package apparmor 2.13.3-7ubuntu4 failed to install/upgrade: end of file on stdin at conffile prompt

[hrkrx]

I have no definite idea what happened, it just popped up randomly.

I can only assume it was trying to show the usual update notification

ProblemType: Package
DistroRelease: Ubuntu 20.04
Package: apparmor 2.13.3-7ubuntu4
ProcVersionSignature: Ubuntu 5.4.0-21.25-generic 5.4.27
Uname: Linux 5.4.0-21-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu24
AptOrdering:
 apparmor:amd64: Install
 NULL: ConfigurePending
Architecture: amd64
Date: Wed Apr 8 13:57:33 2020
ErrorMessage: end of file on stdin at conffile prompt
InstallationDate: Installed on 2020-03-25 (13 days ago)
InstallationMedia: Ubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200324)
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-5.4.0-21-generic root=UUID=66ca0e88-1f73-48ce-a0ae-cfa14442ffe1 ro quiet splash vt.handoff=7
Python3Details: /usr/bin/python3.8, Python 3.8.2, python3-minimal, 3.8.2-0ubuntu2
PythonDetails: N/A
RelatedPackageVersions:
 dpkg 1.19.7ubuntu3
 apt 2.0.1ubuntu1
SourcePackage: apparmor
Syslog:
 Apr 8 13:04:35 sebipc dbus-daemon[1090]: [system] AppArmor D-Bus mediation is enabled
 Apr 8 13:04:44 sebipc dbus-daemon[1479]: [session uid=125 pid=1479] AppArmor D-Bus mediation is enabled
 Apr 8 13:05:16 sebipc dbus-daemon[2072]: [session uid=1000 pid=2072] AppArmor D-Bus mediation is enabled
 Apr 8 13:55:52 sebipc dbus-daemon[2072]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/" interface="org.freedesktop.DBus.Introspectable" member="Introspect" mask="send" name="com.canonical.Unity" pid=11890 label="snap.telegram-desktop.telegram-desktop" peer_pid=2359 peer_label="unconfined"
 Apr 8 13:55:53 sebipc dbus-daemon[2072]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/ScreenSaver" interface="org.freedesktop.ScreenSaver" member="GetSessionIdleTime" mask="send" name="org.freedesktop.ScreenSaver" pid=11890 label="snap.telegram-desktop.telegram-desktop" peer_pid=2462 peer_label="unconfined"
Title: package apparmor 2.13.3-7ubuntu4 failed to install/upgrade: end of file on stdin at conffile prompt
UpgradeStatus: No upgrade log present (probably fresh install)
mtime.conffile..etc.apparmor.d.abstractions.base: 2020-03-26T13:00:28.401582

[Jamie Strandboge (jdstrand)]

Per https://launchpadlibrarian.net/473598993/DpkgHistoryLog.txt, unattended-upgrades is running on this system.

Per https://launchpadlibrarian.net/473598999/modified.conffile..etc.apparmor.d.abstractions.base.txt, /etc/apparmor.d/abstraction/base was modified to include:

  # adds networking to all snaps
  network inet,
  network inet6,

Per https://launchpadlibrarian.net/473598994/DpkgTerminalLog.txt, as part of the upgrade, a prompt was presented:

Configuration file '/etc/apparmor.d/abstractions/base'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ? Your options are:
    Y or I : install the package maintainer's version
    N or O : keep your currently-installed version
      D : show the differences between the versions
      Z : start a shell to examine the situation
 The default action is to keep your current version.
*** base (Y/I/N/O/D/Z) [default=N] ? dpkg: error processing package apparmor (--configure):
 end of file on stdin at conffile prompt

but since the upgrade was unattended, the prompt went unanswered.

You should be able to set things right again with: sudo apt-get -f install

This is not a bug in the apparmor package, so marking this task as Invalid.

[Jamie Strandboge (jdstrand)]

Foundations, it seems like unattended-upgrades should be smarter with conffile changes (honestly, I thought it was)? Note, the security also saw this in https://bugs.launchpad.net/ubuntu/+source/ufw/+bug/1871261. Is this a regression?

[Balint Reczey (rbalint)]

@jdstrand yes, u-u is designed to avoid such prompts. There could be a regression in doing so.

[Seth Arnold (seth-arnold)]

This has happened more than just these two cases, the timing was just enough for me to enquire about it.

sarnold@millbarge:~/.mail_cache$ grep -r 'end of file on stdin at conffile prompt' | wc -l
74

Thanks

[Balint Reczey (rbalint)]

@jdstrand I tried reproducing the issue with ufw, but u-u seems to be working ok, or it is not failing all the time at least when config files are changed. A reliable way of reproducing the issue would be nice, but I'll keep thinking.

[Balint Reczey (rbalint)]

@jdstrand @seth-arnold I may have fixed the issue in 2.2, please monitor if it occurs again with 2.2 which hopefully gets accepted today.

[Jamie Strandboge (jdstrand)]

Thanks!

[Seth Arnold (seth-arnold)]

Thanks Balint! I gave a very quick read to the 2.2 debdiff and couldn't spot the fix, though -- I'd just like to double-check that the fix made it to the packaging.

Thanks

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 2.3

---------------
unattended-upgrades (2.3) unstable; urgency=medium

  * Fix checking if Python regexp is also a POSIX regexp
  * Prepend implied '^' when converting Python regex to a POSIX one
  * Blacklist not trusted packages and ones with conffile prompts
    instead of just pinning them once with NEVER_PIN which is can be cleared
    later. (LP: #1871615) (Closes: #956339)

 -- Balint Reczey <email address hidden> Tue, 14 Apr 2020 00:37:21 +0200