#1142783 broken $TMPDIR handling in postinst

Package:
apparmor
Source:
apparmor
Description:
user-space parser utility for AppArmor
Submitter:
Harald Dunkel
Date:
2026-07-31 20:43:50 UTC
Severity:
normal
Tags:
#1142783#5
Date:
2026-07-25 20:20:34 UTC
From:
To:
in a chroot, I get

Setting up apparmor (4.1.0-1) ...
mktemp: failed to create file via template '/tmp/user/0/tmp.XXXXXXXXXX': No such file or directory
dpkg: error processing package apparmor (--configure):
 installed apparmor package post-installation script subprocess returned error exit status 1

Thiscan  happen in a pbuilder environment or for running debootstrap, for
example.


Regards
Harri
#1142783#10
Date:
2026-07-27 12:01:51 UTC
From:
To:
Hi,

Harald Dunkel (2026-07-25):

I'm not sure what I'm seeing here exactly but from where I stand it
looks like the value for your $TMPDIR (set by libpam-tmpdir) leaks
into an environment (chroot or whatever) where that $TMPDIR hasn't
been set up. In other words, you could trigger the exact same behavior
by setting $TMPDIR to any non-existent path, then trying to install
apparmor. I any package that uses mktemp in its postinst will expose
the same problem.

So to me it looks like a local configuration problem.
Or perhaps some build/chroot system blindly forwards $TMPDIR to
the chroot and that could be considered to be a bug.

But I don't really see what packages can do to guard against an
incorrectly configured $TMPDIR.

What am I missing?

Cheers,
#1142783#17
Date:
2026-07-29 18:25:48 UTC
From:
To:
Please note that I don't set TMPDIR. This weird pam module that sneaked
in via some dependency does. I don't run mktemp, either. This can be
found in apparmor.postinst. Of course I could examine all the postinst
scripts before running apt install of some packages, and unset all
these variables that might lead into problems, but I doubt that this is
the way to follow.

Running mktemp I would either give it a dedicated path for a temporary
file, or I would unset a bad TMPDIR. Maybe ignoring a bad TMPDIR would
be the job of mktemp; I cannot say.


Regards
Harri
#1142783#22
Date:
2026-07-31 17:11:45 UTC
From:
To:
Control: reassign -1 pbuilder

Earlier you wrote:

When you run such an environment, you or the tools you run are
responsible for setting that environment up correctly. It seems
pbuilder should unset TMPDIR if it cannot guarantee it will be
available in the target.

Working around this in each single package that uses TMPDIR is not
a sustainable solution.

Chris