/etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied

[Steve Langasek]

landscape-common in mantic has regressed the autopkgtests for update-motd. The landscape-common package is installed in the cloud images, and as a result its update-motd hook is called as part of the autopkgtest. And for whatever reason, in mantic and later, this hook now produces an error message on stdout that evidently was not there before:

[...]
416s /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
417s autopkgtest [23:07:30]: test show-motd: -----------------------]
421s autopkgtest [23:07:34]: test show-motd: - - - - - - - - - - results - - -
- - - - - - -
421s show-motd FAIL stderr: /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
421s autopkgtest [23:07:34]: test show-motd: - - - - - - - - - - stderr - - - - - - - - - -
421s /etc/update-motd.d/50-landscape-sysinfo: 24: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied

https://autopkgtest.ubuntu.com/packages/u/update-motd/mantic/amd64

The existence of the show-motd package implies that users are meant to be able to execute the update-motd hooks. So these hooks should not spew error messages when run as non-root.

[ Impact ]

 * landscape-common's sysinfo motd executable relies on a cache file in a
   location where permissions that are too strict - a user cannot execute
   the update-motd hooks without errors.

 * backporting is justified because this permissions issue exists in previous
   versions, but it only manifests if the cache is old enough. It breaks
   show-motd tests if the cache file is more than 60s old by the time its tests
   run.

 * fixing this includes not attempting to create the cache file in
   landscape-sysinfo when permission issues prevent doing so.

[ Test Plan ]

To reproduce, ensure that /var/lib/landscape-sysinfo.cache does not exist, then
run

     run-parts /etc/update-motd.d/

 as a non-root user. The output will contain the line:

       /etc/update-motd.d//50-landscape-sysinfo: 17: cannot create /var/lib/landscape-sysinfo.cache: Permission denied

When fixed, the run-parts output will not contain the Permission denied error
and the autopkgtest for show-motd should not fail on stderr output.

[ Where problems could occur ]

Changes to landscape-sysinfo could potential break motd in other ways. This
would manifest as other error messages in the motd or the motd failing to be
displayed or updated.

[ Other Info ]

 * Related upstream changes:
   * https://github.com/canonical/landscape-client/pull/201
   * https://github.com/canonical/landscape-client/pull/219

[Launchpad Janitor (janitor)]

This bug was fixed in the package landscape-client - 23.08-0ubuntu2

---------------
landscape-client (23.08-0ubuntu2) noble; urgency=medium

  * d/landscape-common.postint: ensure sysinfo cache file exists and is globally
    read-write (LP: #2040924)

 -- Mitch Burton <email address hidden> Thu, 23 Nov 2023 14:28:14 -0800

[Mitch Burton (mitchburton)]

Per discussion https://github.com/canonical/landscape-client/pull/198.

I'd like to know why this suddenly became a problem in >=mantic. What changed in show-motd? It exits in jammy as the same version (3.10) and this wasn't an issue then. Without knowing this it's hard to be sure that the fix in https://code.launchpad.net/~mitchburton/ubuntu/+source/landscape-client/+git/landscape-client/+merge/456212 is correct.

[Andreas Hasenack (ahasenack)]

Some findings:

a) the bug won't manifest itself it bin:landscape-common is not installed (obviously: just to note it's not a dependency of the test, maybe it should be)
b) bin:landscape-common's postinst runs update-motd once, which generates the /var/lib/landscape/landscape-sysinfo.cache file
c) the landscape-sysinfo motd script checks the age of the cache file. If it's less than 1min old, it WON'T regenerate it, and just display it[1]:

stamp="/var/lib/landscape/landscape-sysinfo.cache"
NEED_UPDATE="FALSE"
[ -z "$(find "$stamp" -newermt 'now-1 minutes' 2> /dev/null)" ] && NEED_UPDATE="TRUE"

Given (c), if the debian/tests/show-motd is reached quickly enough, the bug won't manifest itself. This, maybe with (a), might explain why the bug hasn't shown itself since now.

To test this, I ran the dep8 tests in a jammy container. First, without any changes, it passed. Then I added a sleep 60s, like so:

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

And now it fails:
autopkgtest [11:05:10]: test show-motd: [-----------------------
Sleeping 60s
Continuing
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 6.5.0-13-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

                         .--._ _.--.
                        ( \ / )
                         \ /\ /
                          \_ \/ _/
                           / \
                          ( /\ )
                           `--' `--'

                           FreedomBox

FreedomBox is a pure blend of Debian GNU/Linux. Web interface is available at
https://localhost/ . FreedomBox manual is available in /usr/share/doc/freedombox
and from the web interface.

  System information as of Mon Dec 4 14:04:30 UTC 2023

  System load: 1.66357421875 Temperature: 76.0 C
  Usage of /home: unknown Processes: 27
  Memory usage: 0% Users logged in: 0
  Swap usage: 0% IPv4 address for eth0: 10.0.102.17

If the empty file ~/.hushlogin exists on the server, login to the server
will be super quiet. Only the bash prompt is displayed.

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

*** System restart required ***

This message is shown once a day. To disable it please create the
/home/test/.hushlogin file.
/etc/update-motd.d/50-landscape-sysinfo: 17: cannot create /var/lib/landscape/landscape-sysinfo.cache: Permission denied
autopkgtest [11:06:11]: test show-motd: -----------------------]
autopkgtest [11:06:11]: test show-motd: - - - - - - - - - - results - - - - - - - - - -
show-motd FAIL stderr: /etc/update-motd.d/50-landscape-sysinfo: 17: ca...

[Andreas Hasenack (ahasenack)]

Related to this, look what I found while testing it...

https://bugs.launchpad.net/ubuntu/+source/landscape-client/+bug/1855544

postinst has been calling update-motd since at least 2009. I don't know if udpate-motd's behavior changed since then, but this is causing the landscape-sysinfo output to be displayed on package upgrade or reinstall. And only landscape-sysinfo, not any of the other scripts' output (from /etc/udpate-motd.d).

The update-motd(8) manpage states:
NAME
       update-motd - immediately update the dynamic MOTD and print it to stdout

This "stdout" component is not desired in the package maintainer script. We should either suppress it, or perhaps better, not use update-motd in the maintainer scripts and find some other way to update the sysinfo cache on install/upgrade.

[Mitch Burton (mitchburton)]

Directly calling landscape-sysinfo in the maintainer scripts should be enough to update the sysinfo cache. I don't think there's any need to call update-motd there. I'll produce a fix upstream, I think.

[Launchpad Janitor (janitor)]

This bug was fixed in the package landscape-client - 23.08-0ubuntu4

---------------
landscape-client (23.08-0ubuntu4) noble; urgency=medium

  * d/p/0003-fix-cpuinfo-and-tests.patch: fix ARM and RISCV cpuinfo parsing;
    fix environment var-modifying tests, increase timeout on tests that can
    be slow on these arches (LP: #2046620).

 -- Mitch Burton <email address hidden> Thu, 04 Jan 2023 17:06:26 -0800

[Dan Bungert (dbungert)]

Hi Mitch,

I went looking for this upstream on master branch and the 24.02 release PR, I think this fix isn't included there yet? If I've missed it please pass that info along, or I suggest incorporating that so that the SRU requirement for fixes being present in devel is retained.

Otherwise LGTM.

[Mitch Burton (mitchburton)]

The fix has been included in upstream. It was included in the following PRs:
https://github.com/canonical/landscape-client/pull/201
https://github.com/canonical/landscape-client/pull/219

[Mitch Burton (mitchburton)]

Updated description to include SRU bug template.

[Andreas Hasenack (ahasenack)]

About the test plan:
- it should also show the good case, i.e., what's expected to happen with the fixed package
- it should include checking the autopkgtest failure that was the trigger for this bug to be opened, i.e., make sure that that autopkgtest now does not fail

Also either [impact] or [other info] should include a *brief* description about what the fix is.

[Mitch Burton (mitchburton)]

Updated description to add the "good case" to the test plan and a mention of fixed autopkgtest. Added a brief description of the fix to [impact] section.

[Timo Aaltonen (tjaalton)]

Hello Steve, or anyone else affected,

Accepted landscape-client into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.08-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Steve, or anyone else affected,

Accepted landscape-client into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.02-0ubuntu1~22.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Steve, or anyone else affected,

Accepted landscape-client into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.02-0ubuntu1~20.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Mitch Burton (mitchburton)]

Tested in mantic using landscape-client and landscape-common versions 23.08-0ubuntu1.1, as ubuntu user in a fresh container: - lxc launch ubuntu:mantic

$ sudo rm -f /var/lib/landscape-sysinfo.cache # just to be sure
$ run-parts /etc/update-motd.d/
Welcome to Ubuntu 23.10 (GNU/Linux 6.5.0-25-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information disabled due to load higher than 1.0

0 updates can be applied immediately.

No errors in motd output, no /var/lib/landscape-sysinfo.cache created.

Tested in focal using landscape-client and landscape-common versions 23.02-0ubuntu1~20.04.2, with same results.

Tested in jammy using landscape-client and landscape-common versions 23.02-0ubuntu1~22.04.2, with same results.

[Mitch Burton (mitchburton)]

Ran show-motd autopkgtest with the following diff (as mentioned by Andreas previously to reproduce the bug)

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

On mantic, focal, and jammy with -proposed enabled. Results were identical, with tests passing:

autopkgtest [13:15:52]: @@@@@@@@@@@@@@@@@@@@ summary
show-motd PASS
update-motd PASS

[Timo Aaltonen (tjaalton)]

Hello Steve, or anyone else affected,

Accepted landscape-client into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/landscape-client/23.08-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Mitch Burton (mitchburton)]

Tested in mantic using landscape-client and landscape-common versions 23.08-0ubuntu1.2, as ubuntu user in a fresh container: - lxc launch ubuntu:mantic

ubuntu@powerful-lion:~$ sudo rm -f /var/lib/landscape-sysinfo.cache # just to be sure
ubuntu@powerful-lion:~$ run-parts /etc/update-motd.d/
Welcome to Ubuntu 23.10 (GNU/Linux 6.5.0-27-generic x86_64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/pro

 System information disabled due to load higher than 1.0

25 updates can be applied immediately.
19 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable

--------

Ran show-motd autopkgtest with the following diff (as mentioned by Andreas previously to reproduce the bug)

--- a/debian/tests/show-motd
+++ b/debian/tests/show-motd
@@ -2,6 +2,9 @@

 unset MOTD_SHOWN

+echo "Sleeping 60s"
+sleep 60
+echo "Continuing"
 RET=0
 bash -i -c '. /etc/profile.d/update-motd.sh' 2> stdout || RET=$?
 egrep -v '(bash: cannot set terminal process group|no job control in this shell)' stdout >&2 || true

On mantic with -proposed enabled and landscape-common=23.08-0ubuntu1.2. Tests passed:

autopkgtest [15:51:54]: @@@@@@@@@@@@@@@@@@@@ summary
show-motd PASS
update-motd PASS

[Launchpad Janitor (janitor)]

This bug was fixed in the package landscape-client - 23.08-0ubuntu1.2

---------------
landscape-client (23.08-0ubuntu1.2) mantic; urgency=medium

  * avoid stopping services on upgrade (LP: #2027613)
    - d/rules: use default dh_installsystemd behaviour
    - d/landscape-client.service: check registration status before starting
      service

landscape-client (23.08-0ubuntu1.1) mantic; urgency=medium

  * d/p/0001-start-service-during-config.patch: fix landscape-config does not
    start landscape-client service (LP: #2040189)
  * d/landscape-sysinfo.wrapper: fix handler using cache when permissions
    allow (LP: #2040924)

 -- Mitch Burton <email address hidden> Mon, 22 Apr 2024 10:20:29 -0700

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for landscape-client has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package landscape-client - 23.02-0ubuntu1~22.04.2

---------------
landscape-client (23.02-0ubuntu1~22.04.2) jammy; urgency=medium

  * d/p/0001-start-service-during-config.patch: fix landscape-config does not
    start landscape-client service (LP: #2040189)
  * d/landscape-sysinfo.wrapper: fix handle using cache when permissions allow
    (LP: #2040924)

landscape-client (23.02-0ubuntu1~22.04.1) jammy; urgency=medium

  * Backporting release 23.02 for SRU (LP: #2006402):
    - Service is no longer stopped on upgrade (LP: #2027613)

 -- Mitch Burton <email address hidden> Wed, 14 Feb 2024 15:34:10 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package landscape-client - 23.02-0ubuntu1~20.04.2

---------------
landscape-client (23.02-0ubuntu1~20.04.2) focal; urgency=medium

  * d/p/0001-start-service-during-config.patch: fix landscape-config does not
    start landscape-client service (LP: #2040189)
  * d/landscape-sysinfo.wrapper: fix handle using cache when permissions allow
    (LP: #2040924)

landscape-client (23.02-0ubuntu1~20.04.1) focal; urgency=medium

  * Backporting release 23.02 for SRU (LP: #2006402):
    - Service is no longer stopped on upgrade (LP: #2027613)

 -- Mitch Burton <email address hidden> Wed, 14 Feb 2024 15:34:10 -0800