Public bug reported:
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.5 LTS
Release: 22.04
Codename: jammy
$ pro --version
37.2ubuntu~22.04.1
by default with `pro enable fips-updates` the origin
`"${distro_id}FIPSUpdates:${distro_codename}-updates";` is not added to
`Allowed-Origins` in `/etc/apt/apt.conf.d/50unattended-upgrades`. This can
lead to non-fips packages such as openssh-client/openssh-server getting
installed and breaking authentication (i.e the non fips crypto algo is rejected
blocking authentication)
# Steps to reproduce and proposed fix
## Create a fresh VM
```
multipass launch jammy -n fips -d 50G
multipass shell fips
```
## Setup
```
sudo pro attach <TOKEN>
sudo pro enable --assume-yes fips-preview
sudo reboot
multipass shell fips
sudo pro enable --access-only --assume-yes fips-updates
sudo rm /etc/apt/preferences.d/ubuntu-fips-preview
sudo rm /etc/apt/sources.list.d/ubuntu-fips-preview.list
```
Note: this rimarole of enabling fips-preview then fips-updates is only
to get the system in a state where there is a newer FIPS package version
available.
```
$ apt-cache policy openssh-client
openssh-client:
Installed: 1:8.9p1-3ubuntu0.4+Fips3
Candidate: 1:8.9p1-3ubuntu0.16+Fips3
Version table:
1:8.9p1-3ubuntu0.16+Fips3 1001
1001 https://esm.ubuntu.com/fips-updates/ubuntu jammy-updates/main amd64
Packages
1:8.9p1-3ubuntu0.16 500
500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
*** 1:8.9p1-3ubuntu0.4+Fips3 100
100 /var/lib/dpkg/status
1:8.9p1-3 500
500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
```
Now, by default with `pro enable fips-updates` the origin
`"${distro_id}FIPSUpdates:${distro_codename}-updates";` is not added to
`Allowed-Origins` in `/etc/apt/apt.conf.d/50unattended-upgrades`.
```
$ grep -A12 "Unattended-Upgrade::Allowed-Origins"
/etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}";
"${distro_id}:${distro_codename}-security";
// Extended Security Maintenance; doesn't necessarily exist for
// every release and this system may not have it installed, but if
// available, the policy for updates is such that unattended-upgrades
// should also install from here by default.
"${distro_id}ESMApps:${distro_codename}-apps-security";
"${distro_id}ESM:${distro_codename}-infra-security";
// "${distro_id}:${distro_codename}-updates";
// "${distro_id}:${distro_codename}-proposed";
// "${distro_id}:${distro_codename}-backports";
};
```
## Trigger the bug
Now trigger unattended updates
```
sudo unattended-upgrades -d
```
the non-FIPS version of a package gets installed
```
$ apt-cache policy openssh-client
openssh-client:
Installed: 1:8.9p1-3ubuntu0.16
Candidate: 1:8.9p1-3ubuntu0.16+Fips3
Version table:
1:8.9p1-3ubuntu0.16+Fips3 1001
1001 https://esm.ubuntu.com/fips-updates/ubuntu jammy-updates/main amd64
Packages
*** 1:8.9p1-3ubuntu0.16 500
500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
100 /var/lib/dpkg/status
1:8.9p1-3 500
500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
```
## Hypothesis
Normally `unattended-upgrades` will respect the pinning
```
$ cat /etc/apt/preferences.d/ubuntu-fips-updates
Package: *
Pin: release o=UbuntuFIPSUpdates
Pin-Priority: 1001
```
but since `unattended-upgrades` dynamically pins `-32768` to packages in
not allowed origins. Thus, it sees there's a higher version available in
a pinned repo, but it installs from the allowed origin since the pin was
superceeded.
## Proposed fix
Add `"${distro_id}FIPSUpdates:${distro_codename}-updates";` to `Allowed-
Origins` in `/etc/apt/apt.conf.d/50unattended-upgrades`. For example
```
FIPS_ORIGIN='"${distro_id}FIPSUpdates:${distro_codename}-updates";'
sudo sed -i "/Unattended-Upgrade::Allowed-Origins {/a \ \ \ \ \ \ \ \
$FIPS_ORIGIN" "/etc/apt/apt.conf.d/50unattended-upgrades"
```
then `unattended-upgrades` will not apply a negative pin to fips and
install the correct version
```
sudo unattended-upgrades -d
```
tada
```
$ apt-cache policy openssh-client
openssh-client:
Installed: 1:8.9p1-3ubuntu0.16+Fips3
Candidate: 1:8.9p1-3ubuntu0.16+Fips3
Version table:
*** 1:8.9p1-3ubuntu0.16+Fips3 1001
1001 https://esm.ubuntu.com/fips-updates/ubuntu jammy-updates/main amd64
Packages
100 /var/lib/dpkg/status
1:8.9p1-3ubuntu0.16 500
500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
1:8.9p1-3 500
500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
```
### Related
This feels like is more working around some **intended** awkward
behavior in `unattended-upgrades` but maybe that needs to be revisited.
[1] -
https://askubuntu.com/questions/1515902/how-to-get-unattended-upgrade-to-obey-apt-pinned-packages
[2] - https://bugs.launchpad.net/ubuntu/+source/unattended-upgrades/+bug/2033646
** Affects: ubuntu-advantage-tools (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165412
Title:
The origin `"${distro_id}FIPSUpdates:${distro_codename}-updates";` is
not added to `Allowed-Origins` in `/etc/apt/apt.conf.d/50unattended-
upgrades` by pro enable fips-updates
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2165412/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
