rmdir: failed to remove '/etc/systemd/system/ssh.socket.d': Directory not empty

[Nick Rosbrook]

[Impact]

If a user a has an existing drop-in config for ssh.socket in /etc/systemd/system/ssh.socket.d upgrades to kinetic, and openssh-server.postint determines it should *not* perform migration to socket-activated ssh, they will receive an error from dpkg:

Errors were encountered while processing:
 openssh-server
Exception during pm.DoInstall(): E:Sub-process /usr/bin/dpkg returned an error code (1)

Could not install the upgrades

The upgrade has aborted. Your system could be in an unusable state. A
recovery will run now (dpkg --configure -a).

Please report this bug in a browser at
http://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+filebug
and attach the files in /var/log/dist-upgrade/ to the bug report.
E:Sub-process /usr/bin/dpkg returned an error code (1)

Setting up openssh-server (1:9.0p1-1ubuntu7) ...
rmdir: failed to remove '/etc/systemd/system/ssh.socket.d': Directory not empty
dpkg: error processing package openssh-server (--configure):
 installed openssh-server package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
 openssh-server

[Test Plan]

* On a Jammy machine, install openssh-server if necessary. Edit /etc/ssh/sshd_config to contain the following:

$ cat /etc/ssh/sshd_config
[... defaults everywhere else ...]

#Port 22
#AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

[... defaults everywhere else ...]

* Create a trivial drop-in override for ssh.socket:

$ systemctl edit ssh.socket
$ cat /etc/systemd/system/ssh.socket.d/override.conf
[Unit]
Description=Testing

* Now perform an upgrade to Kinetic, and observe the dpkg error.

[Where problems could occur]
The solution should be to use rmdir's --ignore-fail-on-empty flag. If the flag was mis-spelled, that would produce a new error.

[Brian Murray (brian-murray)]

Hello Nick, or anyone else affected,

Accepted openssh into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openssh/1:9.0p1-1ubuntu7.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted openssh (1:9.0p1-1ubuntu7.1) for kinetic have finished running.
The following regressions have been reported in tests triggered by the package:

dropbear/2022.82-4 (armhf)
gvfs/1.50.2-2 (amd64, arm64)
sbuild/0.83.1ubuntu1 (s390x, amd64, arm64, ppc64el)
piuparts/1.1.5 (s390x, amd64, arm64, ppc64el)
xen-tools/4.9.1-1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/kinetic/update_excuses.html#openssh

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Nick Rosbrook (enr0n)]

I have verified the fix using openssh-server from kinetic-proposed:

root@jammy:~# grep "^ListenAddress" /etc/ssh/sshd_config
ListenAddress 0.0.0.0
ListenAddress ::
root@jammy:~# systemctl edit ssh.socket
root@jammy:~# cat /etc/systemd/system/ssh.socket.d/override.conf
[Unit]
Description=SRU verification
root@jammy:~# systemctl daemon-reload
root@jammy:~# systemctl status ssh.socket
○ ssh.socket - SRU verification
     Loaded: loaded (/lib/systemd/system/ssh.socket; disabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/ssh.socket.d
             └─override.conf
     Active: inactive (dead)
     Listen: [::]:22 (Stream)
   Accepted: 0; Connected: 0;
root@jammy:~# vi /etc/apt/sources.list
root@jammy:~# cat /etc/apt/sources.list
# Generated by distrobuilder
deb http://archive.ubuntu.com/ubuntu kinetic main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu kinetic-updates main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu kinetic-security main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu kinetic-proposed main restricted universe multiverse
root@jammy:~# apt update && apt dist-upgrade
[ ... ]
root@jammy:~# apt-cache policy openssh-server
openssh-server:
  Installed: 1:9.0p1-1ubuntu7.1
  Candidate: 1:9.0p1-1ubuntu7.1
  Version table:
 *** 1:9.0p1-1ubuntu7.1 500
        500 http://security.ubuntu.com/ubuntu kinetic-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     1:9.0p1-1ubuntu7 500
        500 http://archive.ubuntu.com/ubuntu kinetic/main amd64 Packages

[Nick Rosbrook (enr0n)]

The autopkgtest failures in kinetic have all been resolved with retries and/or hinting.

[Łukasz Zemczak (sil2100)]

I guess ubuntu8 is still in lunar-proposed, but it'll go out of it eventually. Let's release this for kinetic in the meantime.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:9.0p1-1ubuntu7.1

---------------
openssh (1:9.0p1-1ubuntu7.1) kinetic; urgency=medium

  * debian/openssh-server.postinst: Fix handling of ListenAddress when a port
    is specified (LP: #1993478):
    - Strip port before converting hostnames to numerical addresses.
    - Only append ports when the ListenAddress does not already specify a
      port.
    - Revert socket migration on upgrade if a previous version did the
      migration when it should not have.
  * debian/openssh-server.postinst: Ignore empty directory failure from rmdir
    when skipping socket migration (LP: #1995294).

 -- Nick Rosbrook <email address hidden> Tue, 25 Oct 2022 11:57:43 -0400

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for openssh has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssh - 1:9.0p1-1ubuntu8

---------------
openssh (1:9.0p1-1ubuntu8) lunar; urgency=medium

  * debian/openssh-server.postinst: Fix handling of ListenAddress when a port
    is specified (LP: #1993478):
    - Strip port before converting hostnames to numerical addresses.
    - Only append ports when the ListenAddress does not already specify a
      port.
    - Revert socket migration on upgrade if a previous version did the
      migration when it should not have.
  * debian/openssh-server.postinst: Ignore empty directory failure from rmdir
    when skipping socket migration (LP: #1995294).

 -- Nick Rosbrook <email address hidden> Tue, 25 Oct 2022 11:57:43 -0400