[Bug 2079785] [NEW] apt / apt-get install produce spurious Warning

[Colin Foster]

Public bug reported:

A new minimal install of Ubuntu Server 24.04 has started giving a W
message on completion of all installs:

W: Download is performed unsandboxed as root as file
'/var/cache/apt/archives/partial/<PACKAGE_NAME>' couldn't be accessed by
user '_apt'. - pkgAcquire::Run (13: Permission denied)

This seems to be spurious, as on checking
/var/cache/apt/archives/partial has correct _apt:root ownership, mode
700.

I have set ownership on everything from /var/cache/apt down to
_apt:root, but it makes no difference - the warning continues to be
emitted on all installs, using both apt and apt-get.

>From widespread discussion I've found online, this seems to be a common
issue with no obvious cause or solution other than to make root the
sandbox user in /etc/apt/apt.conf.d, which seem to me to not be a
solution at all! I agree that _apt should be used with reduced
privileges for downlaoading, but it seems that something in the changes
you made to implement this is broken.

I'll attach my ubuntu-bug report here, as the machine which generated it
is headless.

Thanks
Colin

** Affects: apt (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: apt download install permissions warning

** Attachment added: "ubuntu-bug report"
   https://bugs.launchpad.net/bugs/2079785/+attachment/5813842/+files/apport.apt.c0blqzu2.apport

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/2079785

Title:
  apt / apt-get install produce spurious Warning

Status in apt package in Ubuntu:
  New

Bug description:
  A new minimal install of Ubuntu Server 24.04 has started giving a W
  message on completion of all installs:

  W: Download is performed unsandboxed as root as file
  '/var/cache/apt/archives/partial/<PACKAGE_NAME>' couldn't be accessed
  by user '_apt'. - pkgAcquire::Run (13: Permission denied)

  This seems to be spurious, as on checking
  /var/cache/apt/archives/partial has correct _apt:root ownership, mode
  700.

  I have set ownership on everything from /var/cache/apt down to
  _apt:root, but it makes no difference - the warning continues to be
  emitted on all installs, using both apt and apt-get.

  From widespread discussion I've found online, this seems to be a
  common issue with no obvious cause or solution other than to make root
  the sandbox user in /etc/apt/apt.conf.d, which seem to me to not be a
  solution at all! I agree that _apt should be used with reduced
  privileges for downlaoading, but it seems that something in the
  changes you made to implement this is broken.

  I'll attach my ubuntu-bug report here, as the machine which generated
  it is headless.

  Thanks
  Colin

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/2079785/+subscriptions