[Bug 1218674] [NEW] Need to make .click world readable before passing to click install

[Launchpad Bug Tracker]

You have been subscribed to a public bug:

Hi,

TLDR; download-manager only allows downloads to be readable by phablet
(of course root can too), so that clickpkg user can't read them.

Installing Click packages from appstore (click scope) in Ubuntu Touch
images is unreliable.

I couldn't figure exactly which conditions trigger this, but "pkcon
install-local some.click" works, and then installation from the scope
works, however if I install straight from the scope it doens't work.

I've straced packagekit doing this and spotted some click traceback being written to a .crash which ends with:
Traceback:
 Traceback (most recent call last):
   File "/usr/bin/click", line 84, in <module>
     sys.exit(main())
   File "/usr/bin/click", line 79, in main
     mod.run(args)
   File "/usr/lib/python3/dist-packages/click/commands/install.py", line 41, in run
     installer.install(package_path, user=options.user)
   File "/usr/lib/python3/dist-packages/click/install.py", line 264, in install
     env=env, **kwargs)
   File "/usr/lib/python3.3/subprocess.py", line 544, in check_call
     raise CalledProcessError(retcode, cmd)
 subprocess.CalledProcessError: Command '['dpkg', '--force-not-root', '--instdir', '/opt/click.ubuntu.com/ar.com.beuno.hello-world/0.6', '--admindir', '/opt/click.ubuntu.com/ar.com.beuno.hello-world/0.6/.click', '--path-exclude', '*/.click/*', '--log', '/opt/click.ubuntu.com/.click/log', '--no-triggers', '--install', '/home/phablet/.local/share/download_manager/{97d4efcf-34bc-4919-a9b4-a1006890128e}/ar.com.beuno.hello-world-0.6.click']' returned non-zero exit status 1

Which suggests dpkg failing; which I found in the strace started as follows:
4519  execve("/usr/bin/dpkg", ["dpkg", "--force-not-root", "--instdir", "/opt/click.ubuntu.com/ar.com.beu"..., "--admindir", "/opt/click.ubuntu.com/ar.com.beu"..., "--path-exclude", "*/.click/*", "--log", "/opt/click.ubuntu.com/.click/log", "--no-triggers", "--install", "/home/phablet/.local/share/downl"...], [/* 7 vars */] <unfinished ...>

then running dpkg-split:
4520  execve("/usr/bin/dpkg-split", ["dpkg-split", "-Qao", "/opt/click.ubuntu.com/ar.com.beu"..., "/home/phablet/.local/share/downl"...], [/* 8 vars */]) = 0

but failing to open the package:
4520  open("/home/phablet/.local/share/download_manager/{8ec430e5-a192-493a-bdb6-478fffcb7ab1}/ar.com.beuno.hello-world-0.6.click", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)
4520  write(2, "dpkg-split: error: unable to rea"..., 183) = 183

Immediately before, one can see:
4520  geteuid32()                       = 106

which was set when launching dpkg:
4519  setresgid32(107, 107, 107)        = 0
4519  setresuid32(106, 106, 106)        = 0
4519  getresuid32([106], [106], [106])  = 0
4519  getresgid32([107], [107], [107])  = 0

Indeed, click install had switched to the clickpkg user:
clickpkg:x:106:107::/nonexistent:/bin/false

So the problem is that .clicks may only be read by phablet user or root,
but not by clickpkg.

Cheers,

** Affects: click (Ubuntu)
     Importance: Undecided
         Status: New

-- 
Need to make .click world readable before passing to click install
https://bugs.launchpad.net/bugs/1218674
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to click in Ubuntu.