package-reporter shouldn't crash when sources.list{,.d/*} files can't be read

[Vincent Ladeuil]

While 'partial upgrade' was 'cleaning up'.

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: landscape-client 12.04-0ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-19.30-generic 3.2.11
Uname: Linux 3.2.0-19-generic x86_64
NonfreeKernelModules: nvidia wl
ApportVersion: 1.94.1-0ubuntu2
Architecture: amd64
Date: Tue Mar 20 11:09:28 2012
ExecutablePath: /usr/bin/landscape-package-reporter
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
InterpreterPath: /usr/bin/python2.7
ProcCmdline: /usr/bin/python /usr/bin/landscape-package-reporter --quiet
ProcEnviron:
 LANG=en_US.UTF-8
 TERM=linux
 PATH=(custom, no user)
PythonArgs: ['/usr/bin/landscape-package-reporter', '--quiet']
SourcePackage: landscape-client
Title: landscape-package-reporter crashed with SystemError in open(): E:Opening /etc/apt/sources.list.d/private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list - ifstream::ifstream (13: Permission denied)
UpgradeStatus: Upgraded to precise on 2012-03-21 (0 days ago)
UserGroups:

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Vincent Ladeuil (vila)]

This now also occurring on a regular basis.

[Thomas Herve (therve)]

Can we get the output of apt-get update? And ls-al /etc/apt/sources.list.d/private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list ?

Thanks!

[Vincent Ladeuil (vila)]

  -rw-r----- 1 root admin 116 Jan 19 11:53 private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list

/me blinks

Changed to:
  -rw-r--r-- 1 root root 116 Jan 19 11:53 private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list

If this sounds like a possible cause, consider it fixed. I have no idea how the chmod bits were changed (and different from all other files there)...

[Vincent Ladeuil (vila)]

Oh, I failed to mention that the content of private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list is a single *commented out* line.

There is currently no braid version available for precise and I'm waiting for the final release to uncomment and try again.

[Andreas Hasenack (ahasenack)]

Vincent, the package-reporter process runs as the "landscape" user and it doesn't have permissions to read that file.

We will probably address this problem by making the reporter not crash, but it still won't be able to read that file, so whatever packages that repository pulls in (when the line is uncommented), landscape won't see them.

To workaround the crash, please change the file permissions or ownership so that the landscape user can read it. Since you are already using a group, maybe you can use filesystem acls, like this:

setfacl -m u:landscape:r /etc/apt/private-ppa.launchpad.net_commercial-ppa-uploaders_braid_ubuntu.list

Oh, ok, I see that you changed the permissions to 0644 already. I suppose the perms where set to 0640 before by the tool that added the file, since it looks like it contains a password.

[Vincent Ladeuil (vila)]

@Andreas: Ok, thanks for the fine details.

Yes, I changed the permission and things are ~ok now. At least I understand what is happening so I could act on it.

Should I update this bug if it re-occurs or should we just close it ?

[Andreas Hasenack (ahasenack)]

No need to update the bug, and please leave it open.

[David Ayers (ayers)]

These files contain privileged information. So instead of changing the access to 0664 I set the group to 'admin' and the mode to 0640:

 -rw-r----- 1 root admin 161 Jun 13 12:18 private-ppa.launchpad.net_commercial-ppa-uploaders_fluendo-plugins_ubuntu.list
-rw-r----- 1 root admin 163 Jun 13 12:18 private-ppa.launchpad.net_commercial-ppa-uploaders_world-of-goo_ubuntu.list

I have added the landscape user to the admin group:
 ayers@schiefer:~$ getent group admin
admin:x:119:ayers,landscape

Yet it seems that the landscape user still doesn't have read access to these files as the crash still happens with the permission denied error message. I suppose that the issue might be related to the fact that process running as system users somehow do not have access to their group privileges?

[Andreas Hasenack (ahasenack)]

Did you restart landscape-client after changing that group membership and the filesystem permissions? And what about the directory /etc/apt/sources.list.d/, is it readable/listable by the landscape user?

[David Ayers (ayers)]

Yes... actually I have this setup for weeks already so there have been several reboots since then.

I can test that the user can read the file via:
sudo -u landscape cat /etc/apt/sources.list.d/private-ppa.launchpad.net_commercial-ppa-uploaders_fluendo-plugins_ubuntu.list
which will display the contents.

Yet the package-reporter still crashes sporadically with permission denied on that file. Could it be that read permissions do not suffice?

[David Ayers (ayers)]

Strangely if I try:
sudo -u landscape /usr/bin/landscape-package-reporter && echo OK
I see no crash and OK is printed... not sure what's different in the environment in which the process is started automatically.

[David Ayers (ayers)]

I know next to nothing about C++ but I believe this is a symptom of a programming error in apt:

The code in
apt-pkg/sourcelist.cc

says:
   ifstream F(File.c_str(),ios::in /*| ios::nocreate*/);
   if (!F != 0)
      return _error->Errno("ifstream::ifstream",_("Opening %s"),File.c_str());

but the C++ documentation I found says:
If the constructor is not successful in opening the file, the object is still created although no file is associated to the stream buffer and the stream's failbit is set (which can be checked with inherited member fail).
http://www.cplusplus.com/reference/iostream/ifstream/ifstream/

So I believe that the the if case is arbitrarily failing due to type promotion rules dependent on the address that is stored in F.

That would make this a bug in the apt package which is repeated a few times in other places.

[Andreas Hasenack (ahasenack)]

Hmm, we might not be initializing the supplemental groups.

When the package-reporter was spawned by landscape, can you get a /proc/<pid>/status output, where <pid> is the pid of the package reporter? That will tell us the groups.

[David Ayers (ayers)]

That's hard to do... but I will try when it happens. But I do still have the crash report which contains:
 Uid: 120 120 120 120
which matches:
~$ getent passwd landscape
landscape:x:120:129::/var/lib/landscape:/bin/false

Of course the default Gid is landscape...

But I really really really believe this is the apt bug I described.

See:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/852003
https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/852003
https://bugs.launchpad.net/ubuntu-tweak/+bug/856140
https://bugs.launchpad.net/ubuntu-tweak/+bug/856144
https://bugs.launchpad.net/ubuntu-tweak/+bug/923967
https://bugs.launchpad.net/ubuntu/+source/synaptic/+bug/426191
https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/258909

[David Ayers (ayers)]

OK, I'm wrong about the C++ error.

I've been told:
The test is ok. !F is equivalent to F.fail() [1], which effectively
makes the test:

 if (F.fail() != false)

[1] http://www.cplusplus.com/reference/iostream/ios/operatornot/

See: https://bugs.launchpad.net/ubuntu/+source/software-center/+bug/852003/comments/8

[Andreas Hasenack (ahasenack)]

You can try restarting the client, it will run the package-reporter in a few seconds. Leave another terminal ready with "cat /proc//status" and your cursor between the "//", ready to type the pid. Then restart and ps fauxw|grep reporter, grab the pid and type. The line I want is "Groups", that will show all the groups.

[🤖 Landscape Builder (landscape-builder)]

This bug has not seen any activity in the last 6 months, so it is being automatically closed.

If you are still experiencing this issue, please feel free to re-open.

Landscape Team