6

(N.B. in the below, I have replaced the domain of my VPS hosting provider with <my_hosting_provider>, for privacy.)

My Debian 9.3 "Stretch" instance is showing a kernel update as being available:

# apt list --upgradable -a
Listing... Done
linux-image-amd64/stable 4.9+80+deb9u3 amd64 [upgradable from: 4.9+80+deb9u2]
linux-image-amd64/stable,now 4.9+80+deb9u2 amd64 [installed,upgradable to: 4.9+80+deb9u3]

I believe 4.9+80+deb9u3 is the same as 4.9.65-3+deb9u2, a recent kernel security update intended to address CVE-2017-5754, aka Meltdown.

Default config fails to install kernel security update

The default contents of Unattended-Upgrade::Origins-Pattern in /etc/apt/apt.conf.d/50unattended-upgrades is:

Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

With that configuration in place, the kernel security update fails to be installed:

# unattended-upgrades -v -d
Initial blacklisted packages: 
Initial whitelisted packages: 
Starting unattended upgrades script
Allowed origins are: ['origin=Debian,codename=stretch,label=Debian-Security']
Checking: linux-image-amd64 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'mirror.<my_hosting_provider>.com' isTrusted:True>])
pkg 'firmware-linux-free' not in allowed origin
sanity check failed
pkgs that look like they should be upgraded: 
Fetched 0 B in 0s (0 B/s)                                                                                                                                               
fetch.run() result: 0
blacklist: []
whitelist: []
Packages that will be upgraded: 
InstCount=0 DelCount=0 BrokenCount=0
Extracting content from '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log' since '2018-01-05 13:11:22'
Sending mail to 'root'
mail returned: 0

Modified config installs kernel security update

If I change Unattended-Upgrade::Origins-Pattern in /etc/apt/apt.conf.d/50unattended-upgrades to read

Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian";
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

then the security update is found and installed:

# unattended-upgrades -v -d
Initial blacklisted packages: 
Initial whitelisted packages: 
Starting unattended upgrades script
Allowed origins are: ['origin=Debian,codename=stretch,label=Debian', 'origin=Debian,codename=stretch,label=Debian-Security']
Checking: linux-image-amd64 ([<Origin component:'main' archive:'stable' origin:'Debian' label:'Debian-Security' site:'mirror.<my_hosting_provider>.com' isTrusted:True>])
pkgs that look like they should be upgraded: linux-image-amd64
Fetched 0 B in 0s (0 B/s)                                                                                                                                               
fetch.run() result: 0
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 19196 DestFile:'/var/cache/apt/archives/firmware-linux-free_3.4_all.deb' DescURI: 'http://mirror.<my_hosting_provider>.com/debian/pool/main/f/firmware-free/firmware-linux-free_3.4_all.deb' ID:0 ErrorText: ''>
check_conffile_prompt('/var/cache/apt/archives/firmware-linux-free_3.4_all.deb')
No conffiles in deb '/var/cache/apt/archives/firmware-linux-free_3.4_all.deb' (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 33252 DestFile:'/var/cache/apt/archives/libnuma1_2.0.11-2.1_amd64.deb' DescURI: 'http://mirror.<my_hosting_provider>.com/debian/pool/main/n/numactl/libnuma1_2.0.11-2.1_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt('/var/cache/apt/archives/libnuma1_2.0.11-2.1_amd64.deb')
No conffiles in deb '/var/cache/apt/archives/libnuma1_2.0.11-2.1_amd64.deb' (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 38768102 DestFile:'/var/cache/apt/archives/linux-image-4.9.0-5-amd64_4.9.65-3+deb9u2_amd64.deb' DescURI: 'http://mirror.<my_hosting_provider>.com/debian-security/pool/updates/main/l/linux/linux-image-4.9.0-5-amd64_4.9.65-3+deb9u2_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt('/var/cache/apt/archives/linux-image-4.9.0-5-amd64_4.9.65-3+deb9u2_amd64.deb')
No conffiles in deb '/var/cache/apt/archives/linux-image-4.9.0-5-amd64_4.9.65-3+deb9u2_amd64.deb' (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 6994 DestFile:'/var/cache/apt/archives/linux-image-amd64_4.9+80+deb9u3_amd64.deb' DescURI: 'http://mirror.<my_hosting_provider>.com/debian-security/pool/updates/main/l/linux-latest/linux-image-amd64_4.9+80+deb9u3_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt('/var/cache/apt/archives/linux-image-amd64_4.9+80+deb9u3_amd64.deb')
found pkg: linux-image-amd64
No conffiles in deb '/var/cache/apt/archives/linux-image-amd64_4.9+80+deb9u3_amd64.deb' (There is no member named 'conffiles')
<apt_pkg.AcquireItem object:Status: 2 Complete: 1 Local: 1 IsTrusted: 1 FileSize: 40396 DestFile:'/var/cache/apt/archives/irqbalance_1.1.0-2.3_amd64.deb' DescURI: 'http://mirror.<my_hosting_provider>.com/debian/pool/main/i/irqbalance/irqbalance_1.1.0-2.3_amd64.deb' ID:0 ErrorText: ''>
check_conffile_prompt('/var/cache/apt/archives/irqbalance_1.1.0-2.3_amd64.deb')
blacklist: []
whitelist: []
Packages that will be upgraded: linux-image-amd64
Writing dpkg log to '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log'
apt-listchanges: Reading changelogs...
Preconfiguring packages ...
Selecting previously unselected package firmware-linux-free.
(Reading database ... 45465 files and directories currently installed.)
Preparing to unpack .../firmware-linux-free_3.4_all.deb ...
Unpacking firmware-linux-free (3.4) ...
Selecting previously unselected package libnuma1:amd64.
Preparing to unpack .../libnuma1_2.0.11-2.1_amd64.deb ...
Unpacking libnuma1:amd64 (2.0.11-2.1) ...
Selecting previously unselected package linux-image-4.9.0-5-amd64.
Preparing to unpack .../linux-image-4.9.0-5-amd64_4.9.65-3+deb9u2_amd64.deb ...
Unpacking linux-image-4.9.0-5-amd64 (4.9.65-3+deb9u2) ...
Preparing to unpack .../linux-image-amd64_4.9+80+deb9u3_amd64.deb ...
Unpacking linux-image-amd64 (4.9+80+deb9u3) over (4.9+80+deb9u2) ...
Selecting previously unselected package irqbalance.
Preparing to unpack .../irqbalance_1.1.0-2.3_amd64.deb ...
Unpacking irqbalance (1.1.0-2.3) ...
Setting up libnuma1:amd64 (2.0.11-2.1) ...
Setting up linux-image-4.9.0-5-amd64 (4.9.65-3+deb9u2) ...
I: /vmlinuz.old is now a symlink to boot/vmlinuz-4.9.0-4-amd64
I: /initrd.img.old is now a symlink to boot/initrd.img-4.9.0-4-amd64
I: /vmlinuz is now a symlink to boot/vmlinuz-4.9.0-5-amd64
I: /initrd.img is now a symlink to boot/initrd.img-4.9.0-5-amd64
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-4.9.0-5-amd64
/etc/kernel/postinst.d/zz-update-grub:
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-4.9.0-5-amd64
Found initrd image: /boot/initrd.img-4.9.0-5-amd64
Found linux image: /boot/vmlinuz-4.9.0-4-amd64
Found initrd image: /boot/initrd.img-4.9.0-4-amd64
Found linux image: /boot/vmlinuz-4.9.0-3-amd64
Found initrd image: /boot/initrd.img-4.9.0-3-amd64
done
Setting up linux-image-amd64 (4.9+80+deb9u3) ...
Processing triggers for libc-bin (2.24-11+deb9u1) ...
Processing triggers for systemd (232-25+deb9u1) ...
Setting up firmware-linux-free (3.4) ...
update-initramfs: deferring update (trigger activated)
Processing triggers for man-db (2.7.6.1-2) ...
Setting up irqbalance (1.1.0-2.3) ...
Processing triggers for initramfs-tools (0.130) ...
update-initramfs: Generating /boot/initrd.img-4.9.0-5-amd64
Processing triggers for systemd (232-25+deb9u1) ...
All upgrades installed
InstCount=0 DelCount=0 BrokenCount=0
Extracting content from '/var/log/unattended-upgrades/unattended-upgrades-dpkg.log' since '2018-01-05 13:24:35'
Sending mail to 'root'
mail returned: 0
Found /var/run/reboot-required, rebooting

Questions

  • In relation to the failure to install security updates with the default configuration, should I file a bug against some part of Debian, or was it expected behaviour (and if so, why)?
  • I only want unattended-upgrades to perform security updates. How can I achieve this, given that the default configuration did not succeed?
4
  • Even doing it manually a new kernel version is often not detected. unattended-upgrades also comes with additional risks in production machines. The possibility of things going wrong is not negligible. Jan 5, 2018 at 14:11
  • 1
    @RuiFRibeiro, life isn't perfect ;) But unattended-upgrades is widely used, and works most of the time. If you are able to actually answer the questions I posted, I would be grateful. For instance, in this case, the kernel update was detected "by hand" and was detected by the modified unattended-upgrades config. It just was not detected by the default config. As I asked above, is that a bug, or expected?
    – user6860
    Jan 5, 2018 at 14:17
  • 2
    It is better to send a bug report , because this an important security update, to install the new kernel you can see this question and answer on U&L.
    – GAD3R
    Jan 5, 2018 at 14:27
  • 1
    I do agree with @GAD3R something is amiss. File a bug report. Given than often you have minor releases, I have no idea wether having only the security repo is enough though. Usually I use both. Jan 5, 2018 at 14:33

2 Answers 2

5

Based upon feedback in the comments above, this appears to be a bug.

A corresponding bug report has now been filed here.

1

With stretch, unattended-upgrades are only started between 6am and 7am. From the NEWS file of the apt package:

apt (1.4.2) unstable; urgency=medium

If periodic updates and unattended upgrades are enabled, the start of periodic updates are now distributed over 24 hour intervals (as in 1.2 to 1.4), whereas starting unattended-upgrade has been restricted to a time between 6 and 7 am. This only affects systems using systemd, other systems still use the classical hourly cron job.

-- Julian Andres Klode Thu, 04 May 2017 22:54:02 +0200

1
  • 1
    Welcome on the Unix SE! Good start. :-)
    – peterh
    Aug 4, 2018 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy