Package: util-linux-extra
Version: 2.40-6
Severity: serious
User: helmutg@debian.org
Usertags: dep17p1
Control: affects -1 + util-linux

Hi Chris,

I think I mentioned this on IRC already and you intended to revert, but
nothing happened, so lets turn this into a bug for tracking purposes at
least.

util-linux-extra gained the utils ctrlaltdel, fsck.cramfs, fsck.minix, mkfs.bfs, mkfs.cramfs, and mkfs.minix. In util-linux-extra, these now
reside below /usr/sbin while they used to reside in /sbin in util-linux
in bookworm and earlier. Hence upgrading from bookworm to sid can cause
these files to be lost.

I think we have three ways to address this:

1. Revert the move and retry after trixie. I think you favoured this?
2. Upgrade Breaks to Conflicts and issue a temporary protective
diversion from u-l-e.preinst to u-l-e.postinst. In theory, apt can
first unpack u-l, then unpack u-l-e and then configure both, so
there is a safe solution. However, there is a risk that apt could
decide to temporarily remove u-l and that would be really bad.
3. Keep Breaks and issue temporary diversions to be removed in forky's
u-l-e.postinst.

Please let me know your choice and I can do a patch.

Helmut

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Helmut,

On Mon, Apr 15, 2024 at 08:58:42PM +0200, Helmut Grohne wrote:

I think I mentioned this on IRC already and you intended to revert, but nothing happened, so lets turn this into a bug for tracking purposes at least.

Indeed, I forgot to follow up afterwards. Thanks for keeping track!

util-linux-extra gained the utils ctrlaltdel, [..] In
util-linux-extra, these now reside below /usr/sbin [..]

I think we have three ways to address this:

1. Revert the move and retry after trixie. I think you favoured this?
2. Upgrade Breaks to Conflicts and issue a temporary protective
diversion from u-l-e.preinst to u-l-e.postinst. In theory, apt can
first unpack u-l, then unpack u-l-e and then configure both, so
there is a safe solution. However, there is a risk that apt could
decide to temporarily remove u-l and that would be really bad.
3. Keep Breaks and issue temporary diversions to be removed in forky's
u-l-e.postinst.

Please let me know your choice and I can do a patch.

I think half of 2) exists now, but Conflicts: util-linux will
probably end badly as you note. I'd welcome a patch implementing 3).

Initially I favored 1), but then u-l will never make progress on
moving the non-essential files.

Thanks!

Chris

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Control: tags -1 + patch

Hi Chris,

On Tue, Apr 16, 2024 at 09:44:13AM +0200, Chris Hofstaedtler wrote:

I think half of 2) exists now, but Conflicts: util-linux will
probably end badly as you note. I'd welcome a patch implementing 3).

Initially I favored 1), but then u-l will never make progress on
moving the non-essential files.

Thanks for pinging me. I observe that util-linux-extra already had
mitigations except that preinst and postinst were swapped. Additionally,
it did not have Conflicts, which allow for unpacking an aliased
util-linux concurrently with a moved util-linux-extra despite the
protective diversions being removed. Since we want to avoid the
Conflicts, I've extended the protective diversions until postrm. In
trixie's postinst we can then remove them for good. Unfortunately, that
also means that we cannot use begin-remove-after magic.

Helmut

diff --minimal -Nru util-linux-2.40/debian/changelog util-linux-2.40/debian/changelog
--- util-linux-2.40/debian/changelog 2024-04-15 09:51:01.000000000 +0200
+++ util-linux-2.40/debian/changelog 2024-04-26 07:32:56.000000000 +0200
@@ -1,3 +1,10 @@
+util-linux (2.40-6.1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * Fix /usr-move mitigation. (Closes: #1069064)
+
+ -- Helmut Grohne <helmut@subdivi.de> Fri, 26 Apr 2024 07:32:56 +0200
+
util-linux (2.40-6) unstable; urgency=medium

* Add upstream patches fixing enosys on m68k, sh and dmesg -H output
diff --minimal -Nru util-linux-2.40/debian/util-linux-extra.lintian-overrides util-linux-2.40/debian/util-linux-extra.lintian-overrides
--- util-linux-2.40/debian/util-linux-extra.lintian-overrides 1970-01-01 01:00:00.000000000 +0100
+++ util-linux-2.40/debian/util-linux-extra.lintian-overrides 2024-04-26 07:32:56.000000000 +0200
@@ -0,0 +1,2 @@
+# DEP17 P1 mitigation
+diversion-for-unknown-file sbin/* [preinst:*]
diff --minimal -Nru util-linux-2.40/debian/util-linux-extra.postinst util-linux-2.40/debian/util-li