do-release-upgrade stuck when dealing with apparmor profile for cupsd

[Thomas Mayer]

On an up-to-date 14.04.x, I started do-release-upgrade -d to upgrade to ubuntu 16.04.

At about 50% of the installation of packages, do-release-upgrade stucks in the following manner:

- cpu runs at 0%~ and there is no disk I/O for about 15 minutes now
- do-release-upgrade does not terminate, and there is no visible progress at all.
---
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: thomas 3220 F.... pulseaudio
CurrentDesktop: Unity
DistroRelease: Ubuntu 16.04
HibernationDevice: RESUME=UUID=28eded29-f9e6-44b5-9e54-c4dd60c8e3cd
InstallationDate: Installed on 2014-11-29 (564 days ago)
InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2)
Lsusb:
 Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
 Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 001 Device 003: ID 0c45:6419 Microdia Integrated Webcam
 Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
MachineType: Dell Inc. Latitude E5510
Package: linux (not installed)
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/@/boot/vmlinuz-4.2.0-38-generic root=UUID=6408c2d9-1b60-43d7-9a7f-2dceeb40de28 ro rootflags=subvol=@ quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 4.2.0-38.45~14.04.1-generic 4.2.8-ckt10
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: Daemon not responding.
RelatedPackageVersions:
 linux-restricted-modules-4.2.0-38-generic N/A
 linux-backports-modules-4.2.0-38-generic N/A
 linux-firmware 1.157
Tags: xenial
Uname: Linux 4.2.0-38-generic x86_64
UpgradeStatus: Upgraded to xenial on 2016-06-15 (0 days ago)
UserGroups: adm cdrom dip libvirtd lpadmin plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 12/06/2013
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A16
dmi.board.name: 023HKR
dmi.board.vendor: Dell Inc.
dmi.board.version: A00
dmi.chassis.type: 9
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA16:bd12/06/2013:svnDellInc.:pnLatitudeE5510:pvr0001:rvnDellInc.:rn023HKR:rvrA00:cvnDellInc.:ct9:cvr:
dmi.product.name: Latitude E5510
dmi.product.version: 0001
dmi.sys.vendor: Dell Inc.

[Thomas Mayer (thomas303)]

do-release-upgrade stucks at this place:

plymouth (0.9.2-3ubuntu13.1) wird eingerichtet ...
update-initramfs: deferring update (trigger activated)
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
cryptsetup (2:1.6.6-5ubuntu2) wird eingerichtet ...
Neue Version der Konfigurationsdatei /etc/init.d/cryptdisks wird installiert ...
update-initramfs: deferring update (trigger activated)
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults
libavahi-common-data:amd64 (0.6.32~rc+dfsg-1ubuntu2) wird eingerichtet ...
libavahi-common3:amd64 (0.6.32~rc+dfsg-1ubuntu2) wird eingerichtet ...
libavahi-client3:amd64 (0.6.32~rc+dfsg-1ubuntu2) wird eingerichtet ...
libcupsmime1:amd64 (2.1.3-4) wird eingerichtet ...
libpaper1:amd64 (1.1.24+nmu4ubuntu1) wird eingerichtet ...
openssl (1.0.2g-1ubuntu4.1) wird eingerichtet ...
ssl-cert (1.0.37) wird eingerichtet ...
bc (1.06.95-9build1) wird eingerichtet ...
cups-daemon (2.1.3-4) wird eingerichtet ...
Neue Version der Konfigurationsdatei /etc/apparmor.d/usr.sbin.cupsd wird installiert ...
Neue Version der Konfigurationsdatei /etc/cups/cups-files.conf wird installiert ...
Neue Version der Konfigurationsdatei /etc/init.d/cups wird installiert ...
Neue Version der Konfigurationsdatei /etc/logrotate.d/cups-daemon wird installiert ...
<--- here it hangs. But it does not terminate.

[Thomas Mayer (thomas303)]

output of ps aux | grep dpkg is attached.

Note that there is a process with no progress (stucks)

root 20108 0.0 0.0 4508 1624 pts/18 S+ 18:42 0:00 /bin/sh /var/lib/dpkg/info/cups-daemon.postinst configure 1.7.2-0ubuntu1.7

[Thomas Mayer (thomas303)]

In syslog, I get a lot of complaints from apparmor:

Jun 15 19:06:02 lat61 kernel: [10041.854940] audit: type=1400 audit(1466010362.719:539): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/cups/backend/cups-pdf" pid=24942 comm="apparmor_parser"
Jun 15 19:06:02 lat61 kernel: [10041.854955] audit: type=1400 audit(1466010362.719:540): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/cupsd" pid=24942 comm="apparmor_parser"
Jun 15 19:06:02 lat61 kernel: [10041.879027] audit: type=1400 audit(1466010362.743:541): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="third_party" pid=24942 comm="apparmor_parser"
Jun 15 19:06:02 lat61 kernel: [10041.892595] audit: type=1400 audit(1466010362.755:542): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.892606] audit: type=1400 audit(1466010362.755:543): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.893140] audit: type=1400 audit(1466010362.755:544): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.893148] audit: type=1400 audit(1466010362.755:545): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.956457] audit: type=1400 audit(1466010362.819:546): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.956483] audit: type=1400 audit(1466010362.819:547): apparmor="DENIED" operation="create" profile="/usr/sbin/cupsd" pid=24943 comm="cupsd" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none
Jun 15 19:06:02 lat61 kernel: [10041.957706] init: cups main process (24943) killed by TERM signal
Jun 15 19:06:02 lat61 kernel: [10041.957722] init: cups main process ended, respawning

[Thomas Mayer (thomas303)]

related: #1370930

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1592917

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Thomas Mayer (thomas303)]

Still in the middle of the (stucked) upgrade, I get:

apport-collect 1592917
/usr/share/apport/apport-gtk:16: PyGIWarning: Wnck was imported without specifying a version first. Use gi.require_version('Wnck', '3.0') before import to ensure that the right version gets loaded.
  from gi.repository import GLib, Wnck, GdkX11, Gdk
ERROR: The python-launchpadlib package is not installed. This functionality is not available.

[Thomas Mayer (thomas303)]

After trying to stop or teardown apparmor, I still get

aa-status
apparmor module is loaded.
3 profiles are loaded.
3 profiles are in enforce mode.
   /usr/lib/cups/backend/cups-pdf
   /usr/sbin/cupsd
   /usr/sbin/cupsd//third_party
0 profiles are in complain mode.
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

apport information

[Thomas Mayer (thomas303)]

Workaround:

Step 1:
=======

I killed the process with which I was stuck with (kill 20108):

root 20108 0.0 0.0 4508 1624 pts/18 S+ 18:42 0:00 /bin/sh /var/lib/dpkg/info/cups-daemon.postinst configure 1.7.2-0ubuntu1.7

This had the result that the do-release-upgrade script continued to configure all the packages.

At this point, dpkg --configure -a fails because mysql-server cannot be configured (no socket connection)

Step 2: remove autoremovable packages
=====================

apt-get autoremove => mysql-server can be configured after autoremove

  aptitude-common dh-apparmor g++-4.8 gcc-4.9-base:i386 gir1.2-gconf-2.0 java-common kubuntu-debug-installer latex-beamer latex-xcolor libamd2.3.1 libatk-wrapper-java
  libatk-wrapper-java-jni libavcodec54 libavformat54 libavresample1 libavutil52 libbaloocore4 libbaloofiles4 libbalooxapian4 libbit-vector-perl libboost-iostreams1.54.0
  libboost-thread1.54.0 libcamd2.3.1 libcarp-clan-perl libccolamd2.8.0 libcgmanager0:i386 libcholmod2.1.2 libclamav6 libdate-calc-perl libdate-calc-xs-perl libdbd-mysql-perl
  libdbi-perl libdbus-1-3:i386 libdrm2:i386 libegl1-mesa-drivers libept1.4.12 libepub0 libgbm1-lts-wily libgconf2-4 libgegl-0.2-0 libgif4 libgl1-mesa-dri-lts-wily
  libglapi-mesa-lts-wily libgles1-mesa-lts-wily libgles2-mesa-lts-wily libgraphicsmagick3 libicc2 libidl-2-0 libidl-common libilmbase6 libimdi0 libjavascriptcoregtk-1.0-0
  libjson-c2:i386 libkactivities-models1 libkidletime4 libkscreen1 liblinear1 libmagick++5 libmagickcore5 libmagickcore5-extra libmagickwand5 libmrm4 libmusicbrainz5-0
  libnepomukcleaner4 libnepomukcore4abi1 libnih-dbus1:i386 libnih1:i386 libokularcore4 libopenexr6 libopenjpeg2 liborbit2 libpng12-0:i386 libpostproc52 libpth20 libqapt3
  libqapt3-runtime libqjson0 libsctp1 libsoprano4 libstdc++-4.8-dev libswscale2 libterm-readkey-perl libts-0.0-0 libuil4 libumfpack5.6.2 libvirtodbc0 libvte-common libvte9
  libwebkitgtk-1.0-0 libwebkitgtk-1.0-common libwireshark3 libwiretap3 libwsutil3 libwxbase2.8-0 libwxgtk2.8-0 libx264-142 libxatracker2-lts-wily libxen-4.4 libzip2 libzip4
  linux-headers-generic-lts-wily linux-image-generic-lts-wily lksctp-tools nepomuk-core-data odbcinst odbcinst1debian2 perlmagick pgf phonon-backend-gstreamer1.0
  php-symfony2-yaml php5-xdebug python-urlgrabber python-vte qapt-batch shared-desktop-ontologies soprano-daemon syslinux-themes-debian syslinux-themes-debian-wheezy
  texlive-luatex tsconf ttf-dejavu-core virtuoso-minimal virtuoso-opensource-6.1-bin virtuoso-opensource-6.1-common xserver-xorg-core-lts-wily xserver-xorg-input-all-lts-wily
  xserver-xorg-input-evdev-lts-wily xserver-xorg-input-mouse-lts-wily xserver-xorg-input-synaptics-lts-wily xserver-xorg-input-vmmouse-lts-wily
  xserver-xorg-input-wacom-lts-wily xserver-xorg-video-all-lts-wily xserver-xorg-video-ati-lts-wily xserver-xorg-video-cirrus-lts-wily xserver-xorg-video-fbdev-lts-wily
  xserver-xorg-video-intel-lts-wily xserver-xorg-video-mach64-lts-wily xserver-xorg-video-mga-lts-wily xserver-xorg-video-neomagic-lts-wily
  xserver-xorg-video-nouveau-lts-wily xserver-xorg-video-openchrome-lts-wily xserver-xorg-video-qxl-lts-wily xserver-xorg-video-r128-lts-wily
  xserver-xorg-vi...

[Thomas Mayer (thomas303)]

related: #1592948 originates from ubuntu's apport and was automatically created after the first reboot (while cups was still unconfigured at that time).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[sami (miaousami)]

+1

[Nikhil Choudhary (nikhilc)]

Same issue and same apparmor messages in syslog when upgrading from 14.04.4 to 16.04.1. Thomas' workaround of killing "/var/lib/dpkg/info/cups-daemon.postinst configure 1.7.2-0ubuntu1.7" allowed the upgrade to continue, but it'd be nice not to see this kind of issue on an LTS > LTS upgrade.