Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Christoph Martin]

Am 14.05.24 um 10:39 schrieb Vincent Lefevre:


This could explain the error.

I'm wondering why apt plays with the permissions. This is confusing.
Or should there be a locking mechanism?



This reminds me about the long due rewrite to use the apt-API to access 
these files and not read them directly.


OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Vincent Lefevre]

On 2024-05-14 09:47:02 +0200, Christoph Martin wrote:
> You could try to prepend strace to your cron call like:
> 
> strace -o /tmp/asv.$$ -e trace=file apt-show-versions -u
> 
> and look for the failed syscall.

The issue is that this is not reproducible, but see below.

> Did you look for selinux or apparmor messages in syslog?

No messages in the journalctl output.

The failure occurred on 2024-05-11 00:04:01 +0200.
In the journalctl output:

May 11 00:03:49 qaa su[315536]: (to root) vinc17 on pts/18
May 11 00:03:49 qaa su[315536]: pam_unix(su:session): session opened for user 
root(uid=0) by vinc17(uid=1000)
May 11 00:03:55 qaa accounts-daemon[1127]: Language 'C.utf8' set for user 
vinc17 is invalid
May 11 00:04:01 qaa CRON[316214]: pam_unix(cron:session): session opened for 
user vinc17(uid=1000) by vinc17(uid=0)
May 11 00:04:01 qaa CRON[316215]: (vinc17) CMD (apt-show-versions -u | grep 
manually)
May 11 00:04:01 qaa CRON[316214]: pam_unix(cron:session): session closed for 
user vinc17
May 11 00:04:01 qaa postfix/pickup[314458]: 6682BCA011C: uid=1000 from=
May 11 00:04:01 qaa postfix/cleanup[316242]: 6682BCA011C: 
message-id=<20240510220401.6682bca0...@qaa.vinc17.org>
May 11 00:04:01 qaa postfix/qmgr[2011]: 6682BCA011C: from=, 
size=750, nrcpt=1 (queue active)
May 11 00:04:01 qaa postfix/local[316244]: 6682BCA011C: 
to=, orig_to=, relay=local, delay=0.05, 
delays=0.03/0/0/0.02, dsn=2.0.0, status=sent (delivered to command: procmail -a 
"$EXTENSION")
May 11 00:04:01 qaa postfix/qmgr[2011]: 6682BCA011C: removed

Indeed, I have in my crontab:

4 */6 * * * apt-show-versions -u | grep manually

The mail message is due to the error (normally, there is none).

I logged as root a few seconds before, for an upgrade. I can see
in /var/log/apt/term.log:

Log started: 2024-05-11  00:13:28
[...]

So, perhaps I did an "apt update" around 00:04, and I can see with
"strace -f -o str.out apt update":

914566 
chmod("/var/lib/apt/lists/debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease",
 0600) = 0

before doing later

914566 
chmod("/var/lib/apt/lists/debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease",
 0644 

This could explain the error.

I'm wondering why apt plays with the permissions. This is confusing.
Or should there be a locking mechanism?

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Vincent Lefevre]

On 2024-05-13 15:34:31 +0200, Vincent Lefevre wrote:
> > Which user does the cronjob run with?
> 
> root, AFAIK (the mail was from root).

Actually by the user (vinc17, i.e. me). I shouldn't have looked
at the "From:" header of the mail for that. Anyway, this shouldn't
matter because the permissions are "-rw-r--r--".

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Christoph Martin]

Hi Vincent,

Am 13.05.24 um 19:59 schrieb Vincent Lefevre:

On 2024-05-13 17:12:57 +0200, Christoph Martin wrote:


Please try to access the file e.g. 'less 
/var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease'


No problems.



You could try to prepend strace to your cron call like:

strace -o /tmp/asv.$$ -e trace=file apt-show-versions -u

and look for the failed syscall.

Did you look for selinux or apparmor messages in syslog?

Christoph


OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Vincent Lefevre]

On 2024-05-13 17:12:57 +0200, Christoph Martin wrote:
> Hi Vincent,
> 
> Am 13.05.24 um 15:34 schrieb Vincent Lefevre:
> 
> > > > I don't know why could cause the error, but the pathname with "//"
> > > > is incorrect.
> > > 
> > > // in the path should not be a problem.
> > 
> > zsh completion cannot handle it, so I was wondering.
> 
> Please try to access the file e.g. 'less 
> /var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease'

No problems.

> > > Can you do a 'ls -l /var/lib/apt/lists/' to see the permissions?
> > 
> > lrwxrwxrwx 1 root root   25 2024-05-11 22:36:06 
> > _var_local_apt_._Packages -> /var/local/apt/./Packages
> > drwxr-xr-x 2 _apt root 4096 2023-10-07 13:42:54 auxfiles
> > -rw-r--r-- 1 root root52957 2024-05-11 16:15:34 
> > debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_InRelease
> > -rw-r--r-- 1 root root   308541 2024-05-08 22:34:42 
> > debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_main_binary-amd64_Packages
> > -rw-r--r-- 1 root root49779 2024-02-10 12:17:11 
> > debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
> > -rw-r--r-- 1 root root 14314273 2024-02-10 10:44:17 
> > debug.mirrors.debian.org_debian-debug_dists_stable-debug_main_binary-amd64_Packages
> 
> What is _var_local_apt_._Packages?

Perhaps because on my local repository:

deb [trusted=yes] file:///var/local/apt ./

> Can you access this files content?

Yes, the file can be read.

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Christoph Martin]

Hi Vincent,

Am 13.05.24 um 15:34 schrieb Vincent Lefevre:


I don't know why could cause the error, but the pathname with "//"
is incorrect.


// in the path should not be a problem.


zsh completion cannot handle it, so I was wondering.


Please try to access the file e.g. 'less 
/var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease'



Can you do a 'ls -l /var/lib/apt/lists/' to see the permissions?


lrwxrwxrwx 1 root root   25 2024-05-11 22:36:06 _var_local_apt_._Packages 
-> /var/local/apt/./Packages
drwxr-xr-x 2 _apt root 4096 2023-10-07 13:42:54 auxfiles
-rw-r--r-- 1 root root52957 2024-05-11 16:15:34 
debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_InRelease
-rw-r--r-- 1 root root   308541 2024-05-08 22:34:42 
debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_main_binary-amd64_Packages
-rw-r--r-- 1 root root49779 2024-02-10 12:17:11 
debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
-rw-r--r-- 1 root root 14314273 2024-02-10 10:44:17 
debug.mirrors.debian.org_debian-debug_dists_stable-debug_main_binary-amd64_Packages


What is _var_local_apt_._Packages?

Can you access this files content?

Apart from that, I can't spot a problem.

Christoph


OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Vincent Lefevre]

Hi Christoph,

On 2024-05-13 15:20:28 +0200, Christoph Martin wrote:
> Am 11.05.24 um 11:53 schrieb Vincent Lefevre:
> > Package: apt-show-versions
> > Version: 0.22.15
> > Severity: normal
> > 
> > When running "apt-show-versions -u" in a cron script, I got
> > 
> > Failed to open file 
> > /var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
> >  for reading: Permission denied
> > 
> > I don't know why could cause the error, but the pathname with "//"
> > is incorrect.
> 
> // in the path should not be a problem.

zsh completion cannot handle it, so I was wondering.

> Can you do a 'ls -l /var/lib/apt/lists/' to see the permissions?

lrwxrwxrwx 1 root root   25 2024-05-11 22:36:06 _var_local_apt_._Packages 
-> /var/local/apt/./Packages
drwxr-xr-x 2 _apt root 4096 2023-10-07 13:42:54 auxfiles
-rw-r--r-- 1 root root52957 2024-05-11 16:15:34 
debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_InRelease
-rw-r--r-- 1 root root   308541 2024-05-08 22:34:42 
debug.mirrors.debian.org_debian-debug_dists_proposed-updates-debug_main_binary-amd64_Packages
-rw-r--r-- 1 root root49779 2024-02-10 12:17:11 
debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
-rw-r--r-- 1 root root 14314273 2024-02-10 10:44:17 
debug.mirrors.debian.org_debian-debug_dists_stable-debug_main_binary-amd64_Packages
-rw-r--r-- 1 root root56601 2024-05-11 16:15:45 
debug.mirrors.debian.org_debian-debug_dists_unstable-debug_InRelease
-rw-r--r-- 1 root root11867 2024-05-11 16:07:07 
debug.mirrors.debian.org_debian-debug_dists_unstable-debug_main_Contents-amd64.lz4
-rw-r--r-- 1 root root 15598917 2024-05-11 16:07:09 
debug.mirrors.debian.org_debian-debug_dists_unstable-debug_main_binary-amd64_Packages
-rw-r--r-- 1 root root12615 2024-05-11 16:07:07 
debug.mirrors.debian.org_debian-debug_dists_unstable-debug_main_i18n_Translation-en
-rw-r--r-- 1 root root   101035 2024-05-11 16:15:38 
ftp.debian.org_debian_dists_experimental_InRelease
-rw-r--r-- 1 root root  6832935 2024-05-11 16:10:22 
ftp.debian.org_debian_dists_experimental_main_Contents-all.lz4
-rw-r--r-- 1 root root  2536358 2024-05-11 16:10:42 
ftp.debian.org_debian_dists_experimental_main_Contents-amd64.lz4
-rw-r--r-- 1 root root  3972604 2024-05-11 16:10:44 
ftp.debian.org_debian_dists_experimental_main_binary-amd64_Packages
-rw-r--r-- 1 root root  2424480 2024-05-11 16:10:15 
ftp.debian.org_debian_dists_experimental_main_i18n_Translation-en
-rw-r--r-- 1 root root  3112151 2024-05-11 16:11:36 
ftp.debian.org_debian_dists_experimental_main_source_Sources
-rw-r--r-- 1 root root55443 2024-05-11 16:15:26 
ftp.debian.org_debian_dists_stable-updates_InRelease
-rw-r--r-- 1 root root  317 2024-02-16 21:02:45 
ftp.debian.org_debian_dists_stable-updates_contrib_Contents-amd64.lz4
-rw-r--r-- 1 root root 1224 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_contrib_binary-amd64_Packages
-rw-r--r-- 1 root root  538 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_contrib_i18n_Translation-en
-rw-r--r-- 1 root root 1251 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_contrib_source_Sources
-rw-r--r-- 1 root root   351371 2023-12-29 15:14:53 
ftp.debian.org_debian_dists_stable-updates_main_Contents-all.lz4
-rw-r--r-- 1 root root   429325 2024-04-23 22:45:52 
ftp.debian.org_debian_dists_stable-updates_main_Contents-amd64.lz4
-rw-r--r-- 1 root root73340 2024-04-23 22:45:52 
ftp.debian.org_debian_dists_stable-updates_main_binary-amd64_Packages
-rw-r--r-- 1 root root90213 2024-04-23 22:45:51 
ftp.debian.org_debian_dists_stable-updates_main_i18n_Translation-en
-rw-r--r-- 1 root root   333130 2024-04-23 22:46:05 
ftp.debian.org_debian_dists_stable-updates_main_source_Sources
-rw-r--r-- 1 root root  361 2024-02-16 21:02:46 
ftp.debian.org_debian_dists_stable-updates_non-free-firmware_Contents-amd64.lz4
-rw-r--r-- 1 root root 1446 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_non-free-firmware_binary-amd64_Packages
-rw-r--r-- 1 root root  696 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_non-free-firmware_i18n_Translation-en
-rw-r--r-- 1 root root12123 2024-02-16 21:01:38 
ftp.debian.org_debian_dists_stable-updates_non-free-firmware_source_Sources
-rw-r--r-- 1 root root27884 2024-02-16 21:02:46 
ftp.debian.org_debian_dists_stable-updates_non-free_Contents-amd64.lz4
-rw-r--r-- 1 root root   101751 2024-02-16 21:01:39 
ftp.debian.org_debian_dists_stable-updates_non-free_binary-amd64_Packages
-rw-r--r-- 1 root root64597 2024-02-16 21:01:39 
ftp.debian.org_debian_dists_stable-updates_non-free_i18n_Translation-en
-rw-r--r-- 1 root root 6231 2024-02-16 21:01:39 
ftp.debian.org_debian_dists_stable-updates_non-free_source_Sources
-rw-r--r-- 1 root root   151082 2024-02-10 12:17:10 
ftp.debian.org_debian_dists_stable_InRelease
-rw-r--r-- 1 root root   166896 2023-05-23 22:01:16 
ftp.debian.org_de

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Christoph Martin]

Hi Vincent,

Am 11.05.24 um 11:53 schrieb Vincent Lefevre:

Package: apt-show-versions
Version: 0.22.15
Severity: normal

When running "apt-show-versions -u" in a cron script, I got

Failed to open file 
/var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
 for reading: Permission denied

I don't know why could cause the error, but the pathname with "//"
is incorrect.



// in the path should not be a problem. Can you do a 'ls -l 
/var/lib/apt/lists/' to see the permissions?


Which user does the cronjob run with?

Christoph


OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1070891: apt-show-versions: Permission denied on a bad pathname

[Vincent Lefevre]

Package: apt-show-versions
Version: 0.22.15
Severity: normal

When running "apt-show-versions -u" in a cron script, I got

Failed to open file 
/var/lib/apt/lists//debug.mirrors.debian.org_debian-debug_dists_stable-debug_InRelease
 for reading: Permission denied

I don't know why could cause the error, but the pathname with "//"
is incorrect.

-- System Information:
Debian Release: trixie/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 
'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), 
(500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.7.12-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apt-show-versions depends on:
ii  apt  2.9.2
ii  libapt-pkg-perl  0.1.40+b5
ii  perl [libstorable-perl]  5.38.2-4

apt-show-versions recommends no packages.

apt-show-versions suggests no packages.

-- no debconf information

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)