cups fails to install when kernel does not provide block_suspend capability

[Ted Gould]

[Impact]

* Some users upgrading from 12.04 LTS to 12.10 have encountered upgrade
  errors because apparmor_parser fails to load new policy on an old kernel.
  Specifically, the block_suspend capability is new in the 12.10 kernel and
  does not exist in the 12.04 LTS kernel.

* On upgrade, the cups upstart job calls /lib/init/apparmor-profile-load
  from upstart, which in turn calls apparmor_parser. apparmor_parser can
  exit with error on upgrades causing the upstart job to fail.

[Test Case]

* Regular upgrades using do-release-upgrade or update-manager don't seem to
  be affected, so it is best to:

* Obtain the apparmor profile from the 12.10 cups package[1], copy it to
  /etc/apparmor.d/usr.sbin.cupsd and then perform 'sudo stop cups ; sudo
  start cups'.

* If the bug is not fixed, you will see 'start: Job failed to start'. If it
  is fixed, you will see 'cups start/running, process ####'.

[1]http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/quantal/cups/quantal/view/head:/debian/local/apparmor-profile

[Regression Potential]

* The regression potential is extremely low. The only change is adding '||
  exit 0' to a shell script.

[Other Info]

* This has been discussed with the security team, the release team and
  foundations and we all agree this is the best fix at this time.

* On upgrades, upstart is unpacked very early (much earlier than cups), so
  the new /lib/init/apparmor-profile-load should be in place before the
  upstart job is used

* apparmor_parser failure will not remove the old profile when it faces this
  error condition, so the program will not go unconfined

On our Jenkins builds we're getting a failure to install the cups package. This seems to be because the apparmor profile looks for suspend capability but the virtualized builders do not have it. Here seems to be the relevant log:

AppArmor parser error for /etc/apparmor.d/usr.sbin.cupsd in /etc/apparmor.d/usr.sbin.cupsd at line 24: Invalid capability block_suspend.
start: Job failed to start
invoke-rc.d: initscript cups, action "start" failed.
dpkg: error processing cups (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 cups
E: Sub-process /usr/bin/dpkg returned an error code (1)

Full log: https://jenkins.qa.ubuntu.com/job/indicator-session-ci/label=quantal/16/console

[Till Kamppeter (till-kamppeter)]

pitti, can you have a look into this? It is an AppArmor issue.

[Martin Pitt (pitti)]

Jamie, as you added this, do you have a recommendation how to ignore it if the capability doesn't exist on the system? Or should AppArmor itself be fixed to not stumble over nonexisting deny capabilities?

[Jamie Strandboge (jdstrand)]

There is not a way to 'ignore it if the capability doesn't exist on the system'. We might be able to adjust the parser, but that might not be desirable for a number of reasons.

I don't understand how this is happening-- this capability rule should only exist in 12.10's profile, yet 12.10 kernels have this capability. Can you describe the test environment?

[RussianNeuroMancer (russianneuromancer)]

> I don't understand how this is happening
For example this bug maybe reproduced if you replace "precise" to "quantal" in sources.list and run aptitude dist-upgrade.

[Jamie Strandboge (jdstrand)]

RussionNeuroMancer,

Ah, yes. While cups.postinst uses 'apparmor_parser -r -T -W "$APP_PROFILE" || true' so this shouldn't fail, the upstart job uses /sbin/apparmor_parser -r -W "$profile" which would fail.

[Jamie Strandboge (jdstrand)]

This is an important bug that will affect upgrades from 12.04 LTS to 12.10.

[Jamie Strandboge (jdstrand)]

Minimal patch to /lib/init/apparmor-profile-load to 'exit 0' on apparmor_parser errors.

[Steve Langasek (vorlon)]

Hello Ted, or anyone else affected,

Accepted upstart into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/upstart/1.5-0ubuntu9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Jamie Strandboge (jdstrand)]

Uploaded to quantal-proposed.

[Jamie Strandboge (jdstrand)]

I can reproduce the failure of cups to start, but have not been able to reproduce upgrading from 12.04 to 12.10.

[Jamie Strandboge (jdstrand)]

Downgrading the priority for now. I still believe we should fix this in an SRU because this is the 3rd bug we've seen on this, so people are hitting it.

[Launchpad Janitor (janitor)]

This bug was fixed in the package upstart - 1.5-0ubuntu9

---------------
upstart (1.5-0ubuntu9) quantal-proposed; urgency=low

  * debian/apparmor-profile-load: exit 0 if apparmor_parser fails to not
    block upgrades (errors will still be logged by upstart). This can be
    removed once apparmor_parser better deals with new policy on old kernels
    - LP: #1058356
 -- Jamie Strandboge <email address hidden> Fri, 12 Oct 2012 13:54:10 -0500

[Kees Cook (kees)]

It looks like cups need a versioned depend on quantal's apparmor as well, or else you can get into the state where apparmor is precise, and cups is quantal. This happened after an upgrade failed for other reasons and I tried to continue the installs.

[Mathew Hodson (mhodson)]

The upstart package in quantal-proposed was released so removing the verification-needed tag.

[Rolf Leggewie (r0lf)]

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".