Downloading a package with root warns

[Removed by request]

I'm using Ubuntu 16.04 dev with apt 1.2.3 and on downloading a package with root I'm getting an error message like this example shows:

root@ubuntu:~/tmp# apt-get download nvidia-settings
Get:1 http://archive.ubuntu.com/ubuntu xenial/main amd64 nvidia-settings amd64 361.28-0ubuntu1 [856 kB]
Fetched 856 kB in 0s (1026 kB/s)
W: Can't drop privileges for downloading as file '/root/tmp/nvidia-settings_361.28-0ubuntu1_amd64.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)

The file gets created for root:root with the permissions 0644 and if I'm trying to download the file with my normal user it works successfully while also getting the same permissions.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Removed by request (removed3425744)]

Also in the last time I'm seeing often on an "apt-get dist-upgrade" this:

W: Can't drop privileges for downloading as file '/var/cache/apt/archives/partial/libpython3.5_3.5.1-6ubuntu2_amd64.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)

The permissions of the directory are this:

root@ubuntu:~# stat /var/cache/apt/archives/partial | grep 'Access: ('
Access: (0700/drwx------) Uid: ( 113/ _apt) Gid: ( 0/ root)

[Julian Andres Klode (juliank)]

That does not make any sense. _apt has write access to

/var/cache/apt/archives/partial/libpython3.5_3.5.1-6ubuntu2_amd64.deb

The other thing is not a bug though.

And the importance should again not be high, but wishlist, if the bug should be kept open at all. I don't know what es20490446e is doing to himself, but he clearly shows a significant lack of understanding bug priorities.

[Julian Andres Klode (juliank)]

That is, based on the information that have been available when the Priority was set, it should have not been high. It should never be high anyway, this is just a Warning (it's a W, a W, a W) after all. With the further information about the /var thing, it should maybe be medium.

But I don't see why this happens. What's the permission for the deb in question?

Side note: If you download stuff as a user, APT cannot drop permissions at all (because that requires root), so it won't show a warning and just run as a user. If you run it as root, it tries to play extra safe, but falls back to the APT 1.0 state of running the fetching code as root if that fails.

[Fabio C. Barrionuevo (luzfcb)]

same cause of this bugs:

https://bugs.launchpad.net/ubuntu/+source/update-notifier/+bug/1570141
https://bugs.launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/+bug/1551511

I install a new ppa and run apt-get update and get this error:

W: Can't drop privileges for downloading as file '/var/lib/apt/lists/partial/archive.ubuntu.com_ubuntu_dists_xenial_InRelease' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permissão negada)

I am using Ubuntu 16.0 Beta Final, with all the updated packages

The permissions:

fabio@luzfcb:~$ ls -dl /var/cache/apt/archives/partial/
drwx------ 2 _apt root 4096 Abr 11 21:13 /var/cache/apt/archives/partial/

fabio@luzfcb:~$ ls -dl /var/cache/apt/archives/
drwxr-xr-x 4 root root 28672 Abr 13 19:57 /var/cache/apt/archives/

fabio@luzfcb:~$ grep -B2 _apt /var/lib/dpkg/info/apt.postinst
 # add unprivileged user for the apt methods
 adduser --force-badname --system --home /nonexistent \
     --no-create-home --quiet _apt || true

 # Fixup any mistake in the home directory of the _apt user
 if dpkg --compare-versions "$2" lt-nl 1.1~exp10~; then
     usermod --home /nonexistent _apt

fabio@luzfcb:~$ sudo apt-get update
Atingido:1 http://repo.steampowered.com/steam precise InRelease
Obter:2 http://archive.ubuntu.com/ubuntu xenial InRelease [247 kB]
Ign:3 http://dl.google.com/linux/chrome/deb stable InRelease
Atingido:5 http://archive.canonical.com/ubuntu xenial InRelease
Atingido:6 http://apt.postgresql.org/pub/repos/apt xenial-pgdg InRelease
Atingido:7 http://dl.google.com/linux/chrome/deb stable Release
Atingido:9 http://ppa.launchpad.net/gregory-hainaut/pcsx2.official.ppa/ubuntu xenial InRelease
Atingido:10 http://ppa.launchpad.net/gwendal-lebihan-dev/hexchat-stable/ubuntu xenial InRelease
Atingido:11 http://ppa.launchpad.net/indicator-brightness/ppa/ubuntu xenial InRelease
Ign:4 http://toolbelt.heroku.com/ubuntu ./ InRelease
Atingido:12 http://ppa.launchpad.net/maarten-baert/simplescreenrecorder/ubuntu xenial InRelease
Atingido:14 http://ppa.launchpad.net/saiarcot895/myppa/ubuntu xenial InRelease
Obter:15 http://ppa.launchpad.net/webupd8team/java/ubuntu xenial InRelease [17,5 kB]
Atingido:13 http://toolbelt.heroku.com/ubuntu ./ Release
Obter:17 http://ppa.launchpad.net/webupd8team/java/ubuntu xenial/main amd64 Packages [2.840 B]
Atingido:18 http://archive.ubuntu.com/ubuntu xenial-updates InRelease
Obter:19 http://ppa.launchpad.net/webupd8team/java/ubuntu xenial/main i386 Packages [2.840 B]
Obter:20 http://ppa.launchpad.net/webupd8team/java/ubuntu xenial/main Translation-en [1.260 B]
Atingido:21 http://archive.ubuntu.com/ubuntu xenial-backports InRelease
Atingido:22 http://archive.ubuntu.com/ubuntu xenial-security InRelease
Obter:23 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages [1.184 kB]
Obter:24 http://archive.ubuntu.com/ubuntu xenial/main i386 Packages [1.179 kB]
Obter:25 http://archive.ubuntu.com/ubuntu xenial/main amd64 DEP-11 Metadata [635 kB]
Obter:26 http://archive.ubuntu.com/ubuntu xenial/main DEP-11 64x64 ...

[Julian Andres Klode (juliank)]

Thanks for your input. Unfortunately, you have a failure for /var/lib/apt/lists, so we'd need to see the permissions for that and not for /var/cache/apt/archives.