Bug 32382 - mgaonline update to work regardless of $PATH order
Summary: mgaonline update to work regardless of $PATH order
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 9
Hardware: All Linux
Priority: High major
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: MGA8TOO MGA8-64-OK MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-10-13 09:40 CEST by papoteur
Modified: 2023-10-19 18:14 CEST (History)
5 users (show)

See Also:
Source RPM: mgaonline-3.31
CVE:
Status comment:


Attachments

Description papoteur 2023-10-13 09:40:31 CEST
Advisory
===============================
On some systems, we noticed that the update notification was missing. It turned out that the mgaapplet applet launched a metadata update command and that this command failed.
The primary cause of this failure is that the PATH variable in user space incorrectly prioritizes the /usr/sbin directory over the /usr/bin directory. In order to prevent the metadata update command from failing to launch, this update proposes to write the command with the full path.
===============================
In fact, there are two urpmi.update command scripts. The first one is in /usr/sbin and can only be run by the administrator. The second is in /usr/bin and is executed via pkexec by a user other than the administrator.
To check that this update is working correctly, start by altering the PATH path to /usr/sbin first, to have the error raising. The journal should show an execution error for mgaapplet.
After updating mgaonline and restarting mgaapplet, there should be no more errors reported in the journal and updates should be notified. 
After testing, the PATH variable must of course be set correctly.
papoteur 2023-10-13 09:40:57 CEST

See Also: (none) => https://bugs.mageia.org/show_bug.cgi?id=32354

Comment 1 papoteur 2023-10-13 09:47:35 CEST
RPMS:
mgaonline-3.32-2.mga9.noarch.rpm
mgaonline-3.32-1.mga8.noarch.rpm

SOURCES:

mgaonline-3.32-2.mga9.src.rpm
mgaonline-3.32-1.mga8.src.rpm
Comment 2 katnatek 2023-10-13 19:14:13 CEST
I try hard to reproduce the bug
I set globally /usr/sbin as first item in PATH and make sure are not overwrote like in .bashr from root
I downgrade a package
Reboot
Start Plasma (Mageia 9)
But after wait some time the notification of update is show without issues
And can make the update

rpm -q mgaonline 
mgaonline-3.31-3.mga9

Maybe need to switch to gdm as dm also?
Comment 3 Marja Van Waes 2023-10-13 20:21:20 CEST
Advisory based on comment 0 and comment 1 added to SVN. Please remove the "advisory" keyword if it needs to be changed. It also helps when obsolete advisories are tagged as "obsolete".

Keywords: (none) => advisory
CC: (none) => marja11

Comment 4 papoteur 2023-10-14 16:43:32 CEST
There was a typo in release 3.32.
Thus a new release 3.33
==========
RPMS:
mgaonline-3.33-1.mga9.noarch.rpm
mgaonline-3.33-1.mga8.noarch.rpm

SOURCES:

mgaonline-3.33-1.mga9.src.rpm
mgaonline-3.33-1.mga8.src.rpm
===========
Comment 5 Morgan Leijström 2023-10-14 17:30:53 CEST
I guess advisory need be updated to say version 3.33-1

CC: (none) => fri
Keywords: advisory => (none)

Comment 6 papoteur 2023-10-14 18:55:06 CEST
Trying mgaapplet-update-checker before the update (mgaonline-3.31-3)
======
mgaapplet-update-checker 
Ignore the following Glib::Object::Introspection & Gtk3 warnings
Subroutine Gtk3::main redefined at /usr/share/perl5/vendor_perl/Gtk3.pm line 539.
getting exclusive lock on urpmi
unlocking urpmi database
Only superuser is allowed to update media
Only superuser is allowed to update media
Only superuser is allowed to update media
Only superuser is allowed to update media
Only superuser is allowed to update media
Only superuser is allowed to update media
Only superuser is allowed to update media
using mirror https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64
examining synthesis file [/var/lib/urpmi/Core Release/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Core Updates/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Core Updates Testing/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Nonfree Release/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Nonfree Updates/synthesis.hdlist.cz]
would install instead of upgrade package kernel-desktop-6.3.2-2.mga9.x86_64
would install instead of upgrade package kernel-desktop-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-desktop-devel-6.3.2-2.mga9.x86_64
would install instead of upgrade package kernel-desktop-devel-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-server-6.3.2-2.mga9.x86_64
would install instead of upgrade package kernel-server-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-server-devel-6.3.2-2.mga9.x86_64
would install instead of upgrade package kernel-server-devel-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-linus-6.3.2-1.mga9.x86_64
...
==========
continues with list of rpm to update

Install mgaonline 3.33-1.mga9
==========
mgaapplet-update-checker 
Ignore the following Glib::Object::Introspection & Gtk3 warnings
Subroutine Gtk3::main redefined at /usr/share/perl5/vendor_perl/Gtk3.pm line 539.
getting exclusive lock on urpmi
unlocking urpmi database
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/release/media_info/20230819-212352-synthesis.hdlist.cz
updated medium "Core Release"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/updates/media_info/20231013-213929-synthesis.hdlist.cz                                                                            
updated medium "Core Updates"                                                                                                                                                                                  
medium "Core Updates Testing" is up-to-date
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/nonfree/release/media_info/20230819-190450-synthesis.hdlist.cz
updated medium "Nonfree Release"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/nonfree/updates/media_info/20230911-130133-synthesis.hdlist.cz                                                                         
updated medium "Nonfree Updates"                                                                                                                                                                               
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/core/backports/media_info/20230811-205036-synthesis.hdlist.cz
updated medium "Core Backports"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/nonfree/backports/media_info/20230811-204847-synthesis.hdlist.cz                                                                       
updated medium "Nonfree Backports"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64/media/tainted/backports/media_info/20230811-204714-synthesis.hdlist.cz                                                                       
updated medium "Tainted Backports"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/i586/media/core/backports/media_info/20230811-205035-synthesis.hdlist.cz                                                                            
updated medium "Core 32bit Backports"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/i586/media/nonfree/backports/media_info/20230811-204846-synthesis.hdlist.cz                                                                         
updated medium "Nonfree 32bit Backports"
    https://mirror.math.princeton.edu/pub/mageia/distrib/9/i586/media/tainted/backports/media_info/20230811-204713-synthesis.hdlist.cz                                                                         
updated medium "Tainted 32bit Backports"
using mirror https://mirror.math.princeton.edu/pub/mageia/distrib/9/x86_64                                                                                                                                     
examining synthesis file [/var/lib/urpmi/Core Release/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Core Updates/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Core Updates Testing/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Nonfree Release/synthesis.hdlist.cz]
examining synthesis file [/var/lib/urpmi/Nonfree Updates/synthesis.hdlist.cz]
would install instead of upgrade package kernel-desktop-6.4.9-4.mga9.x86_64
would install instead of upgrade package kernel-desktop-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-desktop-devel-6.4.9-4.mga9.x86_64
would install instead of upgrade package kernel-desktop-devel-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-server-6.4.9-4.mga9.x86_64
would install instead of upgrade package kernel-server-6.4.16-3.mga9.x86_64
would install instead of upgrade package kernel-server-devel-6.4.9-4.mga9.x86_64
would install instead of upgrade package kernel-server-devel-6.4.16-3.mga9.x86_64
=======
Comment 7 Morgan Leijström 2023-10-14 20:18:51 CEST
mga9-64 Plasma OK here

To make the problem show:
$ export PATH="/usr/sbin:$PATH"

Then the old version hit the problem like Comment 6, and after updating to mgaonline 3.33-1.mga9, problem was gone.

After downgrading a package to release, (and i also rebooted) mgaapplet told me there was an update, and installed it back.

Summary: mgaonline update => mgaonline update to work regardless of $PATH order
Priority: Normal => High
Whiteboard: (none) => MGA9-64-OK

Comment 8 Marja Van Waes 2023-10-15 11:27:37 CEST
(In reply to Morgan Leijström from comment #5)
> I guess advisory need be updated to say version 3.33-1

Thanks, Morgan. Done :-)

Keywords: (none) => advisory

Comment 9 Thomas Andrews 2023-10-15 14:24:23 CEST
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 10 Morgan Leijström 2023-10-15 19:06:08 CEST
Packages for mga8 is also provided.

I guess this is such minor change that testing on neither 32 bit nor mga8 is not needed, or...?

Whiteboard: MGA9-64-OK => MGA9-64-OK, MGA8TOO

Comment 11 Guillaume Royer 2023-10-15 20:19:18 CEST
MGA9 64 updated with QA repo and rpm:

mgaonline-3.32-2.mga9.noarch.rpm

command:

mgaapplet-update-checker
Ignore the following Glib::Object::Introspection & Gtk3 warnings
Subroutine Gtk3::main redefined at /usr/share/perl5/vendor_perl/Gtk3.pm line 539.
getting exclusive lock on urpmi
unlocking urpmi database
le média « QA Testing (64-bit) » est à jour
le média « Core Updates » est à jour
le média « Nonfree Updates » est à jour
le média « Tainted Updates » est à jour
le média « Core Backports » est à jour
le média « Nonfree Backports » est à jour
le média « Tainted Backports » est à jour
le média « Core 32bit Backports » est à jour
le média « Nonfree 32bit Backports » est à jour
le média « Tainted 32bit Backports » est à jour
using mirror https://distrib-coffee.ipsl.jussieu.fr/pub/linux/Mageia/distrib/9/x86_64
examen de la liste de synthèse [/var/lib/urpmi/QA Testing (64-bit)/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Core Release/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Core Updates/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Nonfree Release/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Nonfree Updates/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Tainted Release/synthesis.hdlist.cz]
examen de la liste de synthèse [/var/lib/urpmi/Tainted Updates/synthesis.hdlist.cz]

Ok

Command:

mgaapplet-upgrade-checker.
bash: mgaapplet-upgrade-checker. : commande introuvable

This command is NOK for me

CC: (none) => guillaume.royer

Comment 12 Morgan Leijström 2023-10-15 21:04:43 CEST
(In reply to Guillaume Royer from comment #11)
> MGA9 64 updated with QA repo and rpm:
> 
> mgaonline-3.32-2.mga9.noarch.rpm

We are testing 3.33-1 now


> bash: mgaapplet-upgrade-checker. : commande introuvable

I do not think we have that command.
Did you mean to test mgaapplet-upgrade-helper ?
Comment 13 papoteur 2023-10-15 21:56:28 CEST
(In reply to Morgan Leijström from comment #12)
> Did you mean to test mgaapplet-upgrade-helper ?
This is surely that.
It is also modified by the update.
Comment 14 Thomas Andrews 2023-10-17 04:31:44 CEST
(In reply to Morgan Leijström from comment #10)
> Packages for mga8 is also provided.
> 
> I guess this is such minor change that testing on neither 32 bit nor mga8 is
> not needed, or...?

I hadn't noticed the mga8 package when I validated. The MGA8TOO keyword should have been added from the start.

Removing the validation until MGA8 has been tested.

Keywords: validated_update => (none)

Comment 15 Thomas Andrews 2023-10-18 01:40:55 CEST
Tested MGA8 in a VirtualBox guest. All OK. Restoring the validation.

Whiteboard: MGA9-64-OK, MGA8TOO => MGA8TOO MGA8-64-OK MGA9-64-OK
Keywords: (none) => validated_update

Comment 16 Mageia Robot 2023-10-19 18:14:19 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGAA-2023-0095.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.