unrelated changes are breaking qubes-gui-agent

[adrelanos]

Qubes OS version (e.g., R3.1):

R3.2 with Qubes testing repository

Affected TemplateVMs (e.g., fedora-23, if applicable):

whonix-ws

---

Expected behavior:

qubes-gui-agent should not break.

Actual behavior:

qubes-gui-agent service fails to start.

Steps to reproduce the behavior:

Start whonix-ws TemplateVM. Enable developers repository or otherwise upgrade to anon-ws-disable-stacked-tor version 2.2-1.

sudo whonix_repository --enable --repository developers

sudo apt-get update && sudo apt-get --yes install anon-ws-disable-stacked-tor

Then try starting anon-whonix which fails due to qubes-gui-agent service failing to start.

General notes:

sudo service qubes-gui-agent status

● qubes-gui-agent.service - Qubes GUI Agent
   Loaded: loaded (/lib/systemd/system/qubes-gui-agent.service; enabled)
   Active: failed (Result: exit-code) since Mon 2016-11-21 23:35:22 UTC; 2min 26s ago
  Process: 1177 ExecStopPost=/bin/rm -f /tmp/qubes-session-env /tmp/qubes-session-waiter (code=exited, status=0/SUCCESS)
  Process: 757 ExecStart=/usr/bin/qubes-gui $GUI_OPTS (code=exited, status=1/FAILURE)
  Process: 744 ExecStartPre=/bin/touch /var/run/console/user (code=exited, status=0/SUCCESS)
  Process: 704 ExecStartPre=/bin/mkdir -p /var/run/console (code=exited, status=0/SUCCESS)
 Main PID: 757 (code=exited, status=1/FAILURE)

Nov 21 23:35:22 host qubes-gui[757]: Waiting on /var/run/xf86-qubes-socket .....
Nov 21 23:35:22 host su[776]: Successful su for user by root
Nov 21 23:35:22 host su[776]: + ??? root:user
Nov 21 23:35:22 host su[776]: pam_unix(su:session): session opened for user...0)
Nov 21 23:35:22 host qubes-gui[757]: Ok, somebody connected.
Nov 21 23:35:22 host qubes-gui[757]: Connection to local X server established.
Nov 21 23:35:22 host qubes-gui[757]: XIO:  fatal IO error 11 (Resource temp...0"
Nov 21 23:35:22 host qubes-gui[757]: after 37 requests (36 known processed)...g.
Nov 21 23:35:22 host systemd[1]: qubes-gui-agent.service: main process exit...RE
Nov 21 23:35:22 host systemd[1]: Unit qubes-gui-agent.service entered faile...e.
Hint: Some lines were ellipsized, use -l to show in full.

sudo systemctl list-units --failed

  UNIT                    LOAD   ACTIVE SUB    DESCRIPTION
● qubes-gui-agent.service loaded failed failed Qubes GUI Agent

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.

1 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

sudo journalctl -u qubes-gui-agent | cat

-- Logs begin at Mon 2016-11-21 23:37:30 UTC, end at Mon 2016-11-21 23:38:19 UTC. --
Nov 21 23:35:22 host systemd[1]: Starting Qubes GUI Agent...
Nov 21 23:35:22 host systemd[1]: Started Qubes GUI Agent.
Nov 21 23:35:22 host qubes-gui[757]: Waiting on /var/run/xf86-qubes-socket socket...
Nov 21 23:35:22 host su[776]: Successful su for user by root
Nov 21 23:35:22 host su[776]: + ??? root:user
Nov 21 23:35:22 host su[776]: pam_unix(su:session): session opened for user user by (uid=0)
Nov 21 23:35:22 host qubes-gui[757]: Ok, somebody connected.
Nov 21 23:35:22 host qubes-gui[757]: Connection to local X server established.
Nov 21 23:35:22 host qubes-gui[757]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":0"
Nov 21 23:35:22 host qubes-gui[757]: after 37 requests (36 known processed) with 0 events remaining.
Nov 21 23:35:22 host systemd[1]: qubes-gui-agent.service: main process exited, code=exited, status=1/FAILURE
Nov 21 23:35:22 host systemd[1]: Unit qubes-gui-agent.service entered failed state.

I cannot make head or tail why that kind of diff...

• https://github.com/Whonix/anon-ws-disable-stacked-tor
• git diff 2.0-1 2.2-1

Could break qubes-gui-agent.

(The updated anon-ws-disable-stacked-tor doesn't work yet, but the bug I am reporting here is, that qubes-gui-agent shouldn't break easily.)

[adrelanos]

(The updated anon-ws-disable-stacked-tor doesn't work yet, but the bug I am reporting here is, that qubes-gui-agent shouldn't break easily.)

Actually anon-ws-disable-stacked-tor should work. (Does when installing it in AppVM and reloading environment variables from /etc/X11/Xsession.d/20torbrowser.) (Confused myself if also anon-shared-helper-scripts needs an update since this is supposed to become an important Whonix backport / stable upgrade.) Yet, I remain confused how that diff can break qubes-gui-agent.

[adrelanos]

(The updated anon-ws-disable-stacked-tor doesn't work yet, but the bug I am reporting here is, that qubes-gui-agent shouldn't break easily.)

Actually anon-ws-disable-stacked-tor should work. (Does when installing it in AppVM and reloading environment variables from /etc/X11/Xsession.d/20torbrowser.) (Confused myself if also anon-shared-helper-scripts needs an update since this is supposed to become an important Whonix backport / stable upgrade.) Yet, I remain confused how that diff can break qubes-gui-agent.

[adrelanos]

The following 3 issues might be regarded as follow-up bugs or bugs that can be possibly fixed?

---

sudo service qubes-gui-agent restart does not show any error, but it still does not work.

---

user@dom0 ~]$ qvm-run --pass-io anon-whonix-dev konsole

--> Starting Qubes GUId...
Connecting to VM's GUI agent: .exiting
ERROR(anon-whonix-dev): Cannot start qubes-guid!

---

sudo xl console anon-whonix-dev

login...

user@host:~$ konsole

[ 1789.953944] konsole[2157]: segfault at e0 ip 00007fb1da77eead sp 00007ffcd9ec0610 error 4 in libkdeui.so.5.14.2[7fb1da3f7000+461000]
Segmentation fault

[adrelanos]

The following 3 issues might be regarded as follow-up bugs or bugs that can be possibly fixed?

---

sudo service qubes-gui-agent restart does not show any error, but it still does not work.

---

user@dom0 ~]$ qvm-run --pass-io anon-whonix-dev konsole

--> Starting Qubes GUId...
Connecting to VM's GUI agent: .exiting
ERROR(anon-whonix-dev): Cannot start qubes-guid!

---

sudo xl console anon-whonix-dev

login...

user@host:~$ konsole

[ 1789.953944] konsole[2157]: segfault at e0 ip 00007fb1da77eead sp 00007ffcd9ec0610 error 4 in libkdeui.so.5.14.2[7fb1da3f7000+461000]
Segmentation fault

[marmarek]

Anything interesting in X log (in the VM)?

[marmarek]

Anything interesting in X log (in the VM)?

[adrelanos]

Partial /tmp/Xorg.0.log:

[     5.918] (EE) AIGLX: reverting to software rendering
[     5.919] (EE) AIGLX error: dlopen of /usr/lib/x86_64-linux-gnu/dri/swrast_dri.so failed (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so: cannot open shared object file: No such file or directory)
[     5.919] (EE) GLX: could not load software renderer
[     5.957] (EE) Failed to load module "evdev" (module does not exist, 0)
[     5.957] (EE) No input driver matching `evdev'
[     5.985] (EE) Server terminated successfully (0). Closing log file.

(Also just now sent the full to your by encrypted mail since I don't want to share all in public.)

[adrelanos]

Partial /tmp/Xorg.0.log:

[     5.918] (EE) AIGLX: reverting to software rendering
[     5.919] (EE) AIGLX error: dlopen of /usr/lib/x86_64-linux-gnu/dri/swrast_dri.so failed (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so: cannot open shared object file: No such file or directory)
[     5.919] (EE) GLX: could not load software renderer
[     5.957] (EE) Failed to load module "evdev" (module does not exist, 0)
[     5.957] (EE) No input driver matching `evdev'
[     5.985] (EE) Server terminated successfully (0). Closing log file.

(Also just now sent the full to your by encrypted mail since I don't want to share all in public.)

[marmarek]

It looks like anon-ws-disable-stacked-tor does change things related to X session. Namely /etc/X11/Xsession.d/20controlportfilt. I've tried to reproduce (successfully) and this is what I've found in ~user/.xsession-errors:

/usr/bin/xinit: connection to X server lost

waiting for X server to shut down (EE) Server terminated successfully (0). Closing log file.

ilt.sh: shopt: not found
Invalid config file: /etc/controlportfilt.d/*.conf
bash_n_exit_code: 127
bash_n_output:
bash: /etc/controlportfilt.d/*.conf: No such file or directory

[marmarek]

It looks like anon-ws-disable-stacked-tor does change things related to X session. Namely /etc/X11/Xsession.d/20controlportfilt. I've tried to reproduce (successfully) and this is what I've found in ~user/.xsession-errors:

/usr/bin/xinit: connection to X server lost

waiting for X server to shut down (EE) Server terminated successfully (0). Closing log file.

ilt.sh: shopt: not found
Invalid config file: /etc/controlportfilt.d/*.conf
bash_n_exit_code: 127
bash_n_output:
bash: /etc/controlportfilt.d/*.conf: No such file or directory

[marmarek]

I guess the script expect to be running by bash, but it is sourced (not executed) by another script (that Xsession one) which is just /bin/sh.

[marmarek]

I guess the script expect to be running by bash, but it is sourced (not executed) by another script (that Xsession one) which is just /bin/sh.

[adrelanos]

Indeed, that's a bug. I'll work on that.

Looks like one issue in /etc/X11/Xsession.d (before qubes-gui-agent?) can disrput the whole qubes-gui-agent. Do you think this can be made more robust?

[adrelanos]

Indeed, that's a bug. I'll work on that.

Looks like one issue in /etc/X11/Xsession.d (before qubes-gui-agent?) can disrput the whole qubes-gui-agent. Do you think this can be made more robust?

[marmarek]

The whole idea of /etc/X11/Xsession.d is to have some way to source scripts into session (to set env variables etc). If any of those scripts calls exit it will terminate the whole session. That's the price of sourcing vs executing.
So, to answer your question: don't call exit in /etc/X11/Xsession.d.

[marmarek]

The whole idea of /etc/X11/Xsession.d is to have some way to source scripts into session (to set env variables etc). If any of those scripts calls exit it will terminate the whole session. That's the price of sourcing vs executing.
So, to answer your question: don't call exit in /etc/X11/Xsession.d.

[adrelanos]

Alright. So this bug is actually invalid, not a Qubes bug.

Thanks so much for your very quick and nice help, @marmarek!

[adrelanos]

Alright. So this bug is actually invalid, not a Qubes bug.

Thanks so much for your very quick and nice help, @marmarek!