Incorrect syntax when writing to ~/.pam_environment

[Olivier Tilloy]

[Impact]

When the syntax for the entries in ~/.pam_environment was changed, the GUI in language-selector-gnome for maintaining the language priority list was broken since language-selector-gnome reads from ~/.pam_environment. The language-selector upload to artful makes language-selector-gnome handle both the old and the new syntax correctly.

An additional similar change to accountsservice (the update-langlist script) is needed; hence also an accountsservice upload to artful.

[Test Case]

* Log in to an "Ubuntu on Xorg" session.
* Open Language Support and find that it appears as if you can only
  set one item before the "English" item in the language list.

With the new version, it works as expected again.

[Regression Potential]

Low. This is necessary to fix the regression caused by the change in accountsservice.

[Original description]

While investigating bug #1662031, I found out that /usr/share/language-tools/save-to-pam-env writes to ~/.pam_environment using an incorrect syntax: "VARIABLE=value" on each line. The expected syntax is "VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]" (man pam_env.conf).

ProblemType: Bug
DistroRelease: Ubuntu 17.10
Package: accountsservice 0.6.42-0ubuntu2
ProcVersionSignature: Ubuntu 4.13.0-12.13-generic 4.13.3
Uname: Linux 4.13.0-12-generic x86_64
NonfreeKernelModules: zfs zunicode zavl zcommon znvpair
ApportVersion: 2.20.7-0ubuntu2
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Mon Oct 9 06:57:17 2017
EcryptfsInUse: Yes
InstallationDate: Installed on 2016-07-02 (463 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
SourcePackage: accountsservice
UpgradeStatus: Upgraded to artful on 2017-06-04 (126 days ago)

[Gunnar Hjalmarsson (gunnarhj)]

Hi Olivier / Sebastien,

Olivier's conclusion when debugging bug #1662031 (comment #13), that the simple VARIABLE=value syntax is incorrect for ~/.pam_environment, surprised me.

My belief is that it is correct. PAM ignores syntactically incorrect lines, and simple VARIABLE=value statements are not ignored. One of the most used sources for user guidance is this wiki page:

https://help.ubuntu.com/community/EnvironmentVariables#Session-wide_environment_variables

It tells us that the more complex syntax is required for variable expansion to work, but the entries written to ~/.pam_environment by accountsservice don't involve variable expansion.

Can it possibly be that messages like 'remove variable "LANG=fr_FR.UTF-8"', which were written when debugging, simply are informational messages which let you know the previous environment variable - set previously somehow, e.g. from /etc/default/locale - and which is replaced by a new one?

I admit, however, that I don't find support for my belief in the PAM man pages.

[Olivier Tilloy (osomon)]

When adding the "debug" parameter to the invokation of pam_env in /etc/pam.d/gdm-password, I'm seeing the following in journalctl:

oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("PATH=/usr/local/sbin:/usr/local/bin:/usr/
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LANG=en_US.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_NUMERIC=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_TIME=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_MONETARY=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_PAPER=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_NAME=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_ADDRESS=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_TELEPHONE=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_MEASUREMENT=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LC_IDENTIFICATION=es_ES.UTF-8")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): pam_putenv("LANGUAGE=en_US")
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LANGUAGE=fr_FR:en_GB:en"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LANG=fr_FR.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_NUMERIC=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_TIME=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_MONETARY=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_PAPER=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_NAME=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_ADDRESS=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_TELEPHONE=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_MEASUREMENT=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "LC_IDENTIFICATION=es_ES.UTF-8"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_env(gdm-password:session): remove variable "PAPERSIZE=a4"
oct 09 09:52:59 artfulvm gdm-password][1072]: pam_unix(gdm-password:session): session opened for user ubuntu by (uid=0)

The code for the _undefine_var() function in pam-env.c (https://github.com/linux-pam/linux-pam/blob/master/modules/pam_env/pam_env.c#L738) calls pam_putenv(pamh, v...

[Gunnar Hjalmarsson (gunnarhj)]

Hmm.. I just noticed this in "man pam_env":

"By default rules for (un)setting of variables is taken from the config file /etc/security/pam_env.conf if no other file is specified.

This module can also parse a file with simple KEY=VAL pairs on separate lines (/etc/environment by default)."

Doesn't that mean that the simple "KEY=VAL" syntax is documented after all?

[Olivier Tilloy (osomon)]

This is misleading. The syntax for envfile is "VARIABLE=value" pairs, whereas the syntax for user_envfile is that of pam_env.conf ("VARIABLE [DEFAULT=[value]] [OVERRIDE=[value]]"). The documentation leaves to be desired in that regard, but reading the code confirms that the two files are parsed and interpreted in different manners.

[Gunnar Hjalmarsson (gunnarhj)]

Thanks for clarifying, Olivier. Fix uploaded to the artful queue.

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 0.6.42-0ubuntu3

---------------
accountsservice (0.6.42-0ubuntu3) artful; urgency=medium

  * debian/patches/0009-language-tools.patch:
    - Use correct syntax when writing to ~/.pam_environment
      (LP: #1722151).

 -- Gunnar Hjalmarsson <email address hidden> Mon, 09 Oct 2017 23:08:00 +0200

[Gunnar Hjalmarsson (gunnarhj)]

This triggers another change to accountsservice...

[Launchpad Janitor (janitor)]

This bug was fixed in the package language-selector - 0.181

---------------
language-selector (0.181) bionic; urgency=medium

  * LanguageSelector/LocaleInfo.py:
    Adapt to changed syntax in ~/.pam_environment (LP: #1722151).
  * LanguageSelector/ImConfig.py:
    Prevent crash if LC_CTYPE is 'C' (LP: #1723318).
  * debian/control:
    Bump Standards-Version to 4.1.1.

 -- Gunnar Hjalmarsson <email address hidden> Fri, 27 Oct 2017 19:40:00 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 0.6.42-0ubuntu4

---------------
accountsservice (0.6.42-0ubuntu4) bionic; urgency=medium

  * debian/patches/0009-language-tools.patch:
    - Modification of the update-langlist script due to new
      ~/.pam_environment syntax (LP: #1722151).

 -- Gunnar Hjalmarsson <email address hidden> Fri, 27 Oct 2017 22:02:00 +0200

[Brian Murray (brian-murray)]

Hello Olivier, or anyone else affected,

Accepted accountsservice into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/accountsservice/0.6.42-0ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Brian Murray (brian-murray)]

Hello Olivier, or anyone else affected,

Accepted language-selector into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/language-selector/0.180.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Gunnar Hjalmarsson (gunnarhj)]

I installed the language-selector-{gnome,common} 0.180.1 and accountsservice 0.6.42-0ubuntu3.1 packages from artful-proposed.

As regards language-selector I verified the test case in the bug description.

As regards accountsservice, these steps show that it now works as expected:

1.
$ cat ~/.pam_environment | grep LANGUAGE
LANGUAGE DEFAULT=de_DE:sv:en

2.
Changing the language to "Swedish" from Settings -> Region & Language results in:

$ cat ~/.pam_environment | grep LANGUAGE
LANGUAGE DEFAULT=sv:de_DE:en

i.e. the language priority list is maintained instead of replaced with just "sv:en".

[Launchpad Janitor (janitor)]

This bug was fixed in the package language-selector - 0.180.1

---------------
language-selector (0.180.1) artful-proposed; urgency=medium

  * LanguageSelector/LocaleInfo.py:
    Adapt to changed syntax in ~/.pam_environment (LP: #1722151).

 -- Gunnar Hjalmarsson <email address hidden> Fri, 27 Oct 2017 19:43:00 +0200

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for language-selector has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 0.6.42-0ubuntu3.1

---------------
accountsservice (0.6.42-0ubuntu3.1) artful-proposed; urgency=medium

  * debian/patches/0009-language-tools.patch:
    - Modification of the update-langlist script due to new
      ~/.pam_environment syntax (LP: #1722151).

 -- Gunnar Hjalmarsson <email address hidden> Fri, 27 Oct 2017 22:15:00 +0200