aide cronjob fails with bash unbound variable error

Bug #1323827 reported by Nathan Kinkade
32
This bug affects 6 people
Affects Status Importance Assigned to Milestone
aide (Ubuntu)
Fix Released
Undecided
Unassigned
Trusty
Fix Released
Undecided
Unassigned

Bug Description

[Impact]
 * daily cron job may fail with a bash "unbound variable" error
 * the fix is small, low risk and easy to understand
 * the fix is from Debian and included in vivid and simply initializes the affected variables. See the Original description (below) for details

[Test Case]
 * the test case for NF_ADD requires: an aide setup with up to date database, downgrade/upgrade a package, then run the aide con job. Specifically:
  1. $ sudo apt-get install aide
  2. Update /etc/default/aide to have:
    COPYNEWDB=yes
    FILTERUPDATES=yes
  3. $ sudo aideinit # takes a long time
  4. $ sudo dpkg -i /path/to/some/different/version/of/installed/deb
  5. $ sudo /etc/cron.daily/aide

'5' also takes a while, but will eventually fail with:
/etc/cron.daily/aide: line 413: NF_ADD: unbound variable

[Regression Potential]
 * Regression potential is very low. It is a simple change to the /etc/cron.daily/aide shell script which only initializes a few variables that weren't initialized yet

Attached is a debdiff to fix this issue.

Original description:

Ubuntu version: 14.04 LTS (server)
AIDE version: 0.16~a2.git20130520-2

EXPECTED RESULT
===============
The daily cron job should excute properly, generating an email with the AIDE report for that day.

ACTUALLY RESULT
==============
The daily cron job fails with a bash "unbound variable" error.

DESCRIPTION
===============
I recently upgraded a machine from Ubuntu Server 12.04 LTS to Ubuntu Server 14.04 LTS. After the upgrade I noticed that the AIDE cronjob was failing with this error:

-----
/etc/cron.daily/aide:
/etc/cron.daily/aide: line 413: NF_ADD: unbound variable
run-parts: /etc/cron.daily/aide exited with return code 1
-----

NF_ADD is explicity defined as an array, but on line 413 it would appear that a new element is trying to be added to the array based on the current count of the array:

NF_ADD[${#NF_ADD[*]}]="$line"

However, if the variable/array is empty, then referencing ${#NF_ADD[*]} produces an "unbound variable" error, and since line #3 of the script sets the -e option, bash will terminate executeion of the script upon encountering this error, meaning the AIDE cron.daily script fails to complete.

The attached patch seems to have fixed the issue for me, though I really don't know if that is the correct fix, or if it might have other unintended consequences when run with different options or in a different environment.

Revision history for this message
Nathan Kinkade (nath) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "aide.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in aide (Ubuntu):
status: New → Confirmed
Revision history for this message
Adrian Bridgett (adrian-bridgett) wrote :

I wonder if it'd be better to set "NF_ADD=()" etc as this makes it an array rather than a scalar?

Revision history for this message
Julien (julien-t43) wrote :

I have a similar problem but with another var. I enabled filtered updates options and got

****
+ (( CHG++ ))
+ false
+ set +x
+ (( CHG++ ))
+ true
/etc/cron.daily/aide: ligne 436: NF_CHG : variable sans liaison
run-parts: /etc/cron.daily/aide exited with return code 1
****
which is also unbound variable.

Tested on lubuntu 14.04.1
I will try the suggested modification.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package aide - 0.16~a2.git20130520-3

---------------
aide (0.16~a2.git20130520-3) unstable; urgency=medium

  * cron.daily/aide:
    - fixed 'unbound variable' error with bash-4.3 (LP: #1323827)
  * 31_aide_postfix: new
    - handle files/dirs in /var/spool/postfix
    - handle prng_exch file
  * 31_aide_apt:
    - handle files in /var/lib/apt/periodic
  * 31_aide_tt-rss:
    - handle /var/lib/tt-rss
  * 31_aide_etckeeper: new
    - handle /etc/.git and /etc/.git/index
  * debian/control:
    - bumped to Standards-Version 3.9.6 (no changes necessary)
    - added libaudit-dev to build dependencies (linux only)
  * debian/rules:
    - enabled audit support (closes: #745781)

 -- Hannes von Haugwitz <email address hidden> Fri, 24 Oct 2014 22:19:43 +0200

Changed in aide (Ubuntu):
status: Confirmed → Fix Released
Changed in aide (Ubuntu Trusty):
status: New → Triaged
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

14.04 debdiff to fix this bug.

description: updated
Changed in aide (Ubuntu Trusty):
status: Triaged → In Progress
description: updated
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Uploaded to trusty-proposed for hand-off to ubuntu-sru.

description: updated
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Nathan, or anyone else affected,

Accepted aide into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/aide/0.16~a2.git20130520-2ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in aide (Ubuntu Trusty):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

I ran the test plan and installed on some machines and it the package in trusty-proposed fixes the bug.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Alastair Irvine (alastair-al) wrote :

The aide-common package, which contains the cron script, wasn't pushed to trusty-proposed.

Therefore the bug isn't fixed yet.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package aide - 0.16~a2.git20130520-2ubuntu0.1

---------------
aide (0.16~a2.git20130520-2ubuntu0.1) trusty-proposed; urgency=medium

  * cron.daily/aide: fixed 'unbound variable' error with bash-4.3. Patch
    from Debian. (LP: #1323827)
 -- Jamie Strandboge <email address hidden> Wed, 12 Nov 2014 09:11:52 -0600

Changed in aide (Ubuntu Trusty):
status: Fix Committed → Fix Released
Revision history for this message
Chris J Arges (arges) wrote : Update Released

The verification of the Stable Release Update for aide has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Alastair Irvine (alastair-al) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.