Update Manager - Could not install the security updates - SOLVED

[JoeBachofen]

Long time linux user but 1st time problem with Update Manager failures. As of 1/27/2002, Update Manager failed to update webkit2gtk. Anyone else have problem?

[sleeper12]

Try a different Mirror in Software Sources.

[sleeper12]

Any change if you click Refresh in Update Manager?

[JoeBachofen]

Refresh does what it's supposed to & the dialog shows it's not a repository problem. Everything points to permissions but everything in /usr/bin is 755 which is the only place that matters as far as I know and nothing there has changed since last year.

[JoeBachofen]

Reviewing my initial post, I see I fat fingered the date; 1st failure was 1/27/2022 which coincides with the PwnKit alert. That led me to chmod 755 /usr/bin/pkexec which made me think I broke Update Manager with that, but that makes no sense.

[all41]

just post the results of:

Code: Select all

apt update

let the forum analyze

[gremlin]

Ran sudo apt upgrade

Worked. on Mint Cinnamon 20.3

Ran update app. got clear result

I had run the script to try to overcome recent long time Linux security problem
See Slashdot PwnKit story & above @ JoeBachofen on 28th Jan
Good Luck

[sleeper12]

just post the results of:

Code: Select all

apt update

let the forum analyze

From the OP's apt update posted in this thread, maybe the repos are messed up?:
viewtopic.php?f=18&t=366832&p=2130820#p2130820

[all41]

just post the results of:

Code: Select all

apt update

let the forum analyze

From the OP's apt update posted in this thread, maybe the repos are messed up?:
viewtopic.php?f=18&t=366832&p=2130820#p2130820

thanks @sleeper12 I had not followed this other topic. In the final reply on that thread the op
reports even Synaptic Package Manager will not open--which could certainly be a polkit issue,
most likely self-inflicted, and having nothing to do with the recent patch.
Was there an inxi anywhere that I didn't see? No forum rule compliance = no help
http://forums.linuxmint.com/viewtopic.php?f=17&t=83444

[sleeper12]

I don't see an inxi there or here.

[JoeBachofen]

Thx to all, here's inxi followed by apt update & apt list --upgradeable

$ inxi
CPU: 6-Core AMD Ryzen 5 3600 (-MT MCP-) speed/min/max: 2200/2200/3600 MHz
Kernel: 5.4.0-96-generic x86_64 Up: 9h 01m Mem: 9217.6/32099.3 MiB (28.7%)
Storage: 1.14 TiB (6.4% used) Procs: 343 Shell: bash 5.0.17 inxi: 3.0.38

$ apt update
Ign:1 http://packages.linuxmint.com uma InRelease
Hit:2 http://packages.linuxmint.com uma Release
Hit:4 http://security.ubuntu.com/ubuntu focal-security InRelease
Hit:5 http://archive.canonical.com/ubuntu focal InRelease
Hit:6 http://archive.ubuntu.com/ubuntu focal InRelease
Hit:7 http://archive.ubuntu.com/ubuntu focal-updates InRelease
Hit:8 http://archive.ubuntu.com/ubuntu focal-backports InRelease
Reading package lists...
Building dependency tree...
Reading state information...
6 packages can be upgraded. Run 'apt list --upgradable' to see them.

$ apt list --upgradeable
Listing...
firefox-locale-en/uma 96.0.3+linuxmint1+una amd64 [upgradable from: 96.0.2+linuxmint1+una]
firefox/uma 96.0.3+linuxmint1+una amd64 [upgradable from: 96.0.2+linuxmint1+una]
gir1.2-javascriptcoregtk-4.0/focal-updates,focal-security 2.34.4-0ubuntu0.20.04.1 amd64 [upgradable from: 2.34.3-0ubuntu0.20.04.1]
gir1.2-webkit2-4.0/focal-updates,focal-security 2.34.4-0ubuntu0.20.04.1 amd64 [upgradable from: 2.34.3-0ubuntu0.20.04.1]
libjavascriptcoregtk-4.0-18/focal-updates,focal-security 2.34.4-0ubuntu0.20.04.1 amd64 [upgradable from: 2.34.3-0ubuntu0.20.04.1]
libwebkit2gtk-4.0-37/focal-updates,focal-security 2.34.4-0ubuntu0.20.04.1 amd64 [upgradable from: 2.34.3-0ubuntu0.20.04.1]

After that, Update Manager still NOP & Synaptic won't launch.
I agree it's self-inflicted but can't see how.
Only unusual action was to chmod 755 pkexec on 1/27 then trouble shooting today (1/28) after problem detected.

[all41]

after running apt list --upgradeable did you also run
apt upgrade

[JoeBachofen]

Did the following:
$ apt update
Same result as before ending with "6 package can be upgraded. ..."
$ apt list --upgradeable
Same result as before
$ apt upgrade
All packages upgraded.
Update Manager now OK after refresh with "Your system is up to date" displayed.
I monitor that daily for new updates & install any that show up, so I'll know soon if the problem is solved, it appears to be.
However, Synaptic still will not launch even after reinstall.
That's not a big deal since I seldom use it & can use apt instead.
Thank you for your help.
I will close this thread as soon as I get a new Update Manager flag and act on it; most likely Monday 1/31/2022.
Any ideas on how I broke it?

[Wakatakakage]

Try karlchen's suggestion to restore the sticky bit to pkexec's permissions.

[smurphos]

Only unusual action was to chmod 755 pkexec on 1/27

Any why did you do that? Yes it will break update manager and many other apps that use pkexec under the hood for authentication (GUFW, Nemo as root, Login Window, Synaptic, etc etc)
Did you need to because of pwnkit? No you didn't - Mint's pkexec was patched against pwnkit on the 25/1/22.

[JoeBachofen]

Thank you for the reply smurphos; it seemed off target until I read Wakatakakage & followed the sticky bit link.
I remember sticky bits from my UNIX days in the 70s but I figured they would not be needed with today's speed.
The suggestion to chmod 755 pkexec came from https://www.zdnet.com/article/major-lin ... ed-pwnkit/
"Expert" advice can be dangerous if not fully understood. It hurts to re-learn some lessons.
Thank you all for your patience with me.
One more thing, how do I close this thread?

[smurphos]

I'd guessed that you'd followed 'instructions' in an article somewhere - the zdnet article did mention that the command was only needed if your OS hadn't provided a patch. Mint's patch (via Ubuntu) was available to install before that article was published... . Unfortunately none of the tech-blog articles on this I've seen, nor the original disclosure from the security researchers that discovered the vulnerability saw fit to mention that the temporary mitigation of disabling pkexec if a patch was not available or not convenient to install could significantly break functionality for other applications that use it.

Hint for any future concerns over newly discovered vulnerabilities. Ubuntu maintain a CVE log - which includes release status for fixes and version numbers etc - e.g. - https://ubuntu.com/security/CVE-2021-4034

Also every security issue fixed via an update in Mint/Ubuntu is published here - https://ubuntu.com/security/notices

You can close your thread by editing the first post and adding [SOLVED] to the thread subject.

[JoeBachofen]

Thanks again everyone.

[MrJetro]

after running apt list --upgradeable did you also run
apt upgrade

It worked for me.
Thanks!