option to deactivate automatic updates leads people to believe that security updates will be disabled too

[Chris B]

Confirmed in 16.04 LTS and Yakkety Daily.

How to reproduce:
User Ubuntu Server ISO and at the very last question of the installer, answer "no automatic updates."

Then, after the reboot, check /etc/apt/apt.conf.d/50unattended-upgrades and you will find:

// Automatically upgrade packages from these (origin:archive) pairs
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}-security";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-proposed";
// "${distro_id}:${distro_codename}-backports";
};

Since by default the first one is enabled, it will install automatic updates despite having selected "no" during installer.

ProblemType: Bug
DistroRelease: Ubuntu 16.10
Package: debian-installer (not installed)
ProcVersionSignature: Ubuntu 4.4.0-23.41-generic 4.4.10
Uname: Linux 4.4.0-23-generic x86_64
ApportVersion: 2.20.1-0ubuntu4
Architecture: amd64
Date: Fri Jun 10 19:14:21 2016
InstallationDate: Installed on 2016-06-11 (0 days ago)
InstallationMedia: Ubuntu-Server 16.10 "Yakkety Yak" - Alpha amd64 (20160610)
Lsusb:
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
 Bus 002 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: VMware, Inc. VMware Virtual Platform
MemoryUsage:
 total used free shared buff/cache available
 Mem: 4028940 156064 3690500 5928 182376 3693048
 Swap: 4192252 0 4192252
ProcEnviron:
 TERM=linux
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-23-generic root=UUID=eb6a3dc1-0e2a-4ad0-bb88-a5be4bdb7013 ro
SourcePackage: debian-installer
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 07/02/2015
dmi.bios.vendor: Phoenix Technologies LTD
dmi.bios.version: 6.00
dmi.board.name: 440BX Desktop Reference Platform
dmi.board.vendor: Intel Corporation
dmi.board.version: None
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 1
dmi.chassis.vendor: No Enclosure
dmi.chassis.version: N/A
dmi.modalias: dmi:bvnPhoenixTechnologiesLTD:bvr6.00:bd07/02/2015:svnVMware,Inc.:pnVMwareVirtualPlatform:pvrNone:rvnIntelCorporation:rn440BXDesktopReferencePlatform:rvrNone:cvnNoEnclosure:ct1:cvrN/A:
dmi.product.name: VMware Virtual Platform
dmi.product.version: None
dmi.sys.vendor: VMware, Inc.

[Chris B (b-christopher-92)]

Related to https://bugs.launchpad.net/ubuntu/+source/debian-installer/+bug/1591400

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mathieu Trudel-Lapierre (cyphermox)]

That file is the default anyway, from unattended-upgrades. It took me a bit of time to find again where this is being done in the installer (it's in pkgsel), but I remembered fixing it a few months ago.

From the look of things, if all is well, in yakkety the unattended upgrades should be disabled anyway: you should see that in "/etc/apt/apt.conf.d/20auto-upgrades", it reads:
APT::Periodic::Update-Package-Lists "0";
APT::Periodic::Unattended-Upgrade "0";

Despite whatever the configuration might be in /etc/apt/apt.conf.d/50unattended-upgrades. As such, automatic upgrades should not be happening.

The change isn't yet in xenial, so I'm updating this bug to reflect the state of things at the moment and the fact that yakkety should be checked again carefully to make sure the config is as intended.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brian Murray (brian-murray)]

-security is still in Allowed-Origins when installing the daily server CD image for Ubuntu 18.04.

[Brian Murray (brian-murray)]

It's been suggested that it'd be better if the option was better described because we don't actually want the user to have an option that disables automatic security updates. The default should be for users to have a secure system.

[Balint Reczey (rbalint)]

Since the fix for LP: #1577215 u-u does not change to origin list based on debconf answers, but it still changes if u-u is enabled by setting APT::Periodic::Unattended-Upgrade to 0 or 1 in apt.conf.d/ .

The debconf template name is: unattended-upgrades/enable_auto_updates .
Probably the installer does not set it properly.

[Chris B (b-christopher-92)]

@Brian

Yes, I think your suggestion is better than to disable updates. If a user still wants to disable them they can do so manually, but it is important that the setup does not imply this.

[Mathieu Trudel-Lapierre (cyphermox)]

This has been fixed for a while; APT::Periodic::Unattended-Upgrade is set to 0 if you pick No automatic updates; this is how we want things to be. In the installer, the other option is to "install security updates automatically".