ldconfig is still deferred in libc6.preinst

Bug #1889190 reported by Balint Reczey
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
glibc (Ubuntu)
Fix Released
Undecided
Balint Reczey
Focal
Fix Released
Undecided
Balint Reczey

Bug Description

[Impact]

 * Upgrade from Bionic to Focal may break if LDCONFIG_TRIGGER_DEBUG is set
 * The fix really forces ldconfig to run immediately

[Test Case]

$ lxc launch ubuntu:bionic bb-glibc-upgrade
$ lxc shell bb-glibc-upgrade
# export LDCONFIG_TRIGGER_DEBUG=1
# apt update -qq && apt upgrade -qq -y && do-release-upgrade -d
...

With the broken version the following message can be observed:
..
Preparing to unpack .../libc6_2.31-0ubuntu9_amd64.deb ...

Progress: [ 38%]
ldconfig: wrapper deferring update (trigger activated)
...

The fixed version runs ldconfig immediately after unpacking libc6.

[Regression Potential]

* Very small, the fix is literally adding one single character to properly set LDCONFIG_NOTRIGGER. Running ldconfig immediately as originally planned does not seem to cause issues.

[Other Info]

Fix:
--- a/debian/debhelper.in/libc.preinst
+++ b/debian/debhelper.in/libc.preinst
@@ -22,7 +22,7 @@ kfreebsd_compare_versions () {
 # libcrypt1 breaks/replaces libc6 (<< 2.31). cannot use a pre-depends on libcrypt1
 # call ldconfig unconditionally for the first libc6 depending on libcrypt1
 if [ -n "$preversion" ] && dpkg --compare-versions "$preversion" lt 2.31-0ubuntu2; then
- LCONFIG_NOTRIGGER=y
+ LDCONFIG_NOTRIGGER=y
        export LDCONFIG_NOTRIGGER
        ldconfig || ldconfig --verbose
 fi

CVE References

Balint Reczey (rbalint)
Changed in glibc (Ubuntu):
assignee: nobody → Balint Reczey (rbalint)
Revision history for this message
Balint Reczey (rbalint) wrote :

18.04->20.04 upgrade breaks with the reproducer:

...

Preparing to unpack .../libc6_2.31-0ubuntu9_amd64.deb ...

Progress: [ 38%]
ldconfig: wrapper deferring update (trigger activated)
Checking for services that may need to be restarted...
Checking init scripts...
Checking for services that may need to be restarted...
Checking init scripts...
dpkg: error processing archive /var/cache/apt/archives/libc6_2.31-0ubuntu9_amd64.deb (--unpack):
 new libc6:amd64 package pre-installation script subprocess returned error exit status 20
Selecting previously unselected package libcrypt1:amd64.
dpkg: considering deconfiguration of libc6:amd64, which would be broken by installation of libcrypt1:amd64 ...
dpkg: yes, will deconfigure libc6:amd64 (broken by libcrypt1:amd64)
Preparing to unpack .../libcrypt1_1%3a4.4.10-10ubuntu4_amd64.deb ...
De-configuring libc6:amd64 (2.27-3ubuntu1.2) ...

Progress: [ 44%]
Unpacking libcrypt1:amd64 (1:4.4.10-10ubuntu4) ...
Replacing files in old package libc6:amd64 (2.27-3ubuntu1.2) ...

Progress: [ 50%]
Errors were encountered while processing:
 /var/cache/apt/archives/libc6_2.31-0ubuntu9_amd64.deb
ERROR: Cannot create report: [Errno 17] File exists: '/var/crash/libc6.0.crash'
Exception during pm.DoInstall(): E:Sub-process /usr/bin/dpkg returned an error code (1)

*** Send problem report to the developers?

After the problem report has been sent, please fill out the form in the
automatically opened web browser.

What would you like to do? Your options are:
  S: Send report (137.7 KB)
  V: View report
  K: Keep report file for sending later or copying to somewhere else
  I: Cancel and ignore future crashes of this program version
  C: Cancel
Please choose (S/V/K/I/C):
...

Balint Reczey (rbalint)
description: updated
Changed in glibc (Ubuntu Focal):
assignee: nobody → Balint Reczey (rbalint)
Balint Reczey (rbalint)
description: updated
description: updated
Revision history for this message
Robie Basak (racb) wrote :

> * Upgrade from Bionic to Focal may break if LDCONFIG_TRIGGER_DEBUG is set
> * The fix really forces ldconfig to run immediately

Please could you explain the impact of this bug in Xenial *to users*?

Doesn't this also need fixing in Groovy first? What's the status of that please?

Changed in glibc (Ubuntu Focal):
status: New → Incomplete
Revision history for this message
Balint Reczey (rbalint) wrote :

The bug is not present in Xenial.

The fix is in groovy-proposed, getting closer and closer to the release pocket.

I could not reproduce the issue without setting LDCONFIG_TRIGGER_DEBUG, but considering that this is a small fix and helps at least in debugging IMO backporting it is the right thing. If you disagree I'm open to dropping it from the SRU.

Revision history for this message
Robie Basak (racb) wrote :

Reading my own comment it doesn't make sense to me now. I must have confused Xenial and Focal. Sorry!

Revision history for this message
Robie Basak (racb) wrote : Please test proposed package

Hello Balint, or anyone else affected,

Accepted glibc into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glibc/2.31-0ubuntu9.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in glibc (Ubuntu Focal):
status: Incomplete → Fix Committed
tags: added: verification-needed verification-needed-focal
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (glibc/2.31-0ubuntu9.1)

All autopkgtests for the newly accepted glibc (2.31-0ubuntu9.1) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

prometheus-blackbox-exporter/0.13.0+ds-2 (armhf, amd64, ppc64el, s390x, arm64)
prometheus-pushgateway/1.0.0+ds-1 (armhf, amd64, ppc64el, s390x, arm64)
systemd/245.4-4ubuntu3.2 (s390x, amd64, ppc64el)
gfs2-utils/unknown (amd64)
hugo/0.68.3-1 (armhf, amd64, ppc64el, s390x, arm64)
grubzfs-testsuite/0.4.10 (amd64)
glibc/2.31-0ubuntu9.1 (armhf)
badger/2.0.1-3 (armhf, amd64, ppc64el, s390x, arm64)
resource-agents/1:4.5.0-2ubuntu2 (armhf)
etcd/3.2.26+dfsg-6 (amd64, ppc64el)
postgresql-multicorn/1.3.4-31-g9ff7875-3 (armhf, amd64, ppc64el, s390x)
gfs2-utils/3.2.0-3 (ppc64el, s390x, arm64)
scipy/1.3.3-3build1 (ppc64el)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#glibc

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Balint Reczey (rbalint) wrote :

Verified upgrading to 2.31-0ubuntu9.1, to Focal using a PPA where the packages were binary copied to.
...
Preparing to unpack .../locales_2.31-0ubuntu9.1_all.deb ...
Unpacking locales (2.31-0ubuntu9.1) over (2.27-3ubuntu1.2) ...
Preparing to unpack .../libc6_2.31-0ubuntu9.1_amd64.deb ...
Checking for services that may need to be restarted...
Checking init scripts...
Checking for services that may need to be restarted...
Checking init scripts...
...
Restart services during package upgrades without asking?
...
  cron: stopping...done.

Unpacking libc6:amd64 (2.31-0ubuntu9.1) over (2.27-3ubuntu1.2) ...
Selecting previously unselected package libcrypt1:amd64.
Preparing to unpack .../libcrypt1_1%3a4.4.10-10ubuntu4_amd64.deb ...
Unpacking libcrypt1:amd64 (1:4.4.10-10ubuntu4) ...
Setting up libcrypt1:amd64 (1:4.4.10-10ubuntu4) ...
Setting up libc6:amd64 (2.31-0ubuntu9.1) ...
Checking for services that may need to be restarted...
Checking init scripts...
Restarting services possibly affected by the upgrade:
  cron: restarting...done.
  rsync: restarting...done.
  atd: restarting...done.

Services restarted successfully.
...

tags: added: verification-done verification-done-focal
removed: verification-needed verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (8.2 KiB)

This bug was fixed in the package glibc - 2.32-0ubuntu3

---------------
glibc (2.32-0ubuntu3) groovy; urgency=medium

  * Fix cross-toolchain-base.
    Use ${Depends:foo=foo} magic to not create cross packages for
    libnss-nis*, rpcsvc-proto, libtirpc-dev and libnsl-dev (LP: #1895632)
  * XFAIL time/tst-cpuclock1 (LP: #1895687)

glibc (2.32-0ubuntu2) groovy; urgency=medium

  * Merge from Debian unstable
  * Refresh patches
  * debian/watch: Use HTTPS and download xz-compressed tarball
  * debian/watch: Use upstream's signing key to verify the tarball
  * Don't build and ship libnsl.a and Sun RPC static library and header files
  * XFAIL stdlib/tst-getrandom (LP: #1891403)
  * debian/symbols.wildcards: Update versions
  * Make libc-dev depend on rpcsvc-proto and libtirpc-dev.
    They replace development files for the Sun RPC library removed in glibc 32.
  * Make libc-dev depend on libnsl-dev.
    It replaces the development files for the new libnsl library replacing the
    one shipped by glibc.
  * Don't check symbols of libnss_nis.so and libnss_nisplus.so libraries.
    They are not shipped in glibc 2.32
  * Depend on libnss-nis and libnss-nisplus shipping the libraries dropped
    in 2.32
  * debian/patches/git-updates.diff: update from upstream stable branch:
    - x86-64: Fix FMA4 detection in ifunc
  * debian/testsuite-xfail-debian.mk: XFAIL unsupported tests failing in autopkgtest

glibc (2.31-3) unstable; urgency=medium

  [ Aurelien Jarno ]
  * debian/control.in/libc: add a Breaks: against openarena (<< 0.8.8+dfsg-4~)
    due to bug#966150.
  * debian/control.in/libc: add a Breaks: against ioquake3
    (<< 1.36+u20200211.f2c61c1~dfsg-2~) as previous versions are not correctly
    linked with libm.
  * debian/patches/git-updates.diff: update from upstream stable branch:
    - Fix an infinite loop in the iconv program (CVE-2016-10228). Closes:
      #856503.
    - debian/patches/any/submitted-selinux-deprecations.diff: upstreamed.
    - debian/patches/x32/submitted-fix-nptl-setgroups-x32.diff: upstreamed.
  * debian/rules.d/build.mk: install <finclude/math-vector-fortran.h> in the
    multiarch path. Closes: #962457.

  [ Samuel Thibault ]
  * debian/libc0.3.symbols.hurd-i386: Fix dependency of __errno_location and
    __h_errno_location symbols in libpthread.
  * patches/hurd-i386/unsubmitted-sbrk-_end.diff: Fix _end symbol appearance
    by reworking sbrk.
  * patches/hurd-i386/unsubmitted-sched_sets.diff: Add sched_set/getscheduler.
  * patches/hurd-i386/git-pthread_atfork-hidden.diff: Hide pthread_atfork
    symbols imported to applications, to avoid leaking them.

glibc (2.31-2ubuntu1) groovy; urgency=medium

  [ Michael Hudson-Doyle ]
  * Mark tst-getpw as XFAIL on arm64. (LP: #1869364)

  [ Balint Reczey ]
  * Merge from Debian unstable
    - debian/patches/any/submitted-selinux-deprecations.diff: proposed patch to
      ignore the selinux deprecations introduced in libselinux (>= 3.1), fixing
      an FTBFS. (LP: #1887919)
    Remaining changes:
    - Enable libc6{,-dev}-armel on armhf and libc6{-dev}-armhf on armel.
    - Heavily mangle the way we do service restarting on major upgrades.
    - Build amd64 with -O3, and b...

Read more...

Changed in glibc (Ubuntu):
status: New → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package glibc - 2.31-0ubuntu9.1

---------------
glibc (2.31-0ubuntu9.1) focal; urgency=medium

  [ Michael Hudson-Doyle ]
  * Mark tst-getpw as XFAIL on arm64. (LP: #1869364)

  [ Matthias Klose ]
  * Copy the fully conditionalized x86 variant for math-vector-fortran.h
    to /usr/include/finclude. On all architectures. (LP: #1879092)

  [ Balint Reczey ]
  * debian/gbp.conf: Add initial configuration
  * debian/control.in/main: Add Vcs-* pointing to Ubuntu packaging repository
  * debian/debhelper.in/libc.preinst: Fix setting LDCONFIG_NOTRIGGER
    (LP: #1889190)
  * Fall back to calling nanosleep syscall when __clock_nanosleep returns
    EINVAL due to CLOCK_REALTIME not being supported (LP: #1871129)
  * debian/testsuite-xfail-debian.mk: XFAIL tst-getpw on armhf, too
    (LP: #1869364)
  * XFAIL stdlib/tst-getrandom (LP: #1891403)

  [ Dimitri John Ledkov ]
  * debian/patches/powerpc: Cherrypick upstream patches to support POWER10
    optimized library loading. LP: #1887989

 -- Balint Reczey <email address hidden> Mon, 17 Aug 2020 22:02:52 +0200

Changed in glibc (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Update Released

The verification of the Stable Release Update for glibc has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.