update-smart-drivedb overwrites package installed file

[Paride Legovini]

[SRU]
[Impact]

The "drivedb.h" file is the smartmontools drive database file used to perform the scan actions. This file can be updated through update-smart-drivedb command, but debsums may complain about drive.h in the form of a false negative verification of the smartmontool package being raised.

The fix applied here is picked up from upstream and it is present since version 7.2-1, therefore Ubuntu series starting at Impish and later are not affected. What this fix does is that it corrects the current shipping system of "drivedb.h" - the one in /usr belongs to the package and on install it copies it to /var/lib. Any subsequent updates with update-smart-drivedb will update /var/lib and not mess with the packaged original.

If users have broken their file a --reinstall or upgrade of smartmontools will restore the packaged version, just as a manual copy from /usr/share/smartmontools/drivedb.h would.

[Test Plan]

This test plan is for Focal, but applies to Bionic in the same way.

0.Preparing the test environment:

#Preparing the container
lxc launch images:ubuntu/focal focal
lxc shell focal
apt update -y
apt upgrade -y

#Installing necessary tools

apt install -y smartmontools gpg debsums wget

0.1 Preparing scenario:

#At this point, debsums always gives all OK for the package:

root@focal:~# debsums smartmontools
/lib/systemd/system/smartmontools.service OK
/usr/sbin/smartctl OK
/usr/sbin/smartd OK
/usr/sbin/update-smart-drivedb OK
/usr/share/bug/smartmontools/presubj OK
/usr/share/doc/smartmontools/AUTHORS OK
/usr/share/doc/smartmontools/ChangeLog-6.0-7.0.gz OK
/usr/share/doc/smartmontools/NEWS.Debian.gz OK
/usr/share/doc/smartmontools/NEWS.gz OK
/usr/share/doc/smartmontools/README OK
/usr/share/doc/smartmontools/README.Debian OK
/usr/share/doc/smartmontools/badblockhowto.html OK
/usr/share/doc/smartmontools/changelog.Debian.gz OK
/usr/share/doc/smartmontools/copyright OK
/usr/share/doc/smartmontools/examples/Example1 OK
/usr/share/doc/smartmontools/examples/Example2 OK
/usr/share/doc/smartmontools/examples/Example3 OK
/usr/share/doc/smartmontools/examples/Example4 OK
/usr/share/doc/smartmontools/examples/Example5 OK
/usr/share/doc/smartmontools/examples/Example6 OK
/usr/share/doc/smartmontools/examples/Example7 OK
/usr/share/doc/smartmontools/examples/Example8 OK
/usr/share/doc/smartmontools/examples/README OK
/usr/share/doc/smartmontools/smartd.conf.gz OK
/usr/share/lintian/overrides/smartmontools OK
/usr/share/man/man5/smartd.conf.5.gz OK
/usr/share/man/man8/smartctl.8.gz OK
/usr/share/man/man8/smartd.8.gz OK
/usr/share/man/man8/update-smart-drivedb.8.gz OK
/usr/share/smartmontools/smartd-runner OK
/usr/share/smartmontools/smartd_warning.sh OK
/var/lib/smartmontools/drivedb/drivedb.h OK

#Perform an update of the drivedb.h:

root@focal:~# update-smart-drivedb
/var/lib/smartmontools/drivedb/drivedb.h updated from branches/RELEASE_7_0_DRIVEDB

1. Bad cases:

root@focal:~# debsums smartmontools | grep drivedb.h
/var/lib/smartmontools/drivedb/drivedb.h FAILED

2. Good cases:

# special attention on the new location of the file

root@focal:~# debsums smartmontools | grep drivedb.h
/usr/share/smartmontools/drivedb.h OK

[Where problems could occur]

We initially thought that if the file or it gets corrupted (bad update by update-smart-drived) a new installation wouldn't be a solution - that would have been a problem. But at this point the balance of "runtime vs package update" was taken so that the package wins. So a --reinstall will ensure that the packaged content is in place - at the cost of potentially downgrading if the user put new content there. This isn't different than before.

[Other Info]

The fix applied here is picked up from upstream (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976696#30) available since version 7.2-1 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976696#30).

[Original Report]

-------------------------------------------------------------------------

The update-smart-drivedb command overwrites /var/lib/smartmontools/drivedb/drivedb.h which is a file installed by the package. This means that reinstalling or upgrading the package from a SRU may downgrade the drivedb. In general it's something packages shouldn't do. After running update-smart-drivedb on Groovy `debsums smartmontools` report that the package has a corrupted file:

/var/lib/smartmontools/drivedb/drivedb.h FAILED

The smartctl(8) manpage says that

  If /var/lib/smartmontools/drivedb/drivedb.h is
  present, the contents of this file is used instead
  of the built in table.

So I think we should:

1. Make sure the built-in table is up-to-date with drivedb.h. I suppose that file gets #included in the code when building, so this should be the case.

2. Stop installing /var/lib/smartmontools/drivedb/drivedb.h and leave it in full control of update-smart-drivedb.

[Miriam España Acebal (mirespace)]

Fixed in Debian since version 7.2-1 (which is the version we have from Hirsute onwards)

The fix is here [1] and there is also an enhancement related to this here [2] (fixed) and [3].

[1] https://salsa.debian.org/debian/smartmontools/-/commit/4c422299c8d46bb46dbee7ba7717a677526faeea
[2] https://www.smartmontools.org/ticket/1424
[3] https://www.smartmontools.org/ticket/1426

[Miriam España Acebal (mirespace)]

Hi,

[2] and [3] in comment #1 are part of the future release of smartmontools (beyond 7.2), so we'll take only the fix [1] from comment #1.

[Christian Ehrhardt  (paelzer)]

Given the low impact and being fixed in newer releases this might be not worth an SRU.
Please discuss this as part of the MPs.

[Christian Ehrhardt  (paelzer)]

We discussed this and the impact of the fix is too small, let us abandon the SRUs.
To be clear the fix for the recent versions is right, but the impact/fix does not suffice an SRU.

[Christian Franke (christian-franke)]

A note for packaging the upcoming release 7.3:
https://www.smartmontools.org/ticket/1426#comment:12