** Description changed: + [ Impact ] + + The virtualisation stack has 2 variant base/HWE. HWE ships the same binary packages suffixed with "-hwe". These HWE binary packages + (e.g. libvirt-daemon-hwe, libvirt-daemon-log-hwe, ...) reuse the + exact same dynamically generated conffiles and system integration files + as their base counterparts: + + * systemd unit links under /etc/systemd/system/** -> /usr/lib/systemd/... + * apparmor local overrides under /etc/apparmor.d/local/* + * apparmor cache, disable and force-complain entries + * update-rc.d / init.d state + + Because both the base package and the HWE package own the same paths, + purging one package removes the files that the other one still relies + on. For example: + + $ apt install libvirt-daemon-log + $ apt install libvirt-daemon-log-hwe + $ apt purge libvirt-daemon-log + + leaves libvirt-daemon-log-hwe installed but broken: the shared + virtlogd systemd unit link is deleted by the base package's postrm, + so the daemon shipped by the HWE package no longer starts correctly. + + The same class of breakage happens in both directions (purging the HWE + package while the base package is installed) and affects several + packages across the interlinked HWE stack (libvirt, qemu, edk2, + seabios and their -hwe variants). + + As of now, only a subset of virt packages are affected by this issue. They are + mostly the packages that have dynamic conffiles (systemd service, ). + + However, the proposed fix cover all the packages in the virtualization set: + - seabios + - libvirt + - edk2 + - qemu + + to prevent this issue from happening in case we SRU an other fix that + makes use of a dynamic conffile. + + [ Test Plan ] + + On a clean Resolute system with the fixed packages installed: + + 1. Install a base package and its HWE counterpart: + $ sudo apt install libvirt-daemon-log + $ sudo apt install libvirt-daemon-log-hwe + + 2. Purge the base package: + $ sudo apt purge libvirt-daemon-log + + 3. Verify the HWE package is still fully functional, i.e. the shared + systemd unit link is still present and the daemon is usable: + $ systemctl status virtlogd + The unit must still be loaded (link under /usr/lib/systemd/system + intact) and startable. + + 4. Repeat the reverse direction (purge the -hwe package while the base + package is installed) and confirm the base package is unaffected. + + 5. Purge both packages and confirm the shared files are correctly + cleaned up (no leftover systemd links / apparmor local entries) once + no counterpart remains installed. + + [ Where problems could occur ] + + The fix inserts a snippet at the top of each package's postrm + (via execute_after_dh_installdeb in d/rules) that sources a shared + purge hook. On "purge", the hook skips the dpkg-maintscript purge + actions when the counterpart stack is still installed, deferring the + cleanup until the last of the base/HWE pair is removed. + + Risk areas: + + * The change only affects the maintainer scripts (postrm) and packaging + metadata; there is no change to the runtime binaries. A regression + would therefore manifest at install/upgrade/remove/purge time rather + than at runtime. + + * If the hook logic were wrong it could either (a) leave shared files + behind after both packages are purged, or (b) fail to protect the + counterpart. + + * The postrm snippet depends on ubuntu-helper-virt-hwe providing + /usr/share/ubuntu-helper-virt-hwe/ubuntu_virt_postrm_hook; a version + constraint on ubuntu-virt-hwe / ubuntu-helper-virt-hwe was added to + d/control(.in) to guarantee the hook is present. The snippet guards + the source with a file-existence test, so a missing helper degrades + to the previous behaviour rather than failing the postrm. + + + [ Other Info ] + + + --- Original bug report --- + Since libvirt-daemon-log-hwe have the same dynamic conffiles (systemd links, apparmor local) than libvirt-daemon-log When libvirt-daemon-log-hwe is installed, purging libvirt-daemon-log might break libvirt-daemon-log-hwe by removing the systemd unit links (/etc/systemd/system/** -> /usr/lib/). Other packages are also affected, for example libvirt-daemon. Here are the purge actions done by dh-* for libvirt-daemon in the postrm maintscript: ... update-rc.d libvirtd remove deb-systemd-helper purge 'libvirtd-admin.socket' 'libvirtd-ro.socket' 'libvirtd.socket' deb-systemd-helper purge 'libvirtd.service' >/dev/null rm -f "/etc/apparmor.d/disable/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/force-complain/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/local/usr.sbin.libvirtd" || true rm -f /var/cache/apparmor/*/"usr.sbin.libvirtd" || true rmdir /etc/apparmor.d/disable 2>/dev/null || true rmdir /etc/apparmor.d/local 2>/dev/null || true rmdir /etc/apparmor.d 2>/dev/null || true Steps to reproduce --- $ apt install libvirt-daemon-log $ apt install libvirt-daemon-log-hwe $ apt purge libvirt-daemon-log $ systemci status virtlogd ● virtlogd.service - libvirt logging daemon - Loaded: loaded (/usr/lib/systemd/system/virtlogd.service; disabled; preset: enabled) + Loaded: loaded (/usr/lib/systemd/system/virtlogd.service; disabled; preset: enabled)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164849 Title: purging libvirt-daemon when libvirt-daemon-hwe is installed breaks libvirt-daemon-hwe To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2164849/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
