cups fails to install when kernel does not provide block_suspend capability

Bug #1058356 reported by Ted Gould on 2012-09-28
22
This bug affects 2 people
Affects Status Importance Assigned to Milestone
cups (Ubuntu)
Undecided
Unassigned
Quantal
Undecided
Unassigned
upstart (Ubuntu)
Medium
Jamie Strandboge
Quantal
Medium
Jamie Strandboge

Bug Description

[Impact]

* Some users upgrading from 12.04 LTS to 12.10 have encountered upgrade
  errors because apparmor_parser fails to load new policy on an old kernel.
  Specifically, the block_suspend capability is new in the 12.10 kernel and
  does not exist in the 12.04 LTS kernel.

* On upgrade, the cups upstart job calls /lib/init/apparmor-profile-load
  from upstart, which in turn calls apparmor_parser. apparmor_parser can
  exit with error on upgrades causing the upstart job to fail.

[Test Case]

* Regular upgrades using do-release-upgrade or update-manager don't seem to
  be affected, so it is best to:

* Obtain the apparmor profile from the 12.10 cups package[1], copy it to
  /etc/apparmor.d/usr.sbin.cupsd and then perform 'sudo stop cups ; sudo
  start cups'.

* If the bug is not fixed, you will see 'start: Job failed to start'. If it
  is fixed, you will see 'cups start/running, process ####'.

[1]http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/quantal/cups/quantal/view/head:/debian/local/apparmor-profile

[Regression Potential]

* The regression potential is extremely low. The only change is adding '||
  exit 0' to a shell script.

[Other Info]

* This has been discussed with the security team, the release team and
  foundations and we all agree this is the best fix at this time.

* On upgrades, upstart is unpacked very early (much earlier than cups), so
  the new /lib/init/apparmor-profile-load should be in place before the
  upstart job is used

* apparmor_parser failure will not remove the old profile when it faces this
  error condition, so the program will not go unconfined

On our Jenkins builds we're getting a failure to install the cups package. This seems to be because the apparmor profile looks for suspend capability but the virtualized builders do not have it. Here seems to be the relevant log:

AppArmor parser error for /etc/apparmor.d/usr.sbin.cupsd in /etc/apparmor.d/usr.sbin.cupsd at line 24: Invalid capability block_suspend.
start: Job failed to start
invoke-rc.d: initscript cups, action "start" failed.
dpkg: error processing cups (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 cups
E: Sub-process /usr/bin/dpkg returned an error code (1)

Full log: https://jenkins.qa.ubuntu.com/job/indicator-session-ci/label=quantal/16/console

Till Kamppeter (till-kamppeter) wrote :

pitti, can you have a look into this? It is an AppArmor issue.

Changed in cups (Ubuntu):
assignee: nobody → Martin Pitt (pitti)
Martin Pitt (pitti) wrote :

Jamie, as you added this, do you have a recommendation how to ignore it if the capability doesn't exist on the system? Or should AppArmor itself be fixed to not stumble over nonexisting deny capabilities?

Changed in cups (Ubuntu):
assignee: Martin Pitt (pitti) → Jamie Strandboge (jdstrand)
summary: - CUPS failes to install with apparmor exception
+ fails to install when kernel does not provide block_suspend capability

There is not a way to 'ignore it if the capability doesn't exist on the system'. We might be able to adjust the parser, but that might not be desirable for a number of reasons.

I don't understand how this is happening-- this capability rule should only exist in 12.10's profile, yet 12.10 kernels have this capability. Can you describe the test environment?

Changed in cups (Ubuntu):
status: New → Incomplete

> I don't understand how this is happening
For example this bug maybe reproduced if you replace "precise" to "quantal" in sources.list and run aptitude dist-upgrade.

Jamie Strandboge (jdstrand) wrote :

RussionNeuroMancer,

Ah, yes. While cups.postinst uses 'apparmor_parser -r -T -W "$APP_PROFILE" || true' so this shouldn't fail, the upstart job uses /sbin/apparmor_parser -r -W "$profile" which would fail.

Changed in cups (Ubuntu):
status: Incomplete → Confirmed
Jamie Strandboge (jdstrand) wrote :

This is an important bug that will affect upgrades from 12.04 LTS to 12.10.

affects: cups (Ubuntu) → upstart (Ubuntu)
Changed in upstart (Ubuntu):
importance: Undecided → High
milestone: none → ubuntu-12.10
status: Confirmed → In Progress
tags: added: apparmor
Jamie Strandboge (jdstrand) wrote :

Minimal patch to /lib/init/apparmor-profile-load to 'exit 0' on apparmor_parser errors.

Changed in upstart (Ubuntu):
status: In Progress → Fix Committed

Hello Ted, or anyone else affected,

Accepted upstart into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/upstart/1.5-0ubuntu9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags: added: verification-needed

Uploaded to quantal-proposed.

Changed in upstart (Ubuntu):
milestone: ubuntu-12.10 → quantal-updates
description: updated
description: updated
Jamie Strandboge (jdstrand) wrote :

I can reproduce the failure of cups to start, but have not been able to reproduce upgrading from 12.04 to 12.10.

description: updated
Changed in upstart (Ubuntu Quantal):
importance: High → Medium
Jamie Strandboge (jdstrand) wrote :

Downgrading the priority for now. I still believe we should fix this in an SRU because this is the 3rd bug we've seen on this, so people are hitting it.

description: updated
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package upstart - 1.5-0ubuntu9

---------------
upstart (1.5-0ubuntu9) quantal-proposed; urgency=low

  * debian/apparmor-profile-load: exit 0 if apparmor_parser fails to not
    block upgrades (errors will still be logged by upstart). This can be
    removed once apparmor_parser better deals with new policy on old kernels
    - LP: #1058356
 -- Jamie Strandboge <email address hidden> Fri, 12 Oct 2012 13:54:10 -0500

Changed in upstart (Ubuntu Quantal):
status: Fix Committed → Fix Released
Kees Cook (kees) wrote :

It looks like cups need a versioned depend on quantal's apparmor as well, or else you can get into the state where apparmor is precise, and cups is quantal. This happened after an upgrade failed for other reasons and I tried to continue the installs.

Mathew Hodson (mathew-hodson) wrote :

The upstart package in quantal-proposed was released so removing the verification-needed tag.

tags: added: quantal
removed: verification-needed
Rolf Leggewie (r0lf) wrote :

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".

Changed in cups (Ubuntu Quantal):
status: New → Won't Fix
Changed in cups (Ubuntu):
status: New → Invalid
Changed in cups (Ubuntu Quantal):
status: Won't Fix → Invalid
description: updated
summary: - fails to install when kernel does not provide block_suspend capability
+ cups fails to install when kernel does not provide block_suspend
+ capability
description: updated
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers