[Impact]
* Unattended-upgrades hangs and gets killed when installing upgrades that stat/stop services on shutdown, leaving the system in a broken state
[Test Case]
* Install an updated bionic system:
$ lxc launch ubuntu:18.04 uu-shutdown-test
# apt update
...
* When testing the fixed version, install upgrade u-u at this point checking that u-u.service is set up before and is wanted by shutdown.target:
# systemd-analyze dot | grep unatt
"unattended-upgrades.service"->"-.mount" [color="green"];
"unattended-upgrades.service"->"system.slice" [color="green"];
"unattended-upgrades.service"->"network.target" [color="green"];
"unattended-upgrades.service"->"systemd-journald.socket" [color="green"];
"unattended-upgrades.service"->"local-fs.target" [color="green"];
"unattended-upgrades.service"->"-.mount" [color="black"];
"unattended-upgrades.service"->"system.slice" [color="black"];
"shutdown.target"->"unattended-upgrades.service" [color="green"];
"shutdown.target"->"unattended-upgrades.service" [color="grey66"];
Color legend: black = Requires
dark blue = Requisite
dark grey = Wants
red = Conflicts
green = After
* Configure u-u to run on shutdown and install -updates:
# echo 'Unattended-Upgrade::InstallOnShutdown "true";' > /etc/apt/apt.conf.d/51unattended-upgrades-on-shutdown
# echo 'Unattended-Upgrade::Allowed-Origins:: "${distro_id}:${distro_codename}-updates";' > /etc/apt/apt.conf.d/51unattended-upgrades-updates-too
* Downgrade snapd:
# apt install snapd=2.32.5+18.04
* Dowload packages for u-u:
# unattended-upgrade --download-only
* Reboot using logind to let inhibitors hold up shutdown:
# dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1 "org.freedesktop.login1.Manager.Reboot" boolean:false
* With not fixed u-u observe the upgrade process being stuck:
# pstree| grep unatt
`-unattended-upgr---unattended-upgr-+-unattended-upgr---dpkg---snapd.prerm---systemctl
`-{unattended-upgr}
* With fixed u-u observe snapd update taking place and system rebooting after a few seconds with all updates installed
[Regression Potential]
* As part of the fix manual changes were made to postinst to properly transition from coupling u-u.service with multi-user.target to coupling it with shutdown.target again which can make u-u started during normal boot when there is a bug in the implementation.
on-testing the SRU.
* Due to relationship changes between u-u.service, other services and targets u-u may fail to run on shutdown in case of an unexpected regression.
* There is a rarely occurring new crash caused by the (second) fix tracked in LP: #1806487.
[Original Bug Text]
When using unattended-upgrades with "InstallOnShutdown" on Bionic, the package installation on various packages hangs until the systemd ShutdownTimeout (30min) is expired and systemd kills all processes and powers off/reboots the system.
This leaves packages in an unconfigured, broken state. At least sometimes this cannot be fixed with a "dpkg --configure -a", but instead requires the user to manually reinstall the package that caused the hang.
This appears to be a deadlock, because the hanging commands are always "systemctl stop ..." or "systemctl restart ...", etc.. If I understand this correctly, those systemctl commands block because systemd tries to shutdown the system and tries to satisfy all dependencies for the shutdown targets before those systemctl commands could get executed, which creates a deadlock.
Steps to reproduce:
- Install 18.04
- activate "InstallOnShutdown" in /etc/apt/apt.conf.d/50unattended-upgrades
- disable bionic-updates in /etc/apt/sources.list (more on that later)
- execute "unattended-upgrade --download-only"
- reboot the system
-> The upgrade on shutdown hangs when configuring the apport package. The hanging command is "systemctl stop apport-forward.socket". The system hangs until the systemd ShutdownTimeout expires and systemd forcefully reboots the system.
After the system is rebooted the apport package is in "iUR" state, and needs to be reinstalled to fix this.
I disabled the bionic-updates pocket in sources.list, because in the default configuration unattended-updates does not use bionic-updates, and seems to have skipped installation of apport from bionic-security (supposedly because an already newer version of apport was in bionic-updates). If my understanding of why apport initially did not get installed is correct, then this would be another problem, because it would mean that unattended-upgrades potentially does not install all available security updates when bionic-updates is enabled in sources.list (which is the default).
The problem can also be reproduced without disabling bionic-updates in sources.list, but instead enabling bionic-updates in /etc/apt/apt.conf.d/50unattended-upgrades. Then, in my case, the upgrade did hang when installing the package snapd (the hanging command was "systemctl stop snapd.autoimport.service snapd.core-fixup.service snapd.service snapd.snap-repair.service snapd.snap-repair.service snapd.socket snapd.system-shutdown.service"). This leads to the same problems as described above.
---
ApportVersion: 2.20.9-0ubuntu7.1
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 18.04
InstallationDate: Installed on 2018-06-22 (0 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Release amd64 (20180426)
Package: unattended-upgrades 1.1ubuntu1
PackageArchitecture: all
ProcVersionSignature: Ubuntu 4.15.0-20.21-generic 4.15.17
Tags: bionic
Uname: Linux 4.15.0-20-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
_MarkForUpload: True
apport information