Please do not run udevadm trigger without parameters

[Benjamin Drung]

[Impact]
open-vm-tools 2:11.3.5-1ubuntu4 (on Ubuntu 22.04) calls "udevadm trigger" in it's postinst script (line 8). Since no options or devpaths/files/units are specified, udevadm will trigger events for **all** devices. This will trigger a lot of udev rules and can cause unwanted side effects (like bug #1875062 (see from comment #62)).

[Test Case]
 You can see the list of triggered devices by running "udevadm trigger --verbose --dry-run". Without the fix, this displays a large number of irrelevant devices; with the fix a narrower set is shown.

[Regression Potential]
This trigger is performed during the configure step in postinst, so new misbehaviors seen during installation or upgrade might be worth analyzing as regressions. Device-specific variances in behavior after installation may also be worth examination.

This change has been accepted to Debian, and has been tested during kinetic's development period for some weeks without reports of problems. We also plan to keep the jammy MRE with this fix in -proposed for some extra time just to be extra safe.

[Original Report]

Please run "udevadm trigger" only for the relevant subsystems/attributes. Example:
```
udevadm trigger --type=devices --subsystem-match=scsi
```

This was fixed in Debian's 2:12.0.0-1 release by the following delta:

diff --git a/debian/open-vm-tools.postinst b/debian/open-vm-tools.postinst
index f181ab21..aa224fb3 100644
--- a/debian/open-vm-tools.postinst
+++ b/debian/open-vm-tools.postinst
@@ -5,7 +5,7 @@ set -e
 case "${1}" in
     configure)
         if which udevadm 1>/dev/null; then
- udevadm trigger || true
+ udevadm trigger --type=devices --subsystem-match=scsi || true
         fi
         ;;

[Christian Ehrhardt  (paelzer)]

Hi Benjamin, thanks for the bug.
This sounds like an issue not yet wreaking havoc but could be, so it is nice to fix it before things get worse.

Limiting to "scsi + vsock" is what is needed I guess.

The rules we have are:

root@j:~# head /lib/udev/rules.d/60-open-vm-tools.rules /lib/udev/rules.d/99-vmware-scsi-udev.rules
==> /lib/udev/rules.d/60-open-vm-tools.rules <==
# VMWare Virtual Sockets permissions
# after loading the vsock module, a block device /dev/vsock will be created with permission 0600
# This rule changes permission to 0666 to allow users access to the virtual sockets
KERNEL=="vsock", MODE="0666"

==> /lib/udev/rules.d/99-vmware-scsi-udev.rules <==
ACTION=="add", SUBSYSTEMS=="scsi", ENV{DEVTYPE}=="scsi_device", ATTRS{vendor}=="VMware*" , ATTRS{model}=="Virtual disk*", ATTRS{timeout}=="?*", ATTR{timeout}="180"
ACTION=="add", SUBSYSTEMS=="scsi", ENV{DEVTYPE}=="scsi_device", ATTRS{vendor}=="VMware*" , ATTRS{model}=="VMware Virtual S", ATTRS{timeout}=="?*", ATTR{timeout}="180"

@Bryce,
could you have a look at this please?
This should be much smaller to have a look than starting with v12.0.0 right away :-)

[Bryce Harrington (bryce)]

The fix is included in Debian's 12.0.0-1 release, which will be resolved with LP: #1971253.

The 'udevadm trigger' command appears in the open-vm-tools versions for bionic, focal, impish, and jammy, so presumably SRUs are needed for those.

[Bryce Harrington (bryce)]

open-vm-tools is regularly backported to the stable releases as part of the MRE process, so that may be a preferred solution than SRUs.

[Bryce Harrington (bryce)]

This is released to kinetic now via the new release:

 open-vm-tools | 2:12.0.5-1 | kinetic

As mentioned, the fix will be provided on other releases by backporting 2:12.0.5-1 to them via MRE, rather than backporting the individual fix via SRU.

[Brian Murray (brian-murray)]

Ubuntu 21.10 (Impish Indri) has reached end of life, so this bug will not be fixed for that specific release.

[Bryce Harrington (bryce)]

In checking with Christian, it sounds like we'll MRE just to jammy, and seek SRU fixes for bionic and kinetic.

[Christian Ehrhardt  (paelzer)]

FYI - I was tracking down a libvirt bug for a while.
I've found that it was also caused by the too open udevadm trigger of open-vm-tools :-)
I mean the bug is in libvirt for sure, but causing it on a system in the wild was the the postinst of open-vm-tools.

[Timo Aaltonen (tjaalton)]

Hello Benjamin, or anyone else affected,

Accepted open-vm-tools into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/open-vm-tools/2:11.0.5-4ubuntu0.18.04.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Benjamin, or anyone else affected,

Accepted open-vm-tools into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/open-vm-tools/2:11.3.0-2ubuntu0~ubuntu20.04.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Benjamin, or anyone else affected,

Accepted open-vm-tools into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/open-vm-tools/2:12.1.0-1~ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Bryce Harrington (bryce)]

I've validated the SRU for jammy, focal, and bionic, using the following test process:

Create a LXD VM, log into it from two consoles. From the first, monitor
udevadm events, and in the second perform the package installation.

$ lxc init ubuntu-daily:jammy open-vm-tools-sru-lp1968354-vm-jammy --vm
$ lxc start open-vm-tools-sru-lp1968354-vm-jammy

1st console:
$ lxc exec open-vm-tools-sru-lp1968354-vm-jammy -- bash
# udevadm monitor --environment | awk '{print NR ": " $s}'

2nd console:
$ lxc exec open-vm-tools-sru-lp1968354-vm-jammy -- bash
# apt-get update
# apt-get install -y open-vm-tools

On my system, the monitor shows 5629 lines of output printed when the
last command runs.

Next, in the second console enable -proposed and re-install
open-vm-tools:

# apt-get remove -y open-vm-tools
# sh -c "echo 'deb http://archive.ubuntu.com/ubuntu/ jammy-proposed restricted main multiverse universe' >> /etc/apt/sources.list.d/proposed-repositories.list"
# apt-get update
# apt-get -t jammy-proposed install open-vm-tools

This time only a couple hundred additional lines are printed in the udev
monitoring window.

I repeated the above steps also on a focal vm, with similar results.

I did as well on bionic, however I couldn't use the exec bash trick to
login and did this instead:

$ lxc exec open-vm-tools-sru-lp1968354-vm-bionic -- sudo --login --user root

Also, on bionic the initial line count was over 8000 with the current
version of open-vm-tools, and under 150 for the fixed version.

[Launchpad Janitor (janitor)]

This bug was fixed in the package open-vm-tools - 2:12.1.0-1~ubuntu0.22.04.1

---------------
open-vm-tools (2:12.1.0-1~ubuntu0.22.04.1) jammy; urgency=medium

  * Backport recent open-vm-tools (LP: #1975767)
    - Fixes issue with "udevadm trigger" affecting all devices
      that can cause unwanted side-effects.
      (LP: #1968354)
    - Adds new binary open-vm-tools-containerinfo that installs the
      vRealize Container Info plugin, which captures and publishes
      information about running containers inside the guest.
    - Adds new binary open-vm-tools-salt-minion that installs the Salt
      Minion plugin for event driven IT automation, remote task execution,
      and configuration management.

 -- Bryce Harrington <email address hidden> Mon, 19 Sep 2022 17:52:55 +0000

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for open-vm-tools has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package open-vm-tools - 2:11.0.5-4ubuntu0.18.04.3

---------------
open-vm-tools (2:11.0.5-4ubuntu0.18.04.3) bionic; urgency=medium

  * d/open-vm-tools.postinst: Fixes issue with "udevadm trigger"
    affecting all devices that can cause unwanted side-effects.
    (LP: #1968354)

 -- Bryce Harrington <email address hidden> Mon, 19 Sep 2022 22:14:07 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package open-vm-tools - 2:11.3.0-2ubuntu0~ubuntu20.04.4

---------------
open-vm-tools (2:11.3.0-2ubuntu0~ubuntu20.04.4) focal; urgency=medium

  * d/open-vm-tools.postinst: Fixes issue with "udevadm trigger"
    affecting all devices that can cause unwanted side-effects.
    (LP: #1968354)

 -- Bryce Harrington <email address hidden> Mon, 19 Sep 2022 22:14:14 +0000