Bug 12015 - IceWM does not run polkit agent (causing drakconf toolbar launcher icon to not work)
Summary: IceWM does not run polkit agent (causing drakconf toolbar launcher icon to no...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Atilla ÖNTAŞ
QA Contact:
URL:
Whiteboard: 6dev1
Keywords:
: 11304 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-12-16 15:10 CET by David Walser
Modified: 2015-12-15 15:32 CET (History)
6 users (show)

See Also:
Source RPM: drakconf-12.45-1.mga4.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2013-12-16 15:10:46 CET
After upgrading from Mageia 3, the toolbar launcher icon for MCC doesn't work.  In this case, the icon is still there, and the icewm-light package's configuration for this icon has it run the "mcc" command, which is still valid in Cauldron, so I don't think it's a case of the icon being broken like it is in KDE.  When I mcc from a terminal, it asks for a password in the terminal, so I'm guessing that when trying to launch it from the IceWM toolbar, it's failing to launch a GUI dialog asking for the password.

Reproducible: 

Steps to Reproduce:
David Walser 2013-12-16 15:11:05 CET

CC: sysadmin-bugs => mageia
Component: Release (media or process) => RPM Packages

Thierry Vignaud 2013-12-16 16:41:16 CET

Assignee: thierry.vignaud => bugsquad

Comment 1 Colin Guthrie 2013-12-16 16:54:56 CET
Does your IceWM session run a polkit agent?

Usually "ps aux | grep polk" will return both polkitd and your agent, although e.g. GNOME and Cinnamon run agents internally in their shells so they don't show up externally.

It could be simply that IceWM is not running an agent or it could be both that IceWM is not running and agent *and* it's panel does a double fork.

The former I've just explained how to test for - to check if that's the problem, install mate-polkit and run: /usr/libexec/polkit-mate-authentication-agent-1 (as your normal user) If it gives you an error that the "name is already taken" then you are running an agent already. If not, does this make everything work?

If some bits now work but panel is still broken, then run also "journalctl --all -f" (as your user) from a terminal and reproduce the problem. If you get a message about pkexec refusing to render service to dead parents, it's the double forking problem which needs to be patched in the launcher code of whatever is launching it.

HTHs narrow down where the problem lies.
Comment 2 David Walser 2013-12-16 20:25:36 CET
mate-polkit is already installed, and running the agent makes the icon work as expected.  Thanks Colin.

Assignee: bugsquad => mageia
Summary: drakconf toolbar launcher icon does not work in IceWM => IceWM does not run polkit agent (causing drakconf toolbar launcher icon to not work)

Comment 3 Colin Guthrie 2013-12-17 10:10:15 CET
Cool so perhaps we need a patch like this:
http://svnweb.mageia.org/packages?view=revision&revision=557078

Does IceWM support xdg autostart? Can you try quickly if adding IceWM to the OnlyShowIn line makes it launch automatically?
Comment 4 David Walser 2013-12-17 17:51:38 CET
(In reply to Colin Guthrie from comment #3)
> Cool so perhaps we need a patch like this:
> http://svnweb.mageia.org/packages?view=revision&revision=557078
> 
> Does IceWM support xdg autostart? Can you try quickly if adding IceWM to the
> OnlyShowIn line makes it launch automatically?

I just tried that; unfortunately it doesn't run it.
Comment 5 David Walser 2013-12-17 18:00:44 CET
Commenting out the OnlyShowIn line makes it run...so maybe there's a certain way you have to say icewm.  icewm, IceWM, Icewm, and ICEWM don't work.
Comment 6 David Walser 2013-12-17 18:22:22 CET
The xdg-compliance-autostart package from the xdg-compliance SRPM installs a script called /etc/X11/xinit.d/xdg-autostart that is responsible for running the XDG autostart stuff in IceWM.  Only in IceWM, it runs the command "xdg-autostart -r Old"

Looking at the xdg-compliance code, the list of valid environments to use in an OnlyShowIn line does not include IceWM, but it does include Old.  However, if you append "Old;" to the mate-polkit autostart file's OnlyShowIn line, and then run "xdg-autostart -r Old" in a terminal, you see:
/etc/xdg/autostart/polkit-mate-authentication-agent-1.desktop error: invalid value MATE;XFCE;Old;

I believe there is a bug in xdg-compliance and that it should not report it as invalid with Old in it.
Comment 7 David Walser 2013-12-17 19:04:52 CET
Oh, it's not Old that's making it report an error; MATE is an invalid environment value.  What would be the right way to fix this?
Comment 8 David Walser 2013-12-17 19:26:30 CET
OK, I've patched xdg-compliance to accept MATE as a valid environment, and changed mate-polkit to run under "Old" aka IceWM also in:
xdg-compliance-0.1-5.mga4
mate-polkit-1.6.0-8.mga4

This *should* fix this.
Comment 9 David Walser 2013-12-17 21:45:04 CET
I am concerned about one thing: how to know mate-polkit will be installed with icewm, and also in general.

We have KDE's polkit agent which has OnlyShowIn=KDE; and mate-polkit which has OnlyShowIn=MATE;XFCE;Old;, and both of those packages have a virtual provides of polkit-agent, which is required by GConf2 (and therefore, practically everything).

mate-polkit is explicitly required by cinnamon-session and mageia-windowmaker-desktop (which makes me wonder how they're running it, given the OnlyShowIn).

I'm actually surprised to find polkit-gnome (which also provides polkit-agent) is already installed on my Mageia 3 systems here, even though they also have polkit-kde-agent-1.  I would think that with with GConf2 requiring polkit-agent, and kdebase4-runtime requiring polkit-kde-agent-1 which provides polkit-agent, that would satisfy that dep and the installer wouldn't also install polkit-gnome/mate-polkit even though they're listed in /etc/urpmi/prefer.vendor.list.  Maybe I'm wrong the prefer.vendor.list is why it's installed and so we're good.

I'm just wondering if we've sufficiently covered making sure that different environments ensured that the polkit agent that they're actually going to use is installed.

Of course, it'd be marginally better if it was more flexible and each of the environments could use either polkit agent, just based on what's installed, not that it makes a huge difference whether you get a Gtk+ or Qt-based password dialog.
Comment 10 David Walser 2013-12-18 15:27:03 CET
Aside from the concern about ensuring that mate-polkit is installed, there is still an issue if startx is used to start IceWM.  In that case, xdg-autostart does not get run at all.  I see "xinit /etc/X11/xinit/xinitrc" in the process list, and that runs /etc/X11/Xsession which runs the scripts in /etc/X11/xinit.d, so it *should* run, but I'm guessing that when started this way, $DESKTOP is not set.  When logging in through KDM, it works fine.

There was also another issue where xdg-autostart would fail if ~/.config/autostart did not exist, but I just fixed that in xdg-compliance-0.1-6.mga4.
Comment 11 Colin Guthrie 2013-12-20 15:28:12 CET
(In reply to David Walser from comment #9)
> I am concerned about one thing: how to know mate-polkit will be installed
> with icewm, and also in general.
> 
> We have KDE's polkit agent which has OnlyShowIn=KDE; and mate-polkit which
> has OnlyShowIn=MATE;XFCE;Old;, and both of those packages have a virtual
> provides of polkit-agent, which is required by GConf2 (and therefore,
> practically everything).

Hmm, yeah, perhaps an explicit requires is better.

> mate-polkit is explicitly required by cinnamon-session and
> mageia-windowmaker-desktop (which makes me wonder how they're running it,
> given the OnlyShowIn).

So I don't know about windowmaker, but cinnamon only needs it for the fallback session. It might not be started properly at all but having looked at cinnamon code in the past they hard code a crap load of stuff in white and blacklists. It's a *really* ugly way to code. I think it's gotten marginally better recently but only after a lot of fighting with very stubborn cinnamon devs who just couldn't see that blacklists were a really bad design :(

Anyway, I quick hunt through likely sounding source packages and I cannot find anything obvious that starts it.

Probably one for the cinnamon maintainer to check and adapt mate-polkit accordingly. Of course, one big problem is that cinnamon pretends to be GNOME so we'd actually need a OnlyShowIn=GNOME for that to work and that would then break GNOME. There is a hack included in the cinnamon-sceensaver [edit: Hmm I cannot find it now - seems it's still broken and will start under GNOME *sigh* - cinnamon is just so broken :(]
 
> I'm actually surprised to find polkit-gnome (which also provides
> polkit-agent) is already installed on my Mageia 3 systems here, even though
> they also have polkit-kde-agent-1.  I would think that with with GConf2
> requiring polkit-agent, and kdebase4-runtime requiring polkit-kde-agent-1
> which provides polkit-agent, that would satisfy that dep and the installer
> wouldn't also install polkit-gnome/mate-polkit even though they're listed in
> /etc/urpmi/prefer.vendor.list.  Maybe I'm wrong the prefer.vendor.list is
> why it's installed and so we're good.

Can't say for sure, but perhaps something else pulled it in that has since gone. I dunno, but probably not worth disecting too much :)

> I'm just wondering if we've sufficiently covered making sure that different
> environments ensured that the polkit agent that they're actually going to
> use is installed.

There could easily be corner cases left so it's worth thinking about.

> Of course, it'd be marginally better if it was more flexible and each of the
> environments could use either polkit agent, just based on what's installed,
> not that it makes a huge difference whether you get a Gtk+ or Qt-based
> password dialog.

Yeah, the trend these days is to build the agent into your shell, so it's probably not a big deal going forward. dbus activation (which is what's used here) doesn't really have any contextual awareness. We probably could have a wrapper script but that's not really a nice approach either.
Comment 12 Colin Guthrie 2013-12-20 15:39:14 CET
Actually my comment about cinnamon-screensaver is not valid. The .desktop file is no longer an autostart one so it's fine.

Regarding startx, I'm not personally too worried about it as I don't see spending a huge amount of time for the (likely) <1% who insist on doing this. Starting a graphical session via startx is already broken and we've cobbled enough together to make it mostly work, but I'm not going to worry too much about it. People will always find ways to break things if you give them enough rope.

Longer term, startx will have to die as we move a CONFIG_VT-less system for text consoles and a Wayland system for graphics which is another reason why I'm not really that interested in spending time on it. Of course if it can be made to work then great, but not sure I'll be the one to do it!
Comment 13 Atilla ÖNTAŞ 2013-12-30 22:47:12 CET
I have committed icewm-1.3.7-12.mga4 and waiting freeze push. It adds xdg-compliance in icewm-light which was not required by default but needed to run a polkit-agent.

CC: (none) => tarakbumba

Comment 14 David Walser 2013-12-30 22:54:01 CET
(In reply to Atilla ÃNTAÅ from comment #13)
> I have committed icewm-1.3.7-12.mga4 and waiting freeze push. It adds
> xdg-compliance in icewm-light which was not required by default but needed
> to run a polkit-agent.

The commit is incorrect.  xdg-compliance is the source RPM, not the actual package.  The packages are already required by the icewm package, and they are xdg-compliance-menu and xdg-compliance-autostart (the latter of which being the one needed to get the polkit agent running).  So maybe the right thing to do would be to move that requires from icewm to icewm-light, but we should also think about why it's not on the light package in the first place.  I'd say the requires probably should be moved, but the light version is light on purpose to not pull in requires for things that aren't absolutely needed, and though it is needed for our drak tools to run from the toolbar or menu, it's debatable as to whether it's really needed.
Comment 15 Atilla ÖNTAŞ 2013-12-30 22:59:57 CET
(In reply to David Walser from comment #14)
No, xdg-compliance is the meta package to pull xdg-compliance-menu and xdg-compliance-autostart:

[atillaontas@dhcppc1 ~]$  urpmq -i xdg-compliance
Name        : xdg-compliance
Version     : 0.1
Release     : 6.mga4
Group       : Graphical desktop/Other
Size        : 0                            Architecture: x86_64
Source RPM  : xdg-compliance-0.1-6.mga4.src.rpm
URL         : http://gitorious.org/xdg-autostart/
Summary     : Packages to help old desktop environments follow XDG standards
Description :
This meta-package requires xdg-compliance-autostart and xdg-compliance-menu.

Well, you may right that icewm-light should be light as possible but with our draktools migration to polkit makes this move necessary. Just i think i should a silent commit to remove xdg-compliance-menu and xdg-compliance-autostart from icewm requires...
Comment 16 David Walser 2013-12-30 23:29:05 CET
OK, that's fine then.  I'd also remove that comment about it being there for polkit, as it's there for a lot more than just that.
Comment 17 Atilla ÖNTAŞ 2013-12-30 23:38:25 CET
(In reply to David Walser from comment #16)
I can remove that comment and i think i should also add mate-polkit to icewm-light requires. If we want to users should use draktools, am i right?
Comment 18 David Walser 2013-12-30 23:44:23 CET
(In reply to Atilla ÃNTAÅ from comment #17)
> (In reply to David Walser from comment #16)
> I can remove that comment and i think i should also add mate-polkit to
> icewm-light requires. If we want to users should use draktools, am i right?

Yes that sounds right.
Comment 19 Atilla ÖNTAŞ 2013-12-30 23:59:48 CET
(In reply to David Walser from comment #18)
I have made a silent commit. So, basically nothing changed except explicit requires. Should we close this bug report now? Or will discuss for startx and others in this report?
Comment 20 David Walser 2013-12-31 00:01:22 CET
(In reply to Atilla ÃNTAÅ from comment #19)
> (In reply to David Walser from comment #18)
> I have made a silent commit. So, basically nothing changed except explicit
> requires. Should we close this bug report now? Or will discuss for startx
> and others in this report?

The startx issue is probably WONTFIX.  Other than that, this can be closed as FIXED once the icewm package is pushed in Cauldron (bug reports shouldn't be closed when the changes have only been made in SVN).
Comment 21 claire robinson 2014-01-07 16:05:47 CET
Valid 4RC (so far) for drakconf in IceWM

CC: (none) => ennael1
Whiteboard: (none) => 4RC

Comment 22 David Walser 2014-01-07 16:11:58 CET
(In reply to claire robinson from comment #21)
> Valid 4RC (so far) for drakconf in IceWM

It shouldn't be valid anymore.  Do you have xdg-compliance-autostart and mate-polkit installed?
Comment 23 Colin Guthrie 2014-01-07 16:18:07 CET
Seems icewm just needs a push for this. Atilla, many thanks for the changes, but I don't think they should be silent ones. I've edited the log messages accordingly.

Claire, if you have a quick test case, can you: "urpmi xdg-complance mate-polkit" and check if things work? If so then a push is all that's needed.
Comment 24 Colin Guthrie 2014-01-07 16:18:51 CET
(it would help if you spell xdg-compliance correctly unlike me ;))
claire robinson 2014-01-07 16:25:07 CET

CC: (none) => eeeemail

Comment 25 Atilla ÖNTAŞ 2014-01-14 15:29:46 CET
(In reply to Colin Guthrie from comment #23)
Thanks Colin.

Claire, icewm pushed today. Please check if it solves the problem. Thanks
Comment 26 claire robinson 2014-01-14 16:50:49 CET
It's not available as an update yet, mirror timestamp shows it synced 30 mins ago, possible problem with the mirrors?
Comment 27 claire robinson 2014-01-14 17:01:06 CET
d-c is synced so changed mirrors.

To satisfy dependencies, the following package(s) also need to be installed:

- libmate-polkit1_0-1.6.1-1.mga4.i586
- mate-polkit-1.6.1-1.mga4.i586
- xdg-compliance-0.1-7.mga4.i586
- xdg-compliance-autostart-0.1-7.mga4.i586
- xdg-compliance-menu-0.1-7.mga4.i586

434KB of additional disk space will be used.


Confirming the added requires.
Comment 28 claire robinson 2014-01-14 17:03:42 CET
Confirmed fixed after logging out/in again. MageiaWelcome now starts and MCC authenticates as it should.
Comment 29 David Walser 2014-01-14 17:06:35 CET
I'll close this as FIXED now that icewm-1.3.7-12.mga4 has been pushed.

It would be nice if someone could verify that the other desktops that need mate-polkit all explicitly require it as well.

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 30 claire robinson 2014-01-14 17:09:07 CET
Seeing odd behaviour now with kde menu though. Kde's applications are relegated to the 'more >' 2nd tier in kde menu. Could this be a problem with xdg-compliance-menu ?
Comment 31 David Walser 2014-01-14 17:14:20 CET
(In reply to claire robinson from comment #30)
> Seeing odd behaviour now with kde menu though. Kde's applications are
> relegated to the 'more >' 2nd tier in kde menu. Could this be a problem with
> xdg-compliance-menu ?

Shouldn't be.  I've had xdg-compliance-menu installed on my KDE systems for as long as we've had it, since I always have the normal icewm package installed as well, which had required it before (as opposed to just icewm-light).
Comment 32 claire robinson 2014-01-14 17:17:46 CET
It was a clean kde install, the only change made was to update icewm-light with it's dependencies.
Comment 33 David Walser 2014-01-14 17:18:52 CET
(In reply to claire robinson from comment #32)
> It was a clean kde install, the only change made was to update icewm-light
> with it's dependencies.

I'll update my Cauldron install here soon, but it's only a couple weeks old and already had those packages installed and didn't have that issue.
Comment 34 Atilla ÖNTAŞ 2014-01-17 12:20:03 CET
*** Bug 11304 has been marked as a duplicate of this bug. ***

CC: (none) => inster.css

Comment 35 Atilla ÖNTAŞ 2015-12-06 02:09:16 CET
And we' re back here again. Testing Mageia-6-dev1-i586-DVD.iso today. Polkit agent does not runnign on Icewm. I think /etc/X11/xinit.d/xdg-autostart provided by xdg-compliance-autostart package is not running by default. After manually running
> xdg-autostart -r Old

mate-polkit started to run and MCC can be launched from icewm panel as expected.

Status: RESOLVED => REOPENED
Hardware: i586 => All
Resolution: FIXED => (none)
Whiteboard: 4RC => 6dev1

Comment 36 Atilla ÖNTAŞ 2015-12-06 02:19:38 CET
Ok. Modifying xdg-autostart.xinit file in xdg-compliance srpm like this make it work:

> # to be sourced
> case $DESKTOP_SESSION in
>     icewm)
> 	xdg-autostart -r Old
> 	;;
> esac

I' ll modify that file and upload into testing repo. Please test and reply. Thanks
Comment 37 Atilla ÖNTAŞ 2015-12-06 21:17:12 CET
My investigation shows these issues in xdg-compliance-autostart package:

- It doesnt get desktop environment needed by its xinit script. $DESKTOP variable is null. So, it doesn't run "xdg-autostart -r Old" command as expected.
- xdg-autostart segfaults when some .desktop files include "Unity" as a DE; like gnome-keyring package.
- xdg-autostart only looks for autostart directory in $XDG_CONFIG_HOME; it is supposed to look into both $XDG_CONFIG_HOME (~/.config/autostart) and $XDG_CONFIG_DIRS (/etc/xdg/autostart)

I made some changes and add/modify patches to fix these issues:

- Used $DESKTOP_SESSION in xinit script to ensure getting a non empty desktop variable. Now $DESKTOP_SESSION returns icewm as expected.

- I added Unity as a valid desktop to prevent it segfaulting.
- I couldn't make xdg-autostart to scan both $XDG_CONFIG_HOME (~/.config/autostart) and $XDG_CONFIG_DIRS (/etc/xdg/autostart) directories. So, i made it scan $XDG_CONFIG_DIRS (/etc/xdg/autostart) instead of $XDG_CONFIG_HOME to ensure mate-polkit is running as expected.

I've submitted xdg-compliance-0.1-11.mga6 with these modifications. Altough i tested it locally, find it solves mga#12015 and encounter no issues i need you test on different setups to ensure that i didn't break the system. So, please test it from core/updates_testing repository. Thanks.
Samuel Verschelde 2015-12-07 11:40:23 CET

Assignee: mageia => tarakbumba

Florian Hubold 2015-12-11 13:26:12 CET

CC: (none) => doktor5000

Comment 38 Atilla ÖNTAŞ 2015-12-15 15:32:12 CET
My tests show me that xdg-compliance-0.1-11.mga6 fixed this issue. So, closing this bug report again.

Status: REOPENED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.