Debian Bug report logs - #781257
snmp: preinst kills all processes of user snmp

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Christian Seiler <christian@iwakd.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: snmp: preinst kills all processes of user snmp

Date: Thu, 26 Mar 2015 15:39:52 +0100

Package: snmp
Version: 5.7.2.1~dfsg-7
Severity: important

Dear Maintainers,

The preinst script of the 'snmp' (client tools) package contains the
following code (if 'install' or 'upgrade' is passed):

killall -u snmp 2>/dev/null || true

This was added here:
http://anonscm.debian.org/cgit/pkg-net-snmp/pkg-net-snmp.git/commit/debian/snmp.preinst?id=020a681ccee806a6adac6f4a1052132b0b21aad3

This, however, has some unfortunate problems (in ascending order of
importance):

1. This produces a lintian warning for precisely this reason:
https://lintian.debian.org/maintainer/pkg-net-snmp-devel@lists.alioth.debian.org.html#net-snmp

2. The snmp user is created by the 'snmpd' package, not by the 'snmp'
package, and there's no dependency between those packages, i.e. the
snmp user need not exist on systems with just 'snmp' installed.

3. Even worse, if installed on a system where snmpd is already running,
the preinst script will kill the running snmpd, without restarting it.
And since this is a simple SIGTERM, snmpd exits cleanly, making it
more unlikely that you notice that immediately.

4. Also, similar to the issue reported in #727105, this will kill any
processes running in containers that have the same numeric uid as snmp
on the host. In my case, this killed a cyrus instance running in a LXC
while I was just installing the (presumably harmless) snmp client tools
on the host, because the cyrus user inside the LXC had the same UID as
the snmp user outside.

5. And finally: why is this even done? I simply don't see the point of
doing this... The commit message in git doesn't describe the need for
this change, and I can't imagine any scenario for this: snmp contains a
bunch of client utilities and shouldn't have anything directly to do
with the SNMP server, so why start killing the server process and
subagents it started? Especially if the server isn't restarted in
postinst. I just don't get it.

The way I see it, it would probably best to just revert this change.
But if for some reason in some corner case snmpd actually has to be
restarted when the snmp package is installed, then please do that with
invoke-rc.d (and also restart it in postinst) and not with killall -u.

Thank you for your consideration,
Christian

PS: Note that there's a bug open in Ubuntu about the same issue for
quite some time now about the very same issue:
https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1245604

PPS: I was really tempted to report this as RC, but left it at
'important' for now.

-- System Information:
Debian Release: 8.0
  APT prefers testing
  APT policy: (500, 'testing'), (100, 'experimental'), (100, 
'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)

Versions of packages snmp depends on:
ii  libc6         2.19-15
ii  libsnmp-base  5.7.2.1~dfsg-7
ii  libsnmp30     5.7.2.1~dfsg-7
ii  libssl1.0.0   1.0.1k-1

Versions of packages snmp recommends:
ii  perl-modules  5.20.2-2

snmp suggests no packages.

-- no debconf information

Message #10 received at 781257@bugs.debian.org (full text, mbox, reply):

From: Christian Seiler <christian@iwakd.de>

To: 781257@bugs.debian.org

Subject: Re: snmp: preinst kills all processes of user snmp

Date: Fri, 10 Apr 2015 20:44:00 +0200

Dear Maintainers,

ping? Any comments on this?

Thanks,
Christian

Message #15 received at 781257@bugs.debian.org (full text, mbox, reply):

From: Robie Basak <robie.basak@ubuntu.com>

To: 781257@bugs.debian.org

Subject: Re: snmp: preinst kills all processes of user snmp

Date: Thu, 8 Oct 2015 13:15:12 +0100

On Thu, Mar 26, 2015 at 03:39:52PM +0100, Christian Seiler wrote:
> 5. And finally: why is this even done? I simply don't see the point of
> doing this... The commit message in git doesn't describe the need for
> this change, and I can't imagine any scenario for this: snmp contains a
> bunch of client utilities and shouldn't have anything directly to do
> with the SNMP server, so why start killing the server process and
> subagents it started? Especially if the server isn't restarted in
> postinst. I just don't get it.

> The way I see it, it would probably best to just revert this change.
> But if for some reason in some corner case snmpd actually has to be
> restarted when the snmp package is installed, then please do that with
> invoke-rc.d (and also restart it in postinst) and not with killall -u.

Looks like this was done in response to
https://launchpad.net/bugs/573391 in Ubuntu, and Debian merged that
change.

But since
http://anonscm.debian.org/cgit/pkg-net-snmp/pkg-net-snmp.git/commit/debian/snmpd.postinst?id=d96adf57b662ca601f9c4deb0a7a43e679272fcb
deluser isn't even called any more. So I don't think the killall is
necessary anymore anyway, but I'd like someone to review this.

Robie

Message #20 received at 781257@bugs.debian.org (full text, mbox, reply):

From: Christian Ehrhardt <christian.ehrhardt@canonical.com>

To: 781257@bugs.debian.org

Subject: Re: snmp: preinst kills all processes of user snmp

Date: Fri, 9 Oct 2015 13:30:40 +0200

[Message part 1 (text/plain, inline)]

tags 781257 +patch
thanks

It turns out that the original motivation why the killall was added is gone.
These days the install scripts no more call deluser (only snmpd.postrm).

So we can just remove the killall introduced by Ubuntu LP: #573391 to fix
LP: #1245604 and Debian Bug #781257

FYI - I'm uploading a comparable fix to the Ubuntu LP to fix it as well
until we merge again.

[diffstat]
 snmp.preinst |    2 --
 1 file changed, 2 deletions(-

diff --git a/debian/snmp.preinst b/debian/snmp.preinst
index 8f8c754..a9e7b87 100644
--- a/debian/snmp.preinst
+++ b/debian/snmp.preinst
@@ -12,8 +12,6 @@ install|upgrade)
     rm -rf /usr/doc/snmp
   fi

-  killall -u snmp 2>/dev/null || true
-
   ;;
 abort-upgrade)
   ;;

[Message part 2 (text/html, inline)]

Message #29 received at 781257-close@bugs.debian.org (full text, mbox, reply):

From: sesse@debian.org (Steinar H. Gunderson)

To: 781257-close@bugs.debian.org

Subject: Bug#781257: fixed in net-snmp 5.7.3+dfsg-1.1

Date: Tue, 29 Mar 2016 21:59:52 +0000

Source: net-snmp
Source-Version: 5.7.3+dfsg-1.1

We believe that the bug you reported is fixed in the latest version of
net-snmp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 781257@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steinar H. Gunderson <sesse@debian.org> (supplier of updated net-snmp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 29 Mar 2016 10:30:24 +0200
Source: net-snmp
Binary: snmpd snmptrapd snmp libsnmp-base libsnmp30 libsnmp30-dbg libsnmp-dev libsnmp-perl python-netsnmp tkmib
Architecture: source all amd64
Version: 5.7.3+dfsg-1.1
Distribution: unstable
Urgency: medium
Maintainer: Net-SNMP Packaging Team <pkg-net-snmp-devel@lists.alioth.debian.org>
Changed-By: Steinar H. Gunderson <sesse@debian.org>
Description:
 libsnmp-base - SNMP configuration script, MIBs and documentation
 libsnmp-dev - SNMP (Simple Network Management Protocol) development files
 libsnmp-perl - SNMP (Simple Network Management Protocol) Perl5 support
 libsnmp30  - SNMP (Simple Network Management Protocol) library
 libsnmp30-dbg - SNMP (Simple Network Management Protocol) library debug
 python-netsnmp - SNMP (Simple Network Management Protocol) Python support
 snmp       - SNMP (Simple Network Management Protocol) applications
 snmpd      - SNMP (Simple Network Management Protocol) agents
 snmptrapd  - Net-SNMP notification receiver
 tkmib      - SNMP (Simple Network Management Protocol) MIB browser
Closes: 455707 765289 765846 765873 781257 785380 788964 794641 794647 810982
Changes:
 net-snmp (5.7.3+dfsg-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload, done on top of the latest version in pkg-net-snmp
     git, as well as adding Steven Chamberlain's kFreeBSD patches from
     bug #810892.
 .
   [ Hideki Yamane ]
   * debian/patches
     - add Bug-788964-net-snmp-snmp_pdu_parse-DoS.patch (Closes: #788964)
     - add 0026-fix-Bug-785380-incorrect-date-format.patch (Closes: #785380)
       Thanks to Gabor Kiss <kissg@ssg.ki.iif.hu>
     - add 0027-fix-455707-traptoemail-use-FQDN.patch (Closes: #455707)
       Thanks to Ferenc Wagner <wferi@niif.hu>
   * debian/snmpd.{preinst,postinst,postrm}
     - change SNMP user from "snmp" to "Debian-snmp" to avoid confusion with
       non-system user. It satisfy to work with some LDAP system. Thanks to
       Vincent Bernat <bernat@debian.org> for suggestions.
       (Closes: #794641, #794647)
   * debian/snmp.preinst
     - revert "killall", it is unnecessary anymore (Closes: #781257)
 .
   [ Steven Chamberlain ]
   * Fix a typo in 26_kfreebsd.patch
   * Add 27_kfreebsd.patch: (Closes: #810982)
     - Add missing dependency of mibII/icmp on kfreebsd
     - Add kfreebsd definitions not in GNU libc's icmp6.h
   * Remove obsolete Fix-kfreebsd-builds-with-kernel-headers-10.patch
   * Re-enable IPv6 on kfreebsd (Closes: #765846)
   * Build with the libbsd overlay on kfreebsd, for nlist
 .
   [ Steinar H. Gunderson ]
   * New patches, mostly for various bug fixes (some of them for crash bugs):
     * fix_engineid_reprobe.diff: Do not probe engineID for USM
       if it is already given. (Closes: #765873)
     * callback_print.diff: Fix enum formatting when doing asynchronous queries
       from Perl. (Closes: #765289)
     * do_not_callback_for_failed_reports.diff: Fix access of freed data due to
       callbacks for reports occasionally coming twice.
     * fix_perl_bulk_gets.diff: Fix handling of truncated bulk get responses
       in the Perl module. (Patch 1278 in upstream patch tracker.)
     * let_perl_access_engineid.diff: Add a new functions to let Perl code
       access the security engine ID.
Checksums-Sha1:
 a14821b79af5c68cdd0ae5c525bdd64310ecfb32 3026 net-snmp_5.7.3+dfsg-1.1.dsc
 87a34bd08a49c7b07872f492e051bb15c87491ff 64420 net-snmp_5.7.3+dfsg-1.1.debian.tar.xz
 b7d64bc9ca2276eb2b3c4fa7723f186bfdbad92d 1594960 libsnmp-base_5.7.3+dfsg-1.1_all.deb
 d24b687507bd8117683b08792b422f8b53745c03 1073776 libsnmp-dev_5.7.3+dfsg-1.1_amd64.deb
 d5e6794536f5068922a424ab4ccd94d72948f3d3 289098 libsnmp-perl-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 ae6fdb6ff0660716260479e75a96d6e0a8d49b82 1497310 libsnmp-perl_5.7.3+dfsg-1.1_amd64.deb
 38f5c217f80346b5c398eacade12609eaa67fe4d 2559114 libsnmp30-dbg_5.7.3+dfsg-1.1_amd64.deb
 4b6d0526bd4297805bfcbb99e4207714ddd714f6 2214686 libsnmp30_5.7.3+dfsg-1.1_amd64.deb
 5a7907276ae9014c4ade7764ee565783cd0ad75f 37484 python-netsnmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 4dd90aee49e304fbddf34f71ea4a9102e2eb89cc 19424 python-netsnmp_5.7.3+dfsg-1.1_amd64.deb
 144c6cc9b32e5d6c5410bfc143e5d9246d45c609 230272 snmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 c9a08c2247e38d81c372758e975435896a25bfe7 155156 snmp_5.7.3+dfsg-1.1_amd64.deb
 af820c76edcade12416c3fc5700b18defb68b341 18492 snmpd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 42d0ac6ca10aae58fc32aa22bbd20079ab1a7475 56336 snmpd_5.7.3+dfsg-1.1_amd64.deb
 95b4d905a33b9b9ab6e23e1b04b28c97a6b3c7e2 21046 snmptrapd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 dccb9814ec8a5855de861dcc0ce1b4518f82803c 23990 snmptrapd_5.7.3+dfsg-1.1_amd64.deb
 13f909afc5f2b9a6edb20db8f878ba3521fddb36 1470888 tkmib_5.7.3+dfsg-1.1_all.deb
Checksums-Sha256:
 99a90ea17c2fd741ee46af0af32ce8765ea44af4349da7b87ff3511bd153bae6 3026 net-snmp_5.7.3+dfsg-1.1.dsc
 e5264e28677661d78d933c035ecd7fe3c7212f8b5b7895c6fc8ca010a6f7700b 64420 net-snmp_5.7.3+dfsg-1.1.debian.tar.xz
 d0c475a09c31183561371c9ced7569ee6df9da9a80a4deb793b0f7eb25d0c812 1594960 libsnmp-base_5.7.3+dfsg-1.1_all.deb
 f46ac1dc12d9f63616d0f3b53f69513f763b67aa8cb414b4f196bdf9ae023505 1073776 libsnmp-dev_5.7.3+dfsg-1.1_amd64.deb
 f4645481a486e6e2a1f61dd9f1b2f8ff41a1e73f302bb3df51e895ddd8216e23 289098 libsnmp-perl-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 87a6e4fb62d2a1a2b8e4b5022477a69d239ca1331a134e5d7e377beec7800727 1497310 libsnmp-perl_5.7.3+dfsg-1.1_amd64.deb
 ccf502db7344106a82420967ee2565be013a7290703492da91d8dc0a2a5377a5 2559114 libsnmp30-dbg_5.7.3+dfsg-1.1_amd64.deb
 fcd2f5202b8292a9db3283af3d85f0b055a61ab59d8348d7eec730be6d11f05d 2214686 libsnmp30_5.7.3+dfsg-1.1_amd64.deb
 dc1b0f24646f7a04199eb964ff2a9fac14b52386faf31249fcb155accf52c9d5 37484 python-netsnmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 3636b9f3be9c09bbf409641de1d12b3a5c3df436824c0ff8c3fdb36cd6ae8a39 19424 python-netsnmp_5.7.3+dfsg-1.1_amd64.deb
 261a7405c878f760b8ba6cb391005761deaca3d6ccd39aecc9c4b3eed7e392d7 230272 snmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 e37a5210ff2e58e0a64a120a2b785011a6b396cbff5b72e191241495c7d02bdb 155156 snmp_5.7.3+dfsg-1.1_amd64.deb
 bbcfc3bac514c722b57f97ddd4d4f716359c2544a8d935e535a73faa88947ecc 18492 snmpd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 2a162622ee50140edb1ba7208762e1040087c9477090a6986ea47e81583c9acc 56336 snmpd_5.7.3+dfsg-1.1_amd64.deb
 59983afb0642d5e45810606e38b4d23ac4f139afb715ea0715edcd6e4b44bb4e 21046 snmptrapd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 ccb54e58c2efba56e81648f8944cb421a7b18d978e52bd7a841385b580ced3b6 23990 snmptrapd_5.7.3+dfsg-1.1_amd64.deb
 c38f4a877b3549a1b53613bd99df571a077e2c3d4ca96b687617c37cc214cf73 1470888 tkmib_5.7.3+dfsg-1.1_all.deb
Files:
 6cffd77c059f4d9946b4bd15aa07ae17 3026 net optional net-snmp_5.7.3+dfsg-1.1.dsc
 f5f28144e4bd823550a2950e94dc4eb2 64420 net optional net-snmp_5.7.3+dfsg-1.1.debian.tar.xz
 79aa769ad6a8d4d48a5b7f549abba794 1594960 libs optional libsnmp-base_5.7.3+dfsg-1.1_all.deb
 007f797a28931fd01be2d60627493423 1073776 libdevel optional libsnmp-dev_5.7.3+dfsg-1.1_amd64.deb
 a94ddca092b1e6b078d9f7d1b09d74c4 289098 debug extra libsnmp-perl-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 7cd31aeaeb977e27e3b67e491354f053 1497310 perl optional libsnmp-perl_5.7.3+dfsg-1.1_amd64.deb
 d3f27fabe7cdb6e632cc9095923cc676 2559114 debug extra libsnmp30-dbg_5.7.3+dfsg-1.1_amd64.deb
 73ede601436a54f4344d853219592459 2214686 libs optional libsnmp30_5.7.3+dfsg-1.1_amd64.deb
 41bdd6d8184ec24dea6ceeb65fa58119 37484 debug extra python-netsnmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 606ddf0326a79635ba91326266122090 19424 python optional python-netsnmp_5.7.3+dfsg-1.1_amd64.deb
 1d001512462951bd0ac03d53cab7d136 230272 debug extra snmp-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 8ac7bfffc8e0697cad2715c2529c0a19 155156 net optional snmp_5.7.3+dfsg-1.1_amd64.deb
 588ea0090b1f30d4e05531281558d4b7 18492 debug extra snmpd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 bdc65bc848c13fcd2e795a07f5710891 56336 net optional snmpd_5.7.3+dfsg-1.1_amd64.deb
 2839b8b731c249191e0664a277a5e598 21046 debug extra snmptrapd-dbgsym_5.7.3+dfsg-1.1_amd64.deb
 20e5a1a7a56113017cb73a9e8e5b1b9e 23990 net optional snmptrapd_5.7.3+dfsg-1.1_amd64.deb
 df854f66e111a5dd3a355e4695b58ca0 1470888 net optional tkmib_5.7.3+dfsg-1.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJW+uwFAAoJEH9hdWF3l492eRwQAL43kkVEtMT0vVrzRf/JAuZf
9wwi0dUktz2fXWBYEStdhtLj8xIx6laa8mUsYvWPcodpJ8HFUNdHzha3reBaTUhp
+pyNNJuA2FCIEwXVmI8rbwc6wD/sfsWMf27VVr5n7jz12KbXb/LsfcGfYKE4aRMw
YnO0xWe86cez+iM84Qy/KfRzQ2kA9XGt4N2TA6LxmSpqhYBFvryzeg3gAs9A3Hzv
emuTVgNzov8rRpWZSZg6nkUusY2qSpUI7senn9jltAEjFIsRfRVcRxTOo27WWw6w
NVuNiXod4g1CbaFfuSl3L3A4g9LFIRCJEC8rmL7ikyw6xuYcVOMR9Uhns5c2sl9p
/OBpDVZmGvKYN+WDNIasAm6UHgT2TfRPqHnFpQmTpH67lSTHP0NBK9cs4mT7KHm8
dVWWjnUH3gkgl4L64EcVNvyF+CujHlAip5Pt7DDQzKIjacxbbpRFoUWnrJIjMSgg
1b/6uYYkVzCy2/NUXUAXfcdZe6ZjHYOV9d4Hk49rNnmG1ysvXsOO7tp3wK3NWlpO
ZzMM48gbCgpbWTkrdJIF0P7HxX7Mjlqjz04e8tsTrBhHeXnE+hqOHJTmlVac/lfI
lPGPoSZ0+6bwWNGRNSOLjdioP0Fr/iaj6frdkkpT1J4dh3iq5xSnTfLqM14IlrLS
6sl34qK0cFyLLV7bO4jC
=UtbO
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.