udev reports error due to NIS usage

[Soeren Grunewald]

I see the following error message when trying to updating udev to 245.4-4ubuntu3.4.
> systemd-udevd[25721]: do_ypcall: clnt_call: RPC: Unable to send; errno = Operation not permitted

As it turns out we trigger a security feature of systemd, which appears because we use NIS:

https://github.com/systemd/systemd/commit/695fe4078f0df6564a1be1c4a6a9e8a640d23b67

The solution is fairly simple:
$ sudo mkdir /etc/systemd/system/systemd-udevd.service.d/
$ printf "[Service]\nIPAddressDeny=\n" | sudo tee /etc/systemd/system/systemd-udevd.service.d/override.conf

And here the full error message occurring during the update:

Setting up udev (245.4-4ubuntu3.4) ...
Job for systemd-udevd.service failed because a timeout was exceeded.
See "systemctl status systemd-udevd.service" and "journalctl -xe" for details.
invoke-rc.d: initscript udev, action "restart" failed.
● systemd-udevd.service - udev Kernel Device Manager
     Loaded: loaded (/lib/systemd/system/systemd-udevd.service; static; vendor preset: enabled)
     Active: activating (start) since Fri 2021-02-19 10:44:33 CET; 7ms ago
TriggeredBy: ● systemd-udevd-control.socket
             ● systemd-udevd-kernel.socket
       Docs: man:systemd-udevd.service(8)
             man:udev(7)
   Main PID: 2196 ((md-udevd))
      Tasks: 1
     Memory: 640.0K
     CGroup: /system.slice/systemd-udevd.service
             └─2196 (md-udevd)

Feb 19 10:44:33 hasfpnccd systemd[1]: Starting udev Kernel Device Manager...
dpkg: error processing package udev (--configure):
 installed udev package post-installation script subprocess returned error exit status 1
dpkg: dependency problems prevent configuration of snapd:
 snapd depends on udev; however:
  Package udev is not configured yet.

dpkg: error processing package snapd (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of ubuntu-drivers-common:
 ubuntu-drivers-common depends on udev (>= 204-0ubuntu4~); however:
  Package udev is not configured yet.

dpkg: error processing package ubuntu-drivers-common (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of xserver-xorg-core:
 xserver-xorg-core depends on udev (>= 149); however:
  Package udev is not configured yet.

dpkg: error processing package xserver-xorg-core (--configure):
 dependency problems - leaving unconfigured
No apport report written because the error message indicates its a followup error from a previous failure.
                                                                                                          No apport report written because the error message indicates its a followup error from a previous failure.
                                                                                                                                                                                                                    N
o apport report written because MaxReports is reached already
                                                             Errors were encountered while processing:
 udev
 snapd
 ubuntu-drivers-common
 xserver-xorg-core
E: Sub-process /usr/bin/dpkg returned an error code (1)

[Dan Streetman (ddstreet)]

I'm unclear if this is a bug that needs fixing? Are you saying we should ship a drop-in file to disable the upstream ip sandboxing?

[Soeren Grunewald (soeren-grunewald)]

@ddstreet Well, after thinking about it, I'm actually not sure if this is an issue after all. Or if this should/must be handled by the system administrator itself, when using NIS.