X2Go Bug report logs - #504
nxagent fails to come up on servers using

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: Orion Poplawski <orion@cora.nwra.com>

To: submit@bugs.x2go.org

Subject: Fwd: [Bug 1100985] New: x2go clients fail to connect to servers using polyinstantiated /tmp directories

Date: Tue, 27 May 2014 13:40:08 -0600

Package: x2goserver


-------- Original Message --------
Subject: [Bug 1100985] New: x2go clients fail to connect to servers using 
polyinstantiated /tmp directories
Date: Sun, 25 May 2014 00:13:13 +0000
From: bugzilla@redhat.com
To: orion@cora.nwra.com

https://bugzilla.redhat.com/show_bug.cgi?id=1100985

            Bug ID: 1100985
           Summary: x2go clients fail to connect to servers using
                    polyinstantiated /tmp directories
           Product: Fedora EPEL
           Version: el6
         Component: x2goserver
          Assignee: orion@cora.nwra.com
          Reporter: rgm+rh@gnu.org
        QA Contact: extras-qa@fedoraproject.org
                CC: orion@cora.nwra.com



Hi,


Description of problem:

If the RHEL6 host that acts as the server for x2go has enabled polyinstantiated
/tmp directories as per

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/polyinstantiated-directories.html

then x2go clients cannot connect. They fail with

  The remote proxy closed the connection while negotiating
  the session. This may be due to the wrong authentication
  credentials passed to the server.

It seems that x2go needs the directory /tmp/.X11-unix/ to exist, be owned
by root, and be mode 1777.


Version-Release number of selected component (if applicable):

x2goserver-4.0.1.13-4.el6.x86_64
RHEL 6.5


How reproducible:

100%.


Steps to Reproduce:
1. Uncomment the line in /etc/security/namespace.conf that reads:
#/tmp     /tmp-inst/           level      root,adm

2. Try to log in to that host via x2goclient.


Actual results:

x2go fails.


Expected results:

x2go works.


Additional info:

A workaround is to add something like the following to the end of
/etc/security/namespace.init:

if [ "$1" = "/tmp" ]; then
    XSOCKDIR=/tmp/.X11-unix
    if [ ! -d $XSOCKDIR ]; then
        mkdir $XSOCKDIR
        chmod 1777 $XSOCKDIR
    fi
fi

It would be great if x2go could fix this itself though.
Ideally it would either not need /tmp/.X11-unix, or be able to create it itself
when needed.


Thanks.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.

Message #10 received at 504@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: Orion Poplawski <orion@cora.nwra.com>, 504@bugs.x2go.org

Subject: Re: [X2Go-Dev] Bug#504: Fwd: [Bug 1100985] New: x2go clients fail to connect to servers using polyinstantiated /tmp directories

Date: Sat, 31 May 2014 09:54:46 +0000

[Message part 1 (text/plain, inline)]

Control: retitle -1 nxagent fails to come up on servers using  
polyinstantiated /tmp directories
Control: reassign -1 nxagent
Control: blocks -1 #406

On  Di 27 Mai 2014 21:40:08 CEST, Orion Poplawski wrote:

> Package: x2goserver
>
>
> -------- Original Message --------
> Subject: [Bug 1100985] New: x2go clients fail to connect to servers  
> using polyinstantiated /tmp directories
> Date: Sun, 25 May 2014 00:13:13 +0000
> From: bugzilla@redhat.com
> To: orion@cora.nwra.com
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1100985
>
>             Bug ID: 1100985
>            Summary: x2go clients fail to connect to servers using
>                     polyinstantiated /tmp directories
>            Product: Fedora EPEL
>            Version: el6
>          Component: x2goserver
>           Assignee: orion@cora.nwra.com
>           Reporter: rgm+rh@gnu.org
>         QA Contact: extras-qa@fedoraproject.org
>                 CC: orion@cora.nwra.com
>
>
>
> Hi,
>
>
> Description of problem:
>
> If the RHEL6 host that acts as the server for x2go has enabled  
> polyinstantiated
> /tmp directories as per
>
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/polyinstantiated-directories.html
>
> then x2go clients cannot connect. They fail with
>
>   The remote proxy closed the connection while negotiating
>   the session. This may be due to the wrong authentication
>   credentials passed to the server.
>
> It seems that x2go needs the directory /tmp/.X11-unix/ to exist, be owned
> by root, and be mode 1777.
>
>
> Version-Release number of selected component (if applicable):
>
> x2goserver-4.0.1.13-4.el6.x86_64
> RHEL 6.5
>
>
> How reproducible:
>
> 100%.
>
>
> Steps to Reproduce:
> 1. Uncomment the line in /etc/security/namespace.conf that reads:
> #/tmp     /tmp-inst/           level      root,adm
>
> 2. Try to log in to that host via x2goclient.
>
>
> Actual results:
>
> x2go fails.
>
>
> Expected results:
>
> x2go works.
>
>
> Additional info:
>
> A workaround is to add something like the following to the end of
> /etc/security/namespace.init:
>
> if [ "$1" = "/tmp" ]; then
>     XSOCKDIR=/tmp/.X11-unix
>     if [ ! -d $XSOCKDIR ]; then
>         mkdir $XSOCKDIR
>         chmod 1777 $XSOCKDIR
>     fi
> fi
>
> It would be great if x2go could fix this itself though.
> Ideally it would either not need /tmp/.X11-unix, or be able to  
> create it itself
> when needed.
>
>
> Thanks.


-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Message #17 received at 504@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: Orion Poplawski <orion@cora.nwra.com>, 504@bugs.x2go.org

Subject: Re: [X2Go-Dev] Bug#504: nxagent aborts when /tmp is polyinstatiated

Date: Sat, 31 May 2014 09:57:02 +0000

[Message part 1 (text/plain, inline)]

Hi Orion,

On  Di 27 Mai 2014 21:40:08 CEST, Orion Poplawski wrote:

> Description of problem:
>
> If the RHEL6 host that acts as the server for x2go has enabled  
> polyinstantiated
> /tmp directories as per
>
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/polyinstantiated-directories.html
>

The problem here is that nxagent does not come up in the first place.

"""
mike@minobo:~/.x2go/C-mike-50-1401529831_stRTERMINAL_dp24$ cat session.log
Error: Aborting session with 'Cannot establish any listening sockets -  
Make sure an X server isn't already running'.
Session: Aborting session at 'Sat May 31 11:50:34 2014'.
Session: Session aborted at 'Sat May 31 11:50:34 2014'.
"""

Once this is fixed, we have to address several issues in x2goserver, I  
guess, which we will discuss under #406 [1].

Mike

[1] http://bugs.x2go.org/406
-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Message #22 received at 504@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 504-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 504@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as pending for release

Date: Wed, 11 Jun 2014 16:42:52 +0200 (CEST)

tag #504 pending
fixed #504 2:3.5.0.25
thanks

Hello,

X2Go issue #504 (src:nx-libs) reported by you has been
fixed in X2Go Git. You can see the changelog below, and you can
check the diff of the fix at:

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=656f29c

The issue will most likely be fixed in src:nx-libs (2:3.5.0.25).

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
commit 656f29cc631972002ec0fe1ee8f2ee53438f818d
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Wed Jun 11 16:35:13 2014 +0200

    Add 028_nx-X11_abstract-kernel-sockets.full.patch. Provide abstract local socket support for Linux based systems. This patch pulls in abstract socket relevant code from xtrans 1.2.7.

diff --git a/debian/changelog b/debian/changelog
index 9218a18..28deb71 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,9 @@ nx-libs (2:3.5.0.25-0x2go1) UNRELEASED; urgency=low
     available. (Fixes: #505).
   * Make 220_nxproxy-bind-loopback-only.full+lite.patch cleanly apply after
     having added 027_nxcomp_abstract-X11-socket.full+lite.patch.
+  * Add 028_nx-X11_abstract-kernel-sockets.full.patch. Provide abstract local
+    socket support for Linux based systems. This patch pulls in abstract
+    socket relevant code from xtrans 1.2.7. (Fixes: #504).
 
  -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de>  Wed, 07 May 2014 09:58:10 +0200
 

Message #34 received at 504-quiet@bugs.x2go.org (full text, mbox, reply):

From: Orion Poplawski <orion@cora.nwra.com>

To: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>, 504-quiet@bugs.x2go.org

Subject: Re: Bug#504: X2Go issue (in src:nx-libs) has been marked as pending for release

Date: Wed, 25 Jun 2014 09:28:17 -0600

On 06/11/2014 08:42 AM, Mike Gabriel wrote:
> tag #504 pending
> fixed #504 2:3.5.0.25
> thanks
>
> Hello,
>
> X2Go issue #504 (src:nx-libs) reported by you has been
> fixed in X2Go Git. You can see the changelog below, and you can
> check the diff of the fix at:
>
>      http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=656f29c
>
> The issue will most likely be fixed in src:nx-libs (2:3.5.0.25).

The OP tested this and it appears to be fixed.  Thanks.


-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion@nwra.com
Boulder, CO 80301                   http://www.nwra.com

Message #39 received at 504@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 504-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 504@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as closed

Date: Mon, 30 Jun 2014 14:24:38 +0200 (CEST)

close #504
thanks

Hello,

we are very hopeful that X2Go issue #504 reported by you
has been resolved in the new release (2:3.5.0.25) of the
X2Go source project »src:nx-libs«.

You can view the complete changelog entry of src:nx-libs (2:3.5.0.25)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=8d4317e7e4fccbe6906c5ba57b8d0101868f92f3;hp=460a3cb3911bbfb717d0259947fe05f68d964948

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:nx-libs
Version: 2:3.5.0.25-0x2go1
Status: RELEASE
Date: Mon, 30 Jun 2014 14:05:46 +0200
Fixes: 40 339 490 504 505 515 516
Changes: 
 nx-libs (2:3.5.0.25-0x2go1) RELEASED; urgency=low
 .
   [ Mihai Moldovan ]
   * Add 029_nxcomp_ppc64.full+lite.patch. Fix sockaddr handling on
     Big Endian systems (like PPC64). (Fixes: #515).
   * Add 057_nx-X11_sanitize-eventmasks.full.patch. Fix
     failures in session windows coming up on Big Endian systems
     like PPC64. (Fixes: #516).
   * Improve 105_nxagent_export-remote-keyboard-config.full.patch.
     Don't print out nonsensical information, if there really was
     no error when creating the keyboard file or the other way around.
     Also add the reason when failing to create the keyboard file.
     Only print an error message if SessionPath *really* is not defined.
   * Improve 028_nx-X11_abstract-kernel-sockets.full.patch. Make it more
     Big Endian robust by assigning correct types for socklen_t objects.
   * Add 990_fix-DEBUG-and-TEST-builds.full.patch. Fix debug builds (e.g.
     when globally setting -DDEBUG and -DTEST at build time).
 .
   [ Nito Martínez ]
   * Add 212_nxcomp_build-on-Android.patch. Fix FTBFS of nxproxy/nxcomp when
     build against the Android system. (Fixes: #339).
 .
   [ Oleksandr Shneyder ]
   * Add 210_nxagent_nxcomp_save_session_state.full+lite.patch. Save session
     state in path specified by "state" option in agent options file. If
     option is omitted, session state will not be saved. Session states are:
     STARTING, RUNNING, SUSPENDING, SUSPENDED, RESUMING, TERMINATING,
     TERMINATED.
   * Add 211_nxcomp_set_default_options.full+lite.patch. Set default arguments
     for options 'link' and 'pack' to avoid session damage by resuming with
     incorrect options file.
 .
   [ Mike Gabriel ]
   * Add 606_nx-X11_build-on-aarch64.full.patch. Build on aarch64
     architectures. (Fixes: #490).
   * Add 027_nxcomp_abstract-X11-socket.full+lite.patch. In proxy mode "server"
     let NX proxy attempt connecting to the abstract X11 socket first, and only
     fallback to the file system socket, if the abstract socket is not
     available. (Fixes: #505).
   * Add 028_nx-X11_abstract-kernel-sockets.full.patch. Provide abstract local
     socket support for Linux based systems. This patch pulls in abstract
     socket relevant code from xtrans 1.2.7. (Fixes: #504).
   * Add 302_nx-X11_xkbbasedir-detection.patch. For detecting XkbBaseDir
     test for xkb/rules/base instead of testing for deprecated file
     xkb/keymap.dir. (Fixes: #40).
   * Add 206_nxagent_clipboard-as-nxoption.full.patch. Make the clipboard
     option configurable in nxagent via NX options as addition to the
     command line parameter -clipboard. Note that the command line
     parameter overrides the clipboard NX option. Possible values are
     both or 1, client, server, none or 0.
 .
   * Update patches, to make them apply cleanly after above changes:
     + 220_nxproxy-bind-loopback-only.full+lite.patch
     + 016_nx-X11_install-location.debian.patch
     + 056_nx-X11-Werror-format-security.full.patch
     + 108_nxagent_wine-close-delay.full.patch
     + 300_nxagent_set-wm-class.full.patch
     + 320_nxagent_configurable-keystrokes.full.patch
 .
   * Rename patches to match our naming scheme:
     + 008_nxcomp_sa-restorer.full+lite.patch
     + 009_nxagent_add-man-page.full.patch
     + 009_nxproxy_add-man-page.full+lite.patch
     + 056_nx-X11_Werror-format-security.full.patch
     + 209_x2goagent_add-man-page.full.patch
     + 220_nxproxy_bind-loopback-only.full+lite.patch

Message #44 received at 504@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 504-submitter@bugs.x2go.org

Cc: control@bugs.x2go.org, 504@bugs.x2go.org

Subject: X2Go issue (in src:nx-libs) has been marked as closed

Date: Mon, 30 Jun 2014 14:24:35 +0200 (CEST)

close #504
thanks

Hello,

we are very hopeful that X2Go issue #504 reported by you
has been resolved in the new release (2:3.5.0.25) of the
X2Go source project »src:nx-libs«.

You can view the complete changelog entry of src:nx-libs (2:3.5.0.25)
below, and you can use the following link to view all the code changes
between this and the last release of src:nx-libs.

    http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=be23e057f28a6624380a91d1ba36cbf5df6c3fff;hp=460a3cb3911bbfb717d0259947fe05f68d964948

If you feel that the issue has not been resolved satisfyingly, feel
free to reopen this bug report or submit a follow-up report with
further observations described based on the new released version
of src:nx-libs.

Thanks a lot for contributing to X2Go!!!

light+love
X2Go Git Admin (on behalf of the sender of this mail)

---
X2Go Component: src:nx-libs
Version: 2:3.5.0.25-0x2go1
Status: RELEASE
Date: Mon, 30 Jun 2014 14:05:46 +0200
Fixes: 40 339 490 504 505 515 516
Changes: 
 nx-libs (2:3.5.0.25-0x2go1) RELEASED; urgency=low
 .
   [ Mihai Moldovan ]
   * Add 029_nxcomp_ppc64.full+lite.patch. Fix sockaddr handling on
     Big Endian systems (like PPC64). (Fixes: #515).
   * Add 057_nx-X11_sanitize-eventmasks.full.patch. Fix
     failures in session windows coming up on Big Endian systems
     like PPC64. (Fixes: #516).
   * Improve 105_nxagent_export-remote-keyboard-config.full.patch.
     Don't print out nonsensical information, if there really was
     no error when creating the keyboard file or the other way around.
     Also add the reason when failing to create the keyboard file.
     Only print an error message if SessionPath *really* is not defined.
   * Improve 028_nx-X11_abstract-kernel-sockets.full.patch. Make it more
     Big Endian robust by assigning correct types for socklen_t objects.
   * Add 990_fix-DEBUG-and-TEST-builds.full.patch. Fix debug builds (e.g.
     when globally setting -DDEBUG and -DTEST at build time).
 .
   [ Nito Martínez ]
   * Add 212_nxcomp_build-on-Android.patch. Fix FTBFS of nxproxy/nxcomp when
     build against the Android system. (Fixes: #339).
 .
   [ Oleksandr Shneyder ]
   * Add 210_nxagent_nxcomp_save_session_state.full+lite.patch. Save session
     state in path specified by "state" option in agent options file. If
     option is omitted, session state will not be saved. Session states are:
     STARTING, RUNNING, SUSPENDING, SUSPENDED, RESUMING, TERMINATING,
     TERMINATED.
   * Add 211_nxcomp_set_default_options.full+lite.patch. Set default arguments
     for options 'link' and 'pack' to avoid session damage by resuming with
     incorrect options file.
 .
   [ Mike Gabriel ]
   * Add 606_nx-X11_build-on-aarch64.full.patch. Build on aarch64
     architectures. (Fixes: #490).
   * Add 027_nxcomp_abstract-X11-socket.full+lite.patch. In proxy mode "server"
     let NX proxy attempt connecting to the abstract X11 socket first, and only
     fallback to the file system socket, if the abstract socket is not
     available. (Fixes: #505).
   * Add 028_nx-X11_abstract-kernel-sockets.full.patch. Provide abstract local
     socket support for Linux based systems. This patch pulls in abstract
     socket relevant code from xtrans 1.2.7. (Fixes: #504).
   * Add 302_nx-X11_xkbbasedir-detection.patch. For detecting XkbBaseDir
     test for xkb/rules/base instead of testing for deprecated file
     xkb/keymap.dir. (Fixes: #40).
   * Add 206_nxagent_clipboard-as-nxoption.full.patch. Make the clipboard
     option configurable in nxagent via NX options as addition to the
     command line parameter -clipboard. Note that the command line
     parameter overrides the clipboard NX option. Possible values are
     both or 1, client, server, none or 0.
 .
   * Update patches, to make them apply cleanly after above changes:
     + 220_nxproxy-bind-loopback-only.full+lite.patch
     + 016_nx-X11_install-location.debian.patch
     + 056_nx-X11-Werror-format-security.full.patch
     + 108_nxagent_wine-close-delay.full.patch
     + 300_nxagent_set-wm-class.full.patch
     + 320_nxagent_configurable-keystrokes.full.patch
 .
   * Rename patches to match our naming scheme:
     + 008_nxcomp_sa-restorer.full+lite.patch
     + 009_nxagent_add-man-page.full.patch
     + 009_nxproxy_add-man-page.full+lite.patch
     + 056_nx-X11_Werror-format-security.full.patch
     + 209_x2goagent_add-man-page.full.patch
     + 220_nxproxy_bind-loopback-only.full+lite.patch

Send a report that this bug log contains spam.