update manager has twice appeared when surfing

[athun]

Using Ubuntu 9.04. Not sure if bug or security concern. Twice now, each time while I was surfing using Firefox 3.0.10, the update manager window has suddenly appeared with recommended security updates. I am certain I did not call it up. First time, foolishly, I tried to install the updates and got message that update failed because could not obtain lock. When I closed the window and then checked for updates there were no updates to be installed. Second time I just closed window and checked for updates. Again, no updates to be installed.

[Matthew Paul Thomas (mpt)]

This is not a duplicate of bug 332945. If Update Manager is opening to display no available updates, that is a bug.

[Nicola Ferralis (feranick)]

It seems you might have multiple instances of update manager (or synaptic) open. If you close all applications (or reboot) and try to manually run the update manager, do you still have the same problem?

[Bernard Springer (athun1)]

I suspect you are right and I have handled it by rebooting.

The problem recurs intermittently and only when the updates are security
related. There have only been relatively few instances of the problem
but when it happens I get error messages:

Could not get lock /var/cache/apt/archives/lock - open (!!resource
temporarily unavailable)
Unable to lock the download directory.

Sometimes but not always also a message there is another app running
which needs to be closed. As I have security updates set to install
automatically, perhaps update manager is both trying to install the
updates and also telling me to install the updates. If I try to
install them (security updates) I usually get the problem. If I do
not try to install but just close update manager the updates usually
install. But not always and the security update for T-Bird on 8/21 is
one case where the update did not then install. In that case I ended
by rebooting, opened update manager, and installed the T-Bird update
without difficulty. This is how I have managed the problem - rebooting
when I get a notification of available security updates. When I reboot
and then open update manager I sometimes (again) get notification that
no security updates are available (the updates appear to have already
been installed). Other times, as with the T-Bird update, that security
updates are available and this time there is no installation problem.

The problem is annoying but handleable except that I wonder and worry
about possible security implications of having an update manager which
is not completely consistent.

Anyway, thanks for your help.

feranick wrote:
> It seems you might have multiple instances of update manager (or
> synaptic) open. If you close all applications (or reboot) and try to
> manually run the update manager, do you still have the same problem?
>
>

--
Bernard Springer
<email address hidden>

[Simon Bohlin (simon-bohlin)]

There is a further problem with Update Manager being interactive by default. Users learn to click to allow and install, filling in superuser passwords, and one day (*) somebody will just create a fake update manager to steal superuser passwords and make ubuntu-zombies. There are several ways a fake Update Manager could get on my machine; starting with scripts or console commands that the user would get via chat or support forums as a "solution" to some driver question or similar.

(*) search comments of http://ask.slashdot.org/story/09/12/01/0025213/Ethics-of-Releasing-Non-Malicious-Linux-Malware

[Bernard Springer (athun1)]

I agree and have pointed this out in several emails concerning the issue
although not in the detail in your email. But unless the update icon
is brought back I don't see how this possibility can be avoided in a
manner acceptable to users, and so far it appears the icon is not coming
back. I have gotten into the habit of using the update manager when it
appears as a form of update icon, closing it, and clicking on my
installed icon to install any updates.

Simon Bohlin wrote:
> There is a further problem with Update Manager being interactive by
> default. Users learn to click to allow and install, filling in superuser
> passwords, and one day (*) somebody will just create a fake update
> manager to steal superuser passwords and make ubuntu-zombies. There are
> several ways a fake Update Manager could get on my machine; starting
> with scripts or console commands that the user would get via chat or
> support forums as a "solution" to some driver question or similar.
>
> (*) search comments of http://ask.slashdot.org/story/09/12/01/0025213
> /Ethics-of-Releasing-Non-Malicious-Linux-Malware
>
>

--
Bernard Springer
<email address hidden>