[X2Go-Dev] Bug#458: Apps launched by pkexec fail to start on specific distros

[Michael DePaulo]

Package: x2goserver
Version: 4.0.1.13

Notes:

1. I am not sure if this is a bug in x2goserver, x2goserver-xsession,
or in nx-libs.

2. PolicyKit depends on ConsoleKit (and on systemd-logind in
newer distros.)

3. RHEL7 beta (systemd-logind) is not affected and pkexec commands do
work. However, PolicyKit authentication within apps fails. I will file
a separate bug about this.

4. I also tested CentOS 6.5 64-bit (ConsoleKit) and saw an issue that
precludes even testing for this bug.
(polkit-gnome-authentication-agent-1 fails to start) I wrote bug 457
about this.

5. The workaround I discovered is to set your XAUTHORITY env var. I
demonstrated this below.

Test system:
Ubuntu 12.04.4 32-bit
x2goserver: 4.0.1.13
x2goserver-xsession: 4.0.1.13
nx-libs: 3.5.0.22
mate-desktop: 1.6.0-3+precise from this apt repo:
deb http://packages.mate-desktop.org/repo/ubuntu precise main
(This distro uses ConsoleKit, not systemd-logind)

Test Case 1:
Unity desktop

(The authentication window opens and prompts me for my password both
times. Only the latter time does synaptic start.)

mike at mothership-u-p:~$ ps -ef | grep polkit
root       755     1  0 10:55 ?        00:00:01
/usr/lib/policykit-1/polkitd --no-debug
mike     25151 25098  0 11:51 ?        00:00:00
/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
mike     25515 25447  0 11:51 pts/0    00:00:00 grep --color=auto polkit
mike at mothership-u-p:~$ pkexec synaptic
No protocol specified
No protocol specified

(synaptic:25559): Gtk-WARNING **: cannot open display: :50
mike at mothership-u-p:~$ export XAUTHORITY=/home/mike/.Xauthority
mike at mothership-u-p:~$ pkexec synaptic
mike at mothership-u-p:~$

Test Case 2:
MATE desktop

(This time I am prompted to authentication on the command-line, which
works fine for me. I assume that me not being prompted the 2nd time is
intentional because sudo works in a similar manner. Only the latter
time does synaptic start.)

(And in case isn't clear, polkit-mate-authentication-agent-1 doesn't
start until I run the pkexec command the 1st time. This differs from
Unity where it is launched during login. When I login locally to MATE)

mike at mothership-u-p:~$ ps -ef | grep polkit
root       755     1  0 10:55 ?        00:00:01
/usr/lib/policykit-1/polkitd --no-debug
mike     21645 21522  0 11:46 pts/0    00:00:00 grep --color=auto polkit
mike at mothership-u-p:~$ pkexec synaptic
==== AUTHENTICATING FOR com.ubuntu.pkexec.synaptic ===
Authentication is required to run the Synaptic Package Manager
Authenticating as: Michael DePaulo,,, (mike)
Password:
==== AUTHENTICATION COMPLETE ===
No protocol specified
No protocol specified

(synaptic:21673): Gtk-WARNING **: cannot open display: :50.0
mike at mothership-u-p:~$ ps -ef | grep polkit
root       755     1  0 10:55 ?        00:00:01
/usr/lib/policykit-1/polkitd --no-debug
mike     21701 21379  0 11:47 ?        00:00:00
/usr/lib/polkit-mate/polkit-mate-authentication-agent-1
mike     21803 21522  0 11:47 pts/0    00:00:00 grep --color=auto polkit
mike at mothership-u-p:~$ export XAUTHORITY=/home/mike/.Xauthority
mike at mothership-u-p:~$ pkexec synaptic
mike at mothership-u-p:~$


Test Case 3:
MATE desktop from a local login

Same behavior as test case 2. I wanted to verify that
polkit-mate-authentication-agent-1 is not supposed to start until you
call pkexec, and that you are normally prompted to authentication on
the command-line.