Checkbox prompts for sudo password in terminal

[Brendan Donegan]

Urgh, it seems gksu is no longer included in Raring, so when time comes in Checkbox to prompt for the sudo password, it falls back to doing so on the terminal. This is not ideal since if Checkbox is not run via a terminal it won't be possible to get the password at all. Either way it's not very user friendly.

ProblemType: Bug
DistroRelease: Ubuntu 13.04
Package: checkbox 0.16.1+bzr2092+201304290826~quantal1 [origin: LP-PPA-checkbox-dev]
ProcVersionSignature: Ubuntu 3.8.0-19.29-generic 3.8.8
Uname: Linux 3.8.0-19-generic x86_64
ApportVersion: 2.9.2-0ubuntu8
Architecture: amd64
Date: Mon Apr 29 17:30:45 2013
InstallationDate: Installed on 2013-04-15 (14 days ago)
InstallationMedia: Ubuntu 12.04.2 LTS "Precise Pangolin" - Release amd64 (20130213)
MarkForUpload: True
SourcePackage: checkbox
UpgradeStatus: Upgraded to raring on 2013-04-26 (3 days ago)

[Jeff Lane  (bladernr)]

where are we pulling gksu from? According to apt-cache it's still in Main:

gksu:
  Installed: 2.0.2-6ubuntu2
  Candidate: 2.0.2-6ubuntu2
  Version table:
 *** 2.0.2-6ubuntu2 0
        500 http://us.archive.ubuntu.com/ubuntu/ raring/main amd64 Packages
        100 /var/lib/dpkg/status

[Jeff Lane  (bladernr)]

However, looking at debain/control, checkbox doesn't suggest or recommend gksu. it is a dependency by checkbox-gtk, but not by checkbox-qt:

Package: checkbox-gtk
Section: gnome
Architecture: all
Depends: checkbox (>= ${source:Version}),
         gir1.2-gtk-3.0,
         gksu,
         python3-gi,
         python3-gi-cairo,
         ${misc:Depends}
Description: GTK interface for checkbox
 This project provides an extensible interface for system testing. The
 results can then be sent to Launchpad.
 .
 This package provides a GTK interface for answering tests.

Package: checkbox-qt
Architecture: any
Depends: checkbox (>= ${source:Version}),
         libqt4-dbus,
         libqtgui4,
         python3-dbus,
         ${misc:Depends},
         ${shlibs:Depends}
Description: QT4 interface for checkbox
 This project provides an extensible interface for system testing. The
 results can then be sent to Launchpad.
 .
 This package provides a QT4 interface for answering tests.

So perhaps what needs to happen, assuming that A: gksu is still in Main, but NOT part of the base install for Ubuntu Desktop and B: because of this we never noticed it when installing checkbox-qt, we need to make gksu a dependency for checkbox-qt as well.

Time to fire up vbox and do an install to investigate.

[Daniel Manrique (roadmr)]

It's not part of the base install, so save for checkbox-gtk, we never explicitly declared it.

Before just going ahead and adding it as a dependency, we need to ask the desktop team; they were the ones who removed it from the desktop CD (to community upheaval) so if checkbox simply re-adds it there will be... trouble.

One thing to try would be modifying the plugins/backend_info to try to use pkexec (try gksu, if not present try pkexec, if not present either fall back to sudo). Then seeing if that works well as I recall plainbox using pkexec exposed some strange problems in the tests.

[Daniel Manrique (roadmr)]

OK, I tried this simplistic patch:

diff --git a/plugins/backend_info.py b/plugins/backend_info.py
index 7bc7611..ea17f8d 100644
--- a/plugins/backend_info.py
+++ b/plugins/backend_info.py
@@ -108,6 +108,10 @@ class BackendInfo(Plugin):
                 call(["pgrep", "-x", "-u", str(uid), "gnome-panel|gconfd-2"],
                     stdout=PIPE, stderr=PIPE) == 0:
             prefix = ["gksu", "--message", password_text, "--"]
+ elif os.getenv("DISPLAY") and \
+ call(["which","pkexec"],
+ stdout=PIPE, stderr=PIPE) == 0:
+ prefix = ["pkexec"]
         else:
             prefix = ["sudo", "-p", password_text + " " + password_prompt]

The first weird thing is that pkexec messes with the paths, so it needs an absolute path to work. Easiest way to get it is by setting CHECKBOX_SHARE to something absolute:

CHECKBOX_SHARE=$PWD PYTHON_PATH=. bin/checkbox-qt -w data/whitelists/default.whitelist

The second thing is that it doesn't work :/ try the super key test, which requires root, and it doesn't pop up the test window, so again, I think pkexec may be eating some environment settings that are needed for this to work.

[Jeff Lane  (bladernr)]

So fresh install of raring in vbox confirms that gksu is no longer installed by default, though it IS confirmed to still be in main.

[Jeff Lane  (bladernr)]

FWIW, according to the iso manifest[1], gksu and libgksu2-0 are both on
the CD, they just don't get installed by default.

It's still worth asking the desktop team, of course, however, it looks
to me like the making gksu a recommends won't add anything new to the ISO.

IIRC, using pkexec was just a nightmare. I believe the only option was
either prompt for password every time we need to run a root command or
prompt once and never see one again for the entire user session, which
arguably is a security problem.

[1] http://releases.ubuntu.com/raring/ubuntu-13.04-desktop-amd64.manifest

--
Jeff Lane - Hardware Certification Engineer and Test Tools Developer
Ubuntu Ham: W4KDH
Freenode IRC: bladernr or bladernr_
gpg: 1024D/3A14B2DD 8C88 B076 0DD7 B404 1417 C466 4ABD 3635 3A14 B2DD

[Daniel Manrique (roadmr)]

Fixed in checkbox rev 2272, it was reported as bug 1201769 which has the fix attached to it. I'll set this as Fix Released, then duplicate it to the other one.

[Daniel Manrique (roadmr)]

Er, my bad, it's bug 1097816.