Ubuntu
upstart package

cups fails to install when kernel does not provide block_suspend capability

Bug #1058356 reported by Ted Gould on 2012-09-28

This bug affects 2 people

	Status	Importance	Assigned to	Milestone
cups (Ubuntu)	Invalid	Undecided	Unassigned
Quantal	Invalid	Undecided	Unassigned
upstart (Ubuntu)	Fix Released	Medium	Jamie Strandboge	Ubuntu quantal-updates
Quantal	Fix Released	Medium	Jamie Strandboge	Ubuntu quantal-updates

Bug Description

[Impact]

* Some users upgrading from 12.04 LTS to 12.10 have encountered upgrade
  errors because apparmor_parser fails to load new policy on an old kernel.
  Specifically, the block_suspend capability is new in the 12.10 kernel and
  does not exist in the 12.04 LTS kernel.

* On upgrade, the cups upstart job calls /lib/init/apparmor-profile-load
from upstart, which in turn calls apparmor_parser. apparmor_parser can
exit with error on upgrades causing the upstart job to fail.

[Test Case]

* Regular upgrades using do-release-upgrade or update-manager don't seem to
be affected, so it is best to:

* Obtain the apparmor profile from the 12.10 cups package[1], copy it to
/etc/apparmor.d/usr.sbin.cupsd and then perform 'sudo stop cups ; sudo
start cups'.

* If the bug is not fixed, you will see 'start: Job failed to start'. If it
is fixed, you will see 'cups start/running, process ####'.

[1]http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/quantal/cups/quantal/view/head:/debian/local/apparmor-profile

[Regression Potential]

* The regression potential is extremely low. The only change is adding '||
exit 0' to a shell script.

[Other Info]

* This has been discussed with the security team, the release team and
foundations and we all agree this is the best fix at this time.

* On upgrades, upstart is unpacked very early (much earlier than cups), so
the new /lib/init/apparmor-profile-load should be in place before the
upstart job is used

* apparmor_parser failure will not remove the old profile when it faces this
error condition, so the program will not go unconfined

On our Jenkins builds we're getting a failure to install the cups package. This seems to be because the apparmor profile looks for suspend capability but the virtualized builders do not have it. Here seems to be the relevant log:

AppArmor parser error for /etc/apparmor.d/usr.sbin.cupsd in /etc/apparmor.d/usr.sbin.cupsd at line 24: Invalid capability block_suspend.
start: Job failed to start
invoke-rc.d: initscript cups, action "start" failed.
dpkg: error processing cups (--configure):
subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
cups
E: Sub-process /usr/bin/dpkg returned an error code (1)

Full log: https://jenkins.qa.ubuntu.com/job/indicator-session-ci/label=quantal/16/console

See original description

Tags:

Revision history for this message

Till Kamppeter (till-kamppeter) wrote on 2012-09-28:

pitti, can you have a look into this? It is an AppArmor issue.

Changed in cups (Ubuntu):
assignee:	nobody → Martin Pitt (pitti)

Revision history for this message

Martin Pitt (pitti) wrote on 2012-10-01:

Jamie, as you added this, do you have a recommendation how to ignore it if the capability doesn't exist on the system? Or should AppArmor itself be fixed to not stumble over nonexisting deny capabilities?

Changed in cups (Ubuntu):
assignee:	Martin Pitt (pitti) → Jamie Strandboge (jdstrand)
summary:	- CUPS failes to install with apparmor exception + fails to install when kernel does not provide block_suspend capability

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-01: Re: fails to install when kernel does not provide block_suspend capability

There is not a way to 'ignore it if the capability doesn't exist on the system'. We might be able to adjust the parser, but that might not be desirable for a number of reasons.

I don't understand how this is happening-- this capability rule should only exist in 12.10's profile, yet 12.10 kernels have this capability. Can you describe the test environment?

Changed in cups (Ubuntu):
status:	New → Incomplete

Revision history for this message

RussianNeuroMancer (russianneuromancer) wrote on 2012-10-12:

> I don't understand how this is happening
For example this bug maybe reproduced if you replace "precise" to "quantal" in sources.list and run aptitude dist-upgrade.

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12:

RussionNeuroMancer,

Ah, yes. While cups.postinst uses 'apparmor_parser -r -T -W "$APP_PROFILE" || true' so this shouldn't fail, the upstart job uses /sbin/apparmor_parser -r -W "$profile" which would fail.

Changed in cups (Ubuntu):
status:	Incomplete → Confirmed

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12:

This is an important bug that will affect upgrades from 12.04 LTS to 12.10.

affects:	cups (Ubuntu) → upstart (Ubuntu)
Changed in upstart (Ubuntu):
importance:	Undecided → High
milestone:	none → ubuntu-12.10
status:	Confirmed → In Progress
tags:	added: apparmor

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12:

upstart_1.5-0ubuntu9.debdiff Edit (944 bytes, text/plain)

Minimal patch to /lib/init/apparmor-profile-load to 'exit 0' on apparmor_parser errors.

Jamie Strandboge (jdstrand) on 2012-10-12

Changed in upstart (Ubuntu):
status:	In Progress → Fix Committed

Revision history for this message

Steve Langasek (vorlon) wrote on 2012-10-12: Please test proposed package

Hello Ted, or anyone else affected,

Accepted upstart into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/upstart/1.5-0ubuntu9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

tags:

added: verification-needed

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12: Re: fails to install when kernel does not provide block_suspend capability

Uploaded to quantal-proposed.

Changed in upstart (Ubuntu):
milestone:	ubuntu-12.10 → quantal-updates

Jamie Strandboge (jdstrand) on 2012-10-12

description:

updated

Jamie Strandboge (jdstrand) on 2012-10-12

description:

updated

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12:

#10

I can reproduce the failure of cups to start, but have not been able to reproduce upgrading from 12.04 to 12.10.

description:	updated
Changed in upstart (Ubuntu Quantal):
importance:	High → Medium

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2012-10-12:

#11

Downgrading the priority for now. I still believe we should fix this in an SRU because this is the 3rd bug we've seen on this, so people are hitting it.

Jamie Strandboge (jdstrand) on 2012-10-12

description:

updated

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-10-15:

#12

This bug was fixed in the package upstart - 1.5-0ubuntu9

---------------
upstart (1.5-0ubuntu9) quantal-proposed; urgency=low

  * debian/apparmor-profile-load: exit 0 if apparmor_parser fails to not
    block upgrades (errors will still be logged by upstart). This can be
    removed once apparmor_parser better deals with new policy on old kernels
    - LP: #1058356
-- Jamie Strandboge <email address hidden> Fri, 12 Oct 2012 13:54:10 -0500

Changed in upstart (Ubuntu Quantal):
status:	Fix Committed → Fix Released

Revision history for this message

Kees Cook (kees) wrote on 2012-10-22:

#13

It looks like cups need a versioned depend on quantal's apparmor as well, or else you can get into the state where apparmor is precise, and cups is quantal. This happened after an upgrade failed for other reasons and I tried to continue the installs.

Revision history for this message

Mathew Hodson (mhodson) wrote on 2014-05-29:

#14

The upstart package in quantal-proposed was released so removing the verification-needed tag.

tags:

added: quantal
removed: verification-needed

Revision history for this message

Rolf Leggewie (r0lf) wrote on 2014-12-05:

#15

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".

Changed in cups (Ubuntu Quantal):
status:	New → Won't Fix

Mathew Hodson (mhodson) on 2015-08-19

Changed in cups (Ubuntu):
status:	New → Invalid
Changed in cups (Ubuntu Quantal):
status:	Won't Fix → Invalid

Mathew Hodson (mhodson) on 2015-08-19

description:	updated
summary:	- fails to install when kernel does not provide block_suspend capability + cups fails to install when kernel does not provide block_suspend + capability
description:	updated