半隔离环境下CIS加固的Ubuntu 22.04补丁安装失败（内核文件写入/boot权限异常）

我在半隔离环境里运行Ubuntu 22.04，系统已经按照CIS标准做了加固，没有直接连互联网，用Nexus Repo代理APT仓库。之前用20.04的时候一切正常，但给22.04打补丁时遇到了问题，具体情况如下：

初始补丁安装错误 #

执行补丁安装操作后，出现依赖未满足的错误：

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

You might want to run 'apt --fix-broken install' to correct these.

The following packages have unmet dependencies:

linux-image-generic-hwe-22.04 : Depends: linux-image-6.5.0-17-generic but it is not installed

E: Unmet dependencies. Try 'apt --fix-broken install' with no packages (or specify a solution).

执行修复命令后的错误 #

按照提示运行apt --fix-broken install，仍然失败，错误信息如下：

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

Correcting dependencies... Done

The following additional packages will be installed:

linux-image-6.5.0-17-generic

Suggested packages:

fdutils linux-doc | linux-hwe-6.5-source-6.5.0 linux-hwe-6.5-tools

The following NEW packages will be installed:

linux-image-6.5.0-17-generic

0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.

11 not fully installed or removed.

Need to get 0 B/14.0 MB of archives.

After this operation, 14.3 MB of additional disk space will be used.

Do you want to continue? [Y/n] y

(Reading database ... 241842 files and directories currently installed.)

Preparing to unpack .../linux-image-6.5.0-17-generic_6.5.0-17.17~22.04.1_amd64.deb ...

Unpacking linux-image-6.5.0-17-generic (6.5.0-17.17~22.04.1) ...

dpkg: error processing archive /var/cache/apt/archives/linux-image-6.5.0-17-generic_6.5.0-17.17~22.04.1_amd64.deb (--unpack):

unable to open '/boot/vmlinuz-6.5.0-17-generic.dpkg-new': Operation not permitted

Errors were encountered while processing:

/var/cache/apt/archives/linux-image-6.5.0-17-generic_6.5.0-17.17~22.04.1_amd64.deb

needrestart is being skipped since dpkg has failed

E: Sub-process /usr/bin/dpkg returned an error code (1)

系统挂载配置 #

/etc/fstab中/和/boot的挂载项： #

/ - xfs defaults 0 1

/boot ext4 defaults 0 1

当前mount命令输出的/和/boot状态： #

/dev/mapper/ubuntu--vg-ubuntu--lv on / type xfs (rw,relatime,attr2,inode64,logbufs=8,logbsize=32k,noquota)

/dev/sda2 on /boot type ext4 (rw,relatime)

日志排查结果 #

我grep了/var/log目录下的相关日志，得到以下内容：

/var/log/apt/term.log: unable to open '/boot/vmlinuz-6.5.0-17-generic.dpkg-new': Operation not permitted
/var/log/apt/term.log: unable to open '/boot/vmlinuz-6.5.0-17-generic.dpkg-new': Operation not permitted
/var/log/apt/term.log: unable to open '/boot/vmlinuz-6.5.0-17-generic.dpkg-new': Operation not permitted
grep: /var/log/journal/ffe96984df964d1497fbb9324cd333ee/system@00060fdadd825faf-bbdbb03cab0dd0cc.journal~: binary file matches
grep: /var/log/journal/ffe96984df964d1497fbb9324cd333ee/system.journal: binary file matches
/var/log/cloud-init.log:2024-01-26 11:46:44,407 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 11:47:37,908 - subp.py[DEBUG]: Running command ['grub-probe', '-t', 'disk', '/boot'] with allowed return codes [0] (shell=False, capture=True)
/var/log/cloud-init.log:2024-01-26 11:47:38,516 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 13:26:00,587 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 13:26:25,002 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 14:37:34,484 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 14:38:05,565 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 14:46:54,308 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 14:47:19,119 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 15:06:57,497 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 15:07:22,845 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 15:22:34,506 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 15:23:01,216 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-26 15:42:22,328 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-26 15:42:47,693 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 08:46:24,339 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 08:46:49,825 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 08:51:49,049 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 08:52:14,076 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 13:16:16,484 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 13:16:41,634 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 13:18:48,836 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 13:19:13,965 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 13:22:26,210 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 13:22:51,316 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 13:24:59,325 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 13:25:23,657 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 13:36:00,249 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 13:36:24,889 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-01-29 14:46:43,354 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-01-29 14:47:08,405 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/cloud-init.log:2024-02-07 08:17:09,464 - util.py[DEBUG]: Attempting to remove /var/lib/cloud/instance/boot-finished
/var/log/cloud-init.log:2024-02-07 08:17:34,849 - util.py[DEBUG]: Writing to /var/lib/cloud/instance/boot-finished - wb: [644] 69 bytes
/var/log/syslog:Feb  7 08:17:24 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog:Feb  7 08:17:24 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 08:46:39 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 08:46:39 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 08:52:03 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 08:52:03 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 13:16:30 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 13:16:30 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 13:19:03 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 13:19:03 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 13:22:40 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 13:22:40 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 13:25:13 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 13:25:13 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 13:36:14 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 13:36:14 xxxxxxxxxx systemd[1]: Mounted /boot.
/var/log/syslog.1:Jan 29 14:46:57 xxxxxxxxxx systemd[1]: Mounting /boot...
/var/log/syslog.1:Jan 29 14:46:57 xxxxxxxxxx systemd[1]: Mounted /boot.

备注：内容来源于stack exchange，提问作者PrestonDocks