Permission denied error from show-motd when updates available

[Hayden Barnes]

[Impact]

 * This impacts focal (20.04 LTS) users on WSL. On WSL version of Ubuntu 20.04, on the first time of the launch in a day, the MOTD will show. This error will show if apt gets update but packages are not upgrade.

[Test Case]

* Install Ubuntu/Ubuntu 20.04 LTS from Microsoft Store and setup a user.

* `sudo apt update` and remove `~/.motd_shown`, quit and terminate the running distribution by `wsl.exe -t <distro>`.

* Restart the distribution, the MOTD will be shown again, and the error should be gone.

[Regression Potential]

 * None for now. The file being called in WSL right now is only being used by WSL confirmed by CPC

[Original Bug Report]

motd on demo of 20.04:

Welcome to Ubuntu 20.04 LTS (GNU/Linux 4.19.84-microsoft-standard x86_64)

....

26 updates can be installed immediately.
0 of these updates are security updates.
To see these additional updates run: apt list --upgradable

/usr/lib/ubuntu-release-upgrader/release-upgrade-motd: 31: cannot create /var/lib/ubuntu-release-upgrader/release-upgrade-available: Permission denied

[Hayden Barnes (haydenb)]

/etc/update-motd.d/91-release-upgrade:

 #!/bin/sh

 # if the current release is under development there won't be a new one
 if [ "$(lsb_release -sd | cut -d' ' -f4)" = "(development" ]; then
    exit 0
 fi
 if [ -x /usr/lib/ubuntu-release-upgrader/release-upgrade-motd ]; then
    exec /usr/lib/ubuntu-release-upgrader/release-upgrade-motd
 fi

calls /usr/lib/ubuntu-release-upgrader/release-upgrade-motd:

 stamp=/var/lib/ubuntu-release-upgrader/release-upgrade-available
 if [ -f "$stamp" ]; then
 # Stamp exists, see if it's expired
 now=$(date +%s)
        lastrun=$(stat -c %Y "$stamp") 2>/dev/null || lastrun=0
        expiration=$(expr $lastrun + 86400)
        if [ $now -ge $expiration ]; then
  # Older than 1 day old, so update in the background
  /usr/lib/ubuntu-release-upgrader/check-new-release -q > "$stamp" & # <--- Line 31
 elif [ -s "$stamp" ]; then
  # Less than 1 day old, and non-empty, so display now
  cat "$stamp"
  echo
 fi
 elif [ "$(id -u)" = 0 ]; then
 # No cache at all, so update in the background
 /usr/lib/ubuntu-release-upgrader/check-new-release -q > "$stamp" &
 fi

on 20.04 wsl:

 $stat -c '%A %a %n' /var/lib/ubuntu-release-upgrader/
 drwxr-xr-x 755 /var/lib/ubuntu-release-upgrader/

 $ ls -la /var/lib/ubuntu-release-upgrader
 drwxr-xr-x 2 root root 4096 Nov 8 13:31 .

same on 16.04 wsl

I don't think /var/lib/ubuntu-release-upgrader/release-upgrade-available can be created because /var/lib/ubuntu-release-upgrader/ belongs to root.

This works fine in containers where users are privileged by default but runs into an issue when WSL starts as an unprivileged user.

Users are not going to invoke motd with sudo normally and this error is confusing to inexperienced users so it should be fixed.

/usr/lib/ubuntu-release-upgrader/release-upgrade-motd is in ubuntu-release-upgrader-core: https://git.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/tree/debian/release-upgrade-motd?h=ubuntu/focal

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Patrick Wu (callmepk)]

I can also confirm this bug here runnning on focal

[Patrick Wu (callmepk)]

Got a possible fix solution for update-motd: https://launchpad.net/~callmepk/+archive/ubuntu/ppa

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "update-motd_3.6-0ubuntu7.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Balint Reczey (rbalint)]

Maintainer scripts must not change files installed/owned by other package.

The fix should be done in u-r-u.

--- update-motd-3.6.orig/debian/show-motd.postinst
+++ update-motd-3.6/debian/show-motd.postinst
@@ -0,0 +1,43 @@
+
+#!/bin/sh
...
+case "$1" in
+
+ configure)
+ # if it's WSL and we have 91-release-upgrade, disable it
+ if [ -e "/proc/sys/fs/binfmt_misc/WSLInterop" ] && [ -e "/etc/update-motd.d/91-release-upgrade" ]; then
+ [ -x "/etc/update-motd.d/91-release-upgrade" ] && chmod -x "/etc/update-motd.d/91-release-upgrade"
+ fi

[Patrick Wu (callmepk)]

> Maintainer scripts must not change files installed/owned by other package.

Noted, I will pay attention to that in the future, and thanks for the heads up for here should the fix go

[Brian Murray (brian-murray)]

This will need SRU information if this is to be fixed in releases other than groovy.

[Patrick Wu (callmepk)]

Hi Brian Murray,
I have updated for SRU. This needs to be SRU to 20.04 LTS only.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-release-upgrader - 1:20.10.3

---------------
ubuntu-release-upgrader (1:20.10.3) groovy; urgency=medium

  [ Dimitri John Ledkov ]
  * Use ubuntu-archive-keyring to verify upgrades, irrespective of how
    apt-key is configured.

  [ Brian Murray ]
  * utils/demotions.py: also use the ubuntu-archive-keyring when determining
    packages that were demoted.

 -- Brian Murray <email address hidden> Tue, 30 Jun 2020 09:15:09 -0700

[Łukasz Zemczak (sil2100)]

Hello Hayden, or anyone else affected,

Accepted ubuntu-release-upgrader into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-release-upgrader/1:20.04.20 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted ubuntu-release-upgrader (1:20.04.20) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

update-manager/1:20.04.10.1 (armhf)
update-motd/3.6-0ubuntu6 (armhf, ppc64el, amd64, arm64, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#ubuntu-release-upgrader

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ryan Finnie (fo0bar)]

This fails when logging in from the console (see below). Doesn't appear to be affected when logging in via SSH.

The check should probably be [ -z "$EUID" -o "$EUID" -ne 0 ].

Ubuntu 20.04 LTS riscv64-dev ttyS0

riscv64-dev login: ryan
Password:
/etc/update-motd.d/91-release-upgrade: 9: [: Illegal number:
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-28-generic riscv64)

 * Documentation: https://help.ubuntu.com
 * Management: https://landscape.canonical.com
 * Support: https://ubuntu.com/advantage

0 updates can be installed immediately.
0 of these updates are security updates.

Last login: Mon Jul 6 17:24:50 UTC 2020 on ttyS0
ryan@riscv64-dev:~$

[Brian Murray (brian-murray)]

This should be fixed with ubuntu-release-upgrader version 1:20.10.4 from groovy.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted ubuntu-release-upgrader (1:20.04.20) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

update-manager/1:20.04.10.1 (armhf)
update-motd/3.6-0ubuntu6 (armhf, s390x, amd64, arm64, ppc64el)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#ubuntu-release-upgrader

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Brian Murray (brian-murray)]

Hello Hayden, or anyone else affected,

Accepted ubuntu-release-upgrader into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-release-upgrader/1:20.04.21 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Patrick Wu (callmepk)]

Proposed package tested, the error is no longer showing.

[Patrick Wu (callmepk)]

*Proposed package tested for focal

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-release-upgrader - 1:20.04.21

---------------
ubuntu-release-upgrader (1:20.04.21) focal; urgency=medium

  * debian/91-release-upgrade: make it work in dash. (LP: #1873545)

ubuntu-release-upgrader (1:20.04.20) focal; urgency=medium

  * debian/91-release-upgrade: exit 0 if run as a non-root user.
    (LP: #1873545)
  * Only pass the package name to apport in the event that there is a dpkg
    error during a distribution upgrade. (LP: #1884148)

 -- Brian Murray <email address hidden> Mon, 06 Jul 2020 08:42:50 -0700

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for ubuntu-release-upgrader has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Extender (msveshnikov)]

It is again starting on WSL 22.04 :(

[Fernando Eggert (fereggert)]

The bug is back in 22.04

[Dimitri Dias Moreira (taikamya)]

Yep. Can confirm it's happening again on WSL 22.04 LTS.

[Ebbe Kristensen (ebbek)]

I too can confirm that this bug is back in WSL 22.04 LTS