unable to open '/lib/modules/4.13.0-21-generic/kernel/drivers/scsi/sym53c8xx_2/sym53c8xx.ko.dpkg-new': Operation not permitted
[1] 18746 segmentation fault sudo apt install -f
                                                    %

I am using Ubuntu 17.10.

[Brian Murray (brian-murray)]

Looking at the original reporter's Df.txt file we can see that /boot is not mounted. This would cause the failure and is not something we can really fix.

[iczero (iczero)]

Disabling sophos antivitus has fixed the problem for me. See original comment at https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1739991/comments/3

[Urop (urop)]

See this duplicate: https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/1855259/comments/11. This is likely a bug in fanotify or Sophos, not dpkg.

It would be useful to know whether the original poster (https://launchpad.net/~jsamuel-s) was using Sophos AV or fanotify at the time.

[Paulo Sequeira (psequeirag)]

FYI, someone in a Sohos forum posted a workaround that can help relieve some of the pain with the issues caused by the product until it's more thoroughly diagnosed and addressed: adding pre & post rules to temporarily deactivate the AV on-access scanner while updates take place. Quoting from the forum post:

> I did this by creating the file /etc/apt/apt.conf.d/00sav-protect with the contents:

DPkg::Pre-Invoke {
  "echo Stopping sav-protect...";
  "systemctl stop sav-protect.service";
  "echo Done";
};
DPkg::Post-Invoke {
  "echo Starting sav-protect...";
  "systemctl start sav-protect.service";
  "echo Done";
};

See https://community.sophos.com/products/server-protection-integration/f/sophos-anti-virus-for-linux-basic/117256/sav-protect-service-breaks-system-updates-on-ubuntu/425935#425935