needrestart causes kernel upgrade messages in motd

[Robie Basak]

[Impact]
needrestart shouldn't be writing to /run/reboot-required for kernel updates, that should be reserved to update-manager

[Test plan]

We can use the mockuname thing from the autopkgtests to simulate a kernel
version mismatch:

# in a fresh VM
pull-lp-source needrestart noble
cd needrestart-3.6
gcc -shared -fPIC -ldl debian/tests/mockuname.c -o mockuname.so
LD_PRELOAD=$PWD/mockuname.so apt install hello
# needrestart should complain that the system should be restarted
test ! -x /run/reboot-required || echo test failed

[Where problems could occur]

That particular patch seems on the safer side, nothing in the code relies on this file being written to.

[Original report]

On Noble, I see this in my motd:

*** System restart required ***
Pending kernel upgrade!
Running kernel version:
  6.8.0-22-generic
Diagnostics:
  The currently running kernel version is not the expected kernel version 6.8.0-31-generic.

I found this code in needrestart:

/usr/sbin/needrestart: 'The currently running kernel version is {kversion} which is not the expected kernel version {eversion}.',

I'm told that it is incorrect for needrestart to be injecting this into motd. Steve points out that needrestart isn't installed on desktop and the behaviour shouldn't be different here, thinks that this shouldn't be injected into motd, and asked for a bug report for this.

needrestart 3.6-7ubuntu4

[Robie Basak (racb)]

Steve asked for this to be Critical and assigned to Simon.

[Steve Langasek (vorlon)]

Simon, I don't know if this is a regression in noble, but for sure it shouldn't be needrestart telling us about kernel updates - we already have update-notifier for this which, crucially, is livepatch aware.

[Simon Chopin (schopin)]

This is a new feature that I implemented based on what I had understood were the requirements: integrating needrestart with /run/reboot-required. Apparently, MOTD picks up whatever we write in that file.

Shall I walk that part back and not write to that file in the case of kernel updates? I suppose needrestart could also go through update-notifier and mimick the kernel postinst code somehow?

[Launchpad Janitor (janitor)]

This bug was fixed in the package needrestart - 3.6-8ubuntu3

---------------
needrestart (3.6-8ubuntu3) oracular; urgency=medium

  * d/p/ubuntu-mode.patch: Don't touch /run/reboot-required on kernel updates
    (LP: #2065863)
  * Ubuntu mode: disable it if restart mode has been explicitly set
    (LP: #2068543)
  * Add some inline documentation for the Ubuntu mode (LP: #2068573)
  * Don't restart the google-guest-agent service (LP: #2063442)
  * Don't restart the GH runner provisioner (LP: #2067800)
  * tests: guard against looping when failing.

 -- Simon Chopin <email address hidden> Fri, 14 Jun 2024 11:57:11 +0200

[Łukasz Zemczak (sil2100)]

Hello Robie, or anyone else affected,

Accepted needrestart into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/needrestart/3.6-7ubuntu4.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Simon Chopin (schopin)]

Verified in a fresh VM:

root@needrestart-motd:~/needrestart-3.6# dpkg -l needrestart | tail -n 1
ii needrestart 3.6-7ubuntu4.1 all check which daemons need to be restarted after library upgrades
root@needrestart-motd:~/needrestart-3.6# systemd-detect-virt
kvm
root@needrestart-motd:~/needrestart-3.6# ls /run/reboot-required
ls: cannot access '/run/reboot-required': No such file or directory
root@needrestart-motd:~/needrestart-3.6# gcc -shared -fPIC -ldl debian/tests/mockuname.c -o mockuname.so
root@needrestart-motd:~/needrestart-3.6# LD_PRELOAD=$PWD/mockuname.so apt install hello
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  hello
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 26.0 kB of archives.
After this operation, 106 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 hello amd64 2.10-3build1 [26.0 kB]
Fetched 26.0 kB in 0s (309 kB/s)
Selecting previously unselected package hello.
(Reading database ... 105648 files and directories currently installed.)
Preparing to unpack .../hello_2.10-3build1_amd64.deb ...
Unpacking hello (2.10-3build1) ...
Setting up hello (2.10-3build1) ...
Processing triggers for man-db (2.12.0-4build2) ...
ERROR: ld.so: object '/root/needrestart-3.6/mockuname.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
Processing triggers for install-info (7.1-3build2) ...
Scanning processes...
Scanning linux images...

Pending kernel upgrade!
Running kernel version:
  6.8.0-37-generic
Diagnostics:
  The currently running kernel version is not the expected kernel version 6.8.0-38-generic.

Restarting the system to load the new kernel will not be handled automatically, so you should consider rebooting.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.
root@needrestart-motd:~/needrestart-3.6# test ! -x /run/reboot-required || echo test failed
root@needrestart-motd:~/needrestart-3.6#

[Andreas Hasenack (ahasenack)]

Is the test valid, given mokuname wasn't loaded? Or am I misinterpreting the output?

> ERROR: ld.so: object '/root/needrestart-3.6/mockuname.so' from LD_PRELOAD cannot be preloaded (cannot
> open shared object file): ignored.

[Simon Chopin (schopin)]

You are misinterpreting the output. The process that fails to load the .so is during the man-db stage, the needrestart process happens a bit later (after the install-info triggers have been run). Without mockuname needrestart wouldn't have detected a kernel upgrade in the first place.

It's something that I've always seen when using LD_PRELOAD on apt processes, I've never taken the time to investigate what exactly is going on, but I do know it's benign.