X2Go Bug report logs - #459
PolicyKit authentication within apps often fails

Full log

Message #25 received at 459@bugs.x2go.org (full text, mbox, reply):

Received: (at 459) by bugs.x2go.org; 22 Aug 2014 21:30:12 +0000
From mike.gabriel@das-netzwerkteam.de  Fri Aug 22 23:30:10 2014
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
	version=3.3.2
Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [88.198.48.199])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 770815DCA9
	for <459@bugs.x2go.org>; Fri, 22 Aug 2014 23:30:10 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [78.46.204.98])
	by freya.das-netzwerkteam.de (Postfix) with ESMTPS id 5BDF31EFC;
	Fri, 22 Aug 2014 23:30:09 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 39ED83BBE6;
	Fri, 22 Aug 2014 23:30:09 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de
Received: from grimnir.das-netzwerkteam.de ([127.0.0.1])
	by localhost (grimnir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id lwZudyZFoKcC; Fri, 22 Aug 2014 23:30:09 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTPS id EC7A13BBE5;
	Fri, 22 Aug 2014 23:30:08 +0200 (CEST)
Received: from p5B3B9266.dip0.t-ipconnect.de (p5B3B9266.dip0.t-ipconnect.de
 [91.59.146.102]) by mail.das-netzwerkteam.de (Horde Framework) with HTTP;
 Fri, 22 Aug 2014 21:30:08 +0000
Date: Fri, 22 Aug 2014 21:30:08 +0000
Message-ID: <20140822213008.Horde.R6akvt34g-EHKCIUuyh_tQ1@mail.das-netzwerkteam.de>
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: Michael DePaulo <mikedep333@gmail.com>
Cc: 459@bugs.x2go.org
Subject: Re: [X2Go-Dev] Bug#459: PolicyKit authentication within apps often
 fails
References: <CAMKht8hxORsAXk32K=9ruNpF-PYWLUeyVvWqyeMsZhhb4uTWEQ@mail.gmail.com>
 <20140820093115.Horde.TjoWeWlTUbpPl3j2vDFNFw1@mail.das-netzwerkteam.de>
 <CAMKht8jYno1FNzfcmmo29SMHO4fx6e78Q+zOLnbky0Sv5qtE-A@mail.gmail.com>
In-Reply-To: <CAMKht8jYno1FNzfcmmo29SMHO4fx6e78Q+zOLnbky0Sv5qtE-A@mail.gmail.com>
User-Agent: Internet Messaging Program (IMP) H5 (6.2.0)
Accept-Language: en,de
Organization: DAS-NETZWERKTEAM
X-Originating-IP: 91.59.146.102
X-Remote-Browser: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101
 Firefox/31.0 Iceweasel/31.0
Content-Type: multipart/signed; boundary="=_OOvMBLIgf6hKKypbDWT2XQ1";
 protocol="application/pgp-signature"; micalg=pgp-sha1
MIME-Version: 1.0

[Message part 1 (text/plain, inline)]

On  Mi 20 Aug 2014 16:04:03 CEST, Michael DePaulo wrote:

> On Wed, Aug 20, 2014 at 5:31 AM, Mike Gabriel
> <mike.gabriel@das-netzwerkteam.de> wrote:
>> Hi Michael,
>>
>>
>> On  So 23 Mär 2014 17:25:58 CET, Michael DePaulo wrote:
>>
>>> [...]
>>
>>
>> I just fixed #458 by exporting $XAUTHORITY in x2goruncommand.
>
> Thank you :)
>
>> Do you have any clue what this issue may be related to? As I don't have any
>> of the failing apps on Debian, I cannot reproduce your test results right
>> away.
>
> 2 possible theories:
> 1. We are not integrating with ConsoleKit and/or logind properly.
> (Although it appears that our integration with logind is better, since
> Fedora 20 works better than CentOS 6.)

On Debian systems all is handled via the /etc/X11/Xsession.d directory.

For RHEL et al I see this in the /etc/x2go/Xsession script:

"""
        CK_XINIT_SESSION=
        if [ -x /usr/bin/ck-xinit-session -a -z "$XDG_SESSION_COOKIE" ]; then
                CK_XINIT_SESSION="/usr/bin/ck-xinit-session"
        fi

        # At the time of integrating X2Go Xsession support for RHEL6 / Fedora
        # the Xsession stuff in Fedora/RHEL6 seems to be a little mess.
        # The proposed strategy is to have Xclients.$WM.sh files in
        # /etc/X11/xinit/Xclients.d. Currently, only wmx uses this mechanism.
        # As it is a described but rather unused ,,standard'' we will  
not support it
        # in X2Go for now, but leave it here as a reminder...

        # XCLIENTS_D=/etc/x2go/Xclients.d
        #if [ -d "$XCLIENTS_D" -a -x  
"$XCLIENTS_D/Xclients.${XSESSION_EXEC}.sh" ]; then
        #       exec -l $SHELL -c "$CK_XINIT_SESSION $SSH_AGENT  
$XCLIENTS_D/Xclients.$1.sh"
        #fi

        # switchdesk support is also totally deprecated in RHEL, but  
we leave it here
        # as a reminder, as well, in case we need it in the future  
for special setups...
        #if [ -x "$SWITCHDESKPATH/Xclients.${XSESSION_EXEC}" ]; then
        #       exec -l "$SHELL" -c  
"$SWITCHDESKPATH/Xclients.${XSESSION_EXEC}";
        #fi

        exec $CK_XINIT_SESSION $SSH_AGENT /bin/sh -c "exec -l $SHELL  
-c \"$STARTUP\""
"""

It has been derived from the X11 session startup on SL6. Maybe we need  
to tweak this CK_XINIT_SESSION variable and change over to using  
ck-launch-session here.

Maybe this is hint enough for you to play with this some more.?...

> 2. We have issues with the polcykit authentication windows not being
> permitted to show up.
>
> I think that there is different behavior when using XDMCP. I'll double
> check after work.

Ok. Any results?

> Also, Red Hat has some KB articles on this subject. I noticed them
> after I bought a RHEL subscription for home. I'll look over them
> again, and update this bug with any relevant info.
>
>> Any hint, if this issues also occurs on Debian?
>
> I can test this with VMs. I've already created some Debian VMs for
> compatibility testing with X2Go. Which of the 3 releases (squeeze,
> wheezy and jessie) should I test? Squeeze is similar to CentOS 6 in
> terms of versions of packages like ConsoleKit.

squeeze has CK and GNOMEv2, wheezy has CK and XFCE or GNOMEv3...
jessie has systemd and MATE, GNOMEv3, etc.

So I guess, you should stick with wheezy for CK testing and use jessie  
for systemd testing.

Mike#1

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.