unity8 fails to start as guest user

[Timo Aaltonen]

This is shown in unity8.log:

[2016-11-23 15:59:25.820868] mirserver: Starting
ERROR: /build/mir-JY573_/mir-0.24.1+16.10.20160928/src/server/graphics/default_configuration.cpp(132): Throw in function mir::DefaultServerConfiguration::the_graphics_platform()::<lambda()>
Dynamic exception type: boost::exception_detail::clone_impl<boost::exception_detail::error_info_injector<std::runtime_error> >
std::exception::what: Exception while creating graphics platform
ERROR: /build/mir-JY573_/mir-0.24.1+16.10.20160928/src/server/graphics/nested/mir_client_host_connection.cpp(245): Throw in function mir::graphics::nested::MirClientHostConnection::MirClientHostConnection(const string&, const string&, const std::shared_ptr<mir::shell::HostLifecycleEventListener>&)
Dynamic exception type: boost::exception_detail::clone_impl<boost::exception_detail::error_info_injector<std::runtime_error> >
std::exception::what: Nested Mir Platform Connection Error: Failed to connect to server socket: Permission denied

[2016-11-23:15:59:35.820] ERROR: QMirServer - Mir failed to start
initctl: No such variable: UNITY_MIR_SOCKET

running current zesty, but I had the same problem on yakkety too.

[Michał Sawicz (saviq)]

The "Permission denied" error suggests the apparmor profile, or whatever else lightdm is doing special to the guest session, is the reason for this failure.

Can you check in syslog if you have a DENIED message from apparmor?

[Christopher Townsend (townsend)]

This has been the case since day 1 of Unity on the desktop. See bug #1307618. Not sure why we never added unity8 to that bug, so let's dupe that bug to this one.

[Christopher Townsend (townsend)]

Err, I meant Unity *8* on the desktop:)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Timo Aaltonen (tjaalton)]

dmesg shows these:
[ 58.054017] audit: type=1400 audit(1479927387.876:54): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/sys/kernel/cap_last_cap" pid=3034 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[ 58.076612] audit: type=1400 audit(1479927387.900:55): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/sys/kernel/cap_last_cap" pid=3048 comm="gnome-keyring-d" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[ 58.148996] audit: type=1400 audit(1479927387.972:56): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/3081/fd/" pid=3081 comm="gpg-agent" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[ 58.465172] audit: type=1400 audit(1479927388.288:57): apparmor="DENIED" operation="connect" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/snapd.socket" pid=3195 comm="content-hub-pee" requested_mask="w" denied_mask="w" fsuid=998 ouid=0
[ 58.467504] audit: type=1400 audit(1479927388.288:58): apparmor="DENIED" operation="connect" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/snapd.socket" pid=3195 comm="content-hub-pee" requested_mask="w" denied_mask="w" fsuid=998 ouid=0
[ 58.552978] audit: type=1400 audit(1479927388.376:59): apparmor="DENIED" operation="bind" profile="/usr/lib/lightdm/lightdm-guest-session" pid=3184 comm="ibus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="bind" denied_mask="bind" addr="@/tmp/ibus/dbus-JNJFS8e2"

[Oliver Grawert (ogra)]

related to bug 1593407 ?

[Timo Aaltonen (tjaalton)]

looks like it

[Daniel van Vugt (vanvugt)]

Probably not related directly to bug 1593407. Because duplicate bug 1307618 shows we've had this problem since 2014, before snaps existed.

[Michael Terry (mterry)]

OK, I've got a branch up that adds permission to talk to the USC mir_socket to lightdm's apparmor profile for guests.

Bug 1593407 is indeed separate (though it also will involve editing the guest apparmor profile). Not only can snaps not be run in a guest session, but they aren't listed in the app drawer either, because we can't talk to snapd.

When testing this, I also noticed a bug in unity8. The screen gets locked due to a timeout. But the guest user can't unlock the screen. Looking at that.

[Michael Terry (mterry)]

Hmm, unity8 also doesn't show the "this session and all its data will be deleted when you log out" warning that unity7 does. Because zenity isn't allowed to connect to Mir. Looking at how we might deal with that.

[Michael Terry (mterry)]

Filed bug 1673097 about the guest session dialog.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity8 - 8.15+17.04.20170321-0ubuntu1

---------------
unity8 (8.15+17.04.20170321-0ubuntu1) zesty; urgency=medium

  [ Albert Astals Cid ]
  * Signal aboutToShow (LP: #1664578)
  * Support Panel top level items to be disabled (LP: #1670694)
  * Improve Launcher ←→ touch menu interaction (LP: #1667620, #1671069)
  * Fix real world submenus (e.g. kate) not getting their first item
    selected on open (LP: #1666859)

  [ Daniel d'Andrada ]
  * Really disable the window decoration when in staged mode (LP:
    #1670361)
  * Don't let clients resize their surfaces while in staged
    (phone/tablet) mode (LP: #1670390)
  * TopLevelWindowModel: don't put hidden windows in the model (LP:
    #1665286)

  [ Lukáš Tinkl ]
  * Reset always-show-osk gsetting on startup to default value (false
    atm)
  * Fix the restored-to position with Miral due to the state changes
    being async (LP: #1669819)
  * Add a cursor name fallback mapping "grabbing" -> "closedhand" for
    Breeze
  * Fix unsnapping a maximized window from the panel (LP: #1671721)
  * Disable altDrag feature outside windowed mode

  [ Michael Terry ]
  * Don't lock the screen for guest users or users in the nopasswdlogin
    group. (LP: #1644237)
  * Support GNOME-style logout DBus API (making the Logout, Reboot, and
    Shutdown launcher commands work) (LP: #1673229)

  [ Michael Zanetti ]
  * Add support for closing apps from the spread with "Q" (LP: #1670327)
  * hide "private" launcher quicklist entries when the greeter is locked
    (LP: #1667649)
  * add surface titles to launcher's quicklist (LP: #1661668)
  * properly reset the drawer state when cancelling a horizontal drag
    (LP: #1669536)
  * fix the focus moving correctly between launcher and drawer (LP:
    #1669880)
  * unfocus the drawer's textfield when it is moved (LP: #1669839)

  [ Pete Woods ]
  * Fix up indicators-client after refactoring (LP: #1672797)

 -- Michał Sawicz <email address hidden> Tue, 21 Mar 2017 10:58:13 +0000

[Michael Terry (mterry)]

lightdm (1.22.0-0ubuntu1) zesty; urgency=medium

  * Allow guest sessions to talk to Mir (allowing unity8)

 -- Robert Ancell <email address hidden> Wed, 22 Mar 2017 09:46:38 +1300