nm-applet icon not showing when /proc is mounted with hidepid!=0

[Simon Déziel]

Steps to reproduce:

1. (Re-)mount /proc with hidepid=1 (or =2)
2. Restart nm-applet

nm-applet's icon does not reappear after the restart. This used to work with version 1.0.

Original bug description:

Since I upgraded to -proposed network-manager and network-manager-gnome versions, nm-applet no longer works.
Manually starting it on a console give:

$ nm-applet

(nm-applet:6250): nm-applet-WARNING **: GDBus.Error:org.freedesktop.NetworkManager.AgentManager.PermissionDenied: Unable to determine request sender and UID.
(nm-applet:6250): libnm-CRITICAL **: nm_client_get_nm_running: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_get_state: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_networking_get_enabled: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_wireless_get_enabled: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_wireless_hardware_get_enabled: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_wwan_get_enabled: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_wwan_hardware_get_enabled: assertion 'NM_IS_CLIENT (client)' failed
(nm-applet:6250): libnm-CRITICAL **: nm_client_get_devices: assertion 'NM_IS_CLIENT (client)' failed

What's odd is the NM and NM-gnome base versions are not identical:

$ apt-cache policy network-manager network-manager-gnome
network-manager:
  Installed: 1.1.93-0ubuntu1
  Candidate: 1.1.93-0ubuntu1
  Version table:
 *** 1.1.93-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     1.0.4-0ubuntu10 500
        500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages
network-manager-gnome:
  Installed: 1.1.93-1ubuntu1
  Candidate: 1.1.93-1ubuntu1
  Version table:
 *** 1.1.93-1ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     1.0.10-1ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: network-manager-gnome 1.1.93-1ubuntu1
ProcVersionSignature: Ubuntu 4.4.0-18.34-generic 4.4.6
Uname: Linux 4.4.0-18-generic x86_64
NonfreeKernelModules: zfs zunicode zcommon znvpair zavl
ApportVersion: 2.20.1-0ubuntu1
Architecture: amd64
CurrentDesktop: Unity
Date: Mon Apr 11 08:16:59 2016
NetworkManager.state:
 [main]
 NetworkingEnabled=true
 WirelessEnabled=true
 WWANEnabled=true
 WimaxEnabled=true
RfKill:
 0: phy0: Wireless LAN
  Soft blocked: no
  Hard blocked: no
SourcePackage: network-manager-applet
UpgradeStatus: No upgrade log present (probably fresh install)
nmcli-con:
 Error: command ['nmcli', '-f', 'all', 'con'] failed with exit code 1:
 (process:7301): nmcli-CRITICAL **: Error: Could not create NMClient object: Unable to authenticate request..
nmcli-dev:
 Error: command ['nmcli', '-f', 'all', 'dev'] failed with exit code 1:
 (process:7297): nmcli-CRITICAL **: Error: Could not create NMClient object: Unable to authenticate request..
nmcli-nm: Error: command ['nmcli', '-f', 'all', 'nm'] failed with exit code 2: Error: Object 'nm' is unknown, try 'nmcli help'.

[Mathieu Trudel-Lapierre (cyphermox)]

The errors there look like the issue would be about NetworkManager not running. Are you sure it is started at the time? You wouldn't then have to restart nm-applet -- nm-applet does not show if it can't talk to NM.

Otherwise, I suppose there may be issues with policykit or some other authentication system:
(nm-applet:6250): nm-applet-WARNING **: GDBus.Error:org.freedesktop.NetworkManager.AgentManager.PermissionDenied: Unable to determine request sender and UID.

Neither PolicyKit or polkit-gnome have changed in a while. Could you please stop NetworkManager and restart it with debug logs? Steps below.

sudo systemctl stop NetworkManager
sudo /usr/sbin/NetworkManager --debug > ~/nm-debug.log

Then attach nm-debug.log; I expect it will show some hint as to the authentication issue somewhere near the top of the log.

[Simon Déziel (sdeziel)]

So I stopped NM and started it back only to notice that my old nm-applet was still running (still no icon). To be sure I was doing it the way you needed I killed nm-applet, then started NM with --debug (that's what I've attached).

When NM was running with --debug, it didn't spawn nm-applet but I saw /usr/lib/NetworkManager/nm-dispatcher being invoked, not sure if that's relevant though.

So at this point no nm-applet was showing up on its own so I started one manually. This time, no warning nor anything was shown on the console, nm-applet was just sitting there. Still no nm-applet icon though.

[Hideki Saito (hideki-g)]

After verifying systemctl status network-manager that it is running, it seems to be every interaction from the user seems to be failing.

sudo nmcli g
(process:3936): nmcli-CRITICAL **: Error: Could not create NMClient object: Unable to authenticate request..
sudo nmcli c
(process:3943): nmcli-CRITICAL **: Error: Could not create NMClient object: Unable to authenticate request..

I have verified network connection can't be modified any way from Gnome3, Unity (through system settings) including, changing the network setting (dialog won't even show), connecting to different Wi-Fi access point (never takes effect), turn the wi-fi off (again, nothing happens.)

NetworkManager[1174]: <info> [1461354274.8795] audit: op="connection-add-activate" result="fail" reason="Failed to get request UID."
NetworkManager[1174]: <info> [1461354295.8910] audit: op="radio-control" arg="wireless-enabled:0" result="fail" reason="Could not determine request UID."
NetworkManager[1174]: <info> [1461354296.9988] audit: op="radio-control" arg="wireless-enabled:1" result="fail" reason="Could not determine request UID."

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Hideki Saito (hideki-g)]

I think I see what's going on.
This seems to happen when hidepid is set to anything other than 0. Remounted /proc with hidepid=0 and this seems to be fixed. Though, it used to work with other hidepid option, and is still an issue, but this may be an workaround for those affected...

[Simon Déziel (sdeziel)]

On 2016-04-22 05:08 PM, Hideki Saito wrote:
> I think I see what's going on. This seems to happen when hidepid is
> set to anything other than 0.

Hmm, I use hidepid=2,gid=27. Where gid 27 is the sudo group which I'm
part of. Nice catch.

It would be really nice not to have to resort to hidepid=0 to get
nm-applet working. The hidepid feature is really nice to have.

Thanks,
Simon

[Hideki Saito (hideki-g)]

"Could not determine request UID" gave me a hint perhaps failing to get correct user from proc :-)

This may be a bit more global issue rather than something confined to Network Manager considering gdm3 also fails to boot with this option on. (Haven't really dig deep, but perhaps systemd, polkit, consolekit, who knows...)

[Mathieu Trudel-Lapierre (cyphermox)]

Indeed, the fact that this fails because of hidepid means it's something more systemic than nm-applet -- the bug should be reported upstream, and we need to find out all the processes impacted by this (probably quite many things that depend on DBus, if I was to guess).

[Alberto Salvia Novella (es20490446e)]

Please:

1. Report to (http://tinyurl.com/jc88oby).
2. Paste the new report link here.
3. Set this bug status back to "confirmed".

Thank you.

[Simon Déziel (sdeziel)]

Thanks Alberto. https://bugzilla.gnome.org/show_bug.cgi?id=769324

[Simon Déziel (sdeziel)]

This was fixed upstream: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=3d505b3f87c9cb9bfdc9b9a1fc67f57330701d03

[Simon Déziel (sdeziel)]

The upstream patch was included in NM 1.2.2 so Yakkety is not affected, only Xenial is.

The attached debdiff contains the upstream patch backported to Xenial. The resulting package resolve the issue. If anything is missing for the SRU process, please let me know.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "lp1568829.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Sebastien Bacher (seb128)]

The fixed version is in yakkety and there is a SRU waiting in the review queue which includes that change

[Simon Déziel (sdeziel)]

Thanks Aron and Sebastien, I can confirm that version 1.2.2-0ubuntu0.16.04.1 from xenial-proposed fixes the problem.