debian/control must Recommends menu to run with elevated privileges in hardy

[Loell Anthony Erecre]

in hardy beta, there is no option or menu entry to run wireshark as root, this used to be available in gutsy,
this function is quite handy.

WORKAROUND/FIX:

These lines in wireshark-root.desktop simply need to be changed from:

TryExec=su-to-root
Exec=su-to-root -X -c /usr/bin/wireshark

back to:

TryExec=gksu
Exec=gksu -u root /usr/bin/wireshark

[douglas_smith (hamsterzombie-deactivatedaccount)]

Try this in terminal, "gksu -u root /usr/bin/wireshark" or create a shortcut with the command...

[douglas_smith (hamsterzombie-deactivatedaccount)]

Seems to be a question, not a bug...

"How can I add Wireshark (as roo)t to the Gnome Menu?"

Right click the Gnome Menu, Edit Menu, see if Wireshark (as Root) is listed under Internet and check it's box if it is.
If not, use the "gksu -u root /usr/bin/wireshark" command as a "New Item" and place where you like in the menu.
Have fun!

[Loell Anthony Erecre (loell)]

nope not a question, if you've actually used wireshark in gutsy then you know what i mean.

like i said this feature is offered in gutsy , unless there was a decision to remove this feature in hardy.

[Loell Anthony Erecre (loell)]

please don't carelessly convert this bug as a question...

[Loell Anthony Erecre (loell)]

its offered in gutsy, so its a bug..

[Marcel (marcel-launchpad)]

I can confirm this. Running Wireshark as a normal is not useful as you are not allowed to monitor any interfaces.

[douglas_smith (hamsterzombie-deactivatedaccount)]

I have used it in Gutsy and other distros going back to when it was still Ethereal. Sorry if you feel I carelessly flipped it to a question, but it is pretty straight-forward to add it (or any app) back to the menu. Application selection can and does change between versions in all distros, so I stand by calling it a question. At the worst it may be an oversight, but it is certainly not a bug...

Did you add it back using the process I offered and did it work?

And I do agree running wireshark as a normal user is pretty much a waste of time.

Regards

[douglas_smith (hamsterzombie-deactivatedaccount)]

I am not going to flip it back to a question (even tough it is), but IMHO, there are far more pressing issues that need dev attention than not having wireshark as root in the gnome menu by default. If you understand the data wireshark captures, there's no doubt you have the capacity to edit the gnome menu...

[Loell Anthony Erecre (loell)]

why do you insist that this is a question? if this is a question, i would have just ask in ubuntuforums.

i am fully capable of editing the menu, i already did before filing this.

clearly this was added in gutsy, find another bug thread to harass!!

 you are not an Ubuntu developer, they will be the judge on what priority level this bug is, not you.

[SK (stephantom)]

With the latest version in the Hardy repos, does this issue still happen to you?
I have the menu entry present and working here.

[Loell Anthony Erecre (loell)]

mine here, still has no root menu entry.

I did an update, remove wireshark and wireshark-common with a purge, and deleted the archive deb from the cache, and reinstalled wireshark, still no change in the menu entry.

[douglas_smith (hamsterzombie-deactivatedaccount)]

"Harassing?"
Nice-
Good luck, pal. I'm not wasting my time with this "bug" anymore and I did offer a solution (which you failed to mention you had already done in the first place)... Perhaps if you had offered that information in the original report I would not have been drawn in by a misguided interest in helping out. So you can save your clever remarks, I won't be reading them.
Part of this process is driven by user input to help unburden the devs. They make the call, yes, but people around here are throwing the B word about way too liberally. I did not tag this incomplete, by the way...
Regards

[Loell Anthony Erecre (loell)]

bye, hope you can help others though..

[Hew (hew)]

Just updated to Wireshark 1.0 and I can confirm this issue still exists. Gutsy had the root menu option but Hardy does not. Was this accidentally or intentionally removed? Without Wireshark as root, you cannot use the program for its primary purpose. Having to revert to a command is unsatisfactory; Gutsy had it right. If there is to be only one Wireshark option in the menu, then it should be the one that runs as root, but I believe most users who have chosen to install Wireshark would be happy having both options in their menu. It's better to have both options there by default (with the ability to disable them if desired), rather than having only the crippled option and having to add the useful one manually.

[SK (stephantom)]

As far as I can see the wireshark package does provide two .desktop files:

/usr/share/applications/wireshark-root.desktop
/usr/share/applications/wireshark.desktop

They're both present, visible and working in my default installation. Can you verify that these files exist in your system (and are provided by the wireshark package). You can see which files a package has installed by right clicking it in Synaptic and selecting Properties, then go to "Installed Files".

[Hew (hew)]

Yes, both files exist, and they are listed as installed by wireshark through synaptic.

I created a diff between wireshark.desktop and wireshark-root.desktop in case it is useful to you.

[Albert Damen (albrt)]

I just run into the same problem. The wireshark-root desktop file has the line: TryExec=su-to-root. However, the su-to-root program did not exist on my system. It is provided by the "menu" package, and installing this package made the wireshark (as root) option appear.

[David Pearce (halzia)]

8.04 release
I have recreated the "as root" menu entry with the gksu -u root /usr/bin/wireshark command line as in 7.10
When I select this, wireshark starts and asks for password.
The interfaces are shown in the capture menu
Selecting an interface causes the capture window to stop responding.

Running sudo wireshark in a terminal works normally

[Jim Hodapp (jhodapp)]

I have the same problem, no root menu entry. I've of course added this myself, but it doesn't seem to have come back at all even after fully upgrading to Hardy stable release.

[Hew (hew)]

gksu has simply been replaced with su-to-root. This should be an easy regression to fix. Can someone mark this as low priority? This simple bug needs to be shown some love :-)

Diff attached of wireshark-root.desktop from 0.99.6rel-3ubuntu0.1 (gutsy) to 1.0.0-1 (hardy).

[LosD (losd)]

This is of course a regression, and as such is pretty high-priority. Especially since Wireshark is useless (except for looking at old captures) without it.

This fix is even easy, letting Wireshark depend on menu.

btw, any (good) reasons for using Yet-another-Sudo-Replacement?

[Nathan Handler (nhandler)]

There were two solutions suggested in this thread. The first was replacing su-to-root with gksu in the .desktop file. The second was adding menu as a dependency of wireshark. I have prepared a debdiff for both of these suggestions.

[Nathan Handler (nhandler)]

wireshark (1.0.0-3ubuntu1) intrepid; urgency=low

  * Modify wireshark-root.desktop to use gksu instead
    of su-to-root (LP: #209084)
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Nathan Handler <email address hidden> Sat, 14 Jun 2008 13:22:20 -0500

[Nathan Handler (nhandler)]

wireshark (1.0.0-3ubuntu1) intrepid; urgency=low

  * Add menu as a wireshark dependency (LP: #209084)
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Nathan Handler <email address hidden> Sat, 14 Jun 2008 13:09:02 -0500

[Mathieu Gaspard (lukeg)]

As Hardy is LTS, shouldn't it be done in Hardy too?

[Hew (hew)]

Thank you Nathan for your patches! Now that I think about it, I'm not sure which would be better. The gksu fix would avoid the need for the extra menu package on gnome systems, and essentially revert back to the old behaviour. I assume the reasoning behind Debian changing to menu in the first place was to support the other desktop environments (eg. KDE). In this case, it's probably best to replace the existing recommend for gksu to menu (I assume there would then be no need for gksu?). Disclaimer: I'm not a developer, so if I'm way off the mark, feel free to completely discard my suggestions :-).

Mathieu: You're right. This would be nice to include for 8.04.1, since it's a regression from previous releases. Wireshark as root is broken as-is, so there shouldn't be a problem getting a SRU for this small fix.

[Nathan Handler (nhandler)]

Hewus, I did not notice that gksu was listed as a Recommended package. If we are replacing gksu with menu, then menu should probably be a recommended package instead of a dependency. Since most package managers automatically install recommended packages, we shouldn't run into any issues. Here is a new debdiff that simply replaces gksu with menu as a recommended package.

wireshark (1.0.0-3ubuntu1) intrepid; urgency=low

  * Replace gksu with menu in Recommends (LP: #209084)
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- Nathan Handler <email address hidden> Sun, 15 Jun 2008 09:41:30 -0500

[otzenpunk (reisswolf-nospam)]

> If we are replacing gksu with menu, then menu should probably be a recommended package instead of a dependency.

I think, I don't like that very much. I, for example, regularly disable automatic installation of recommended packages, and I'm sure I'm not alone. This is in this case no problem, because gksu is installed by default, but menu is not, and without a working "as root" menu entry, wireshark is near useless.

Although I understand, that that's maybe not the same on Kubuntu or other *buntu systems, so that there should better be a cross platform solution.

If you don't want to make menu a dependency, maybe there would be a way to recommend gksu | menu, (and maybe kdesudo, too) and use either one or the other? Perhaps a simple shell script wireshark_as_root which checks for the existence of various "become root" programs and execs one of it would do it.

[otzenpunk (reisswolf-nospam)]

I think, this thread may be of interest:

http://<email address hidden>/msg20136.html

[Hew (hew)]

If you disable the installation of recommended packages, then you have to accept a loss of functionality, such as the missing menu entry for the wireshark (root) option. Wireshark does not require gksu/menu to provide core functionality, so making it a dependency is inappropriate. For an advanced user who explicitly chooses not install this recommended package, I think it's reasonable for the entry not to exist. Remember, this is no different to the way it currently works (at least before this broken version); if you do not have gksu installed, then you have no root menu entry. Wireshark can still be used, but if the user makes the decision not to install the recommended package, it should be up to them to work around the missing functionality.

I think the best option here is the latest patch submitted by Nathan. Changing a single word solves our problems :-)

[Hew (hew)]

I posted before I read your last comment, otzenpunk. That is a great thread that really clears up the situation! This menu package is likely to become more important in future releases, so it is more likely to already be installed on a user's system anyway. The last patch by Nathan is the way to go.

[otzenpunk (reisswolf-nospam)]

@Hewus:
If menu will be the standard for that in the future, say in Intrepid, then it will certainly be o.k, and maybe a better solution than now. But currently, this would be a weird exception. Everything else uses gksu in their .desktop files on Ubuntu, be it wireshark-comparable tools like ettercap or etherape, or system tools like synaptic, gparted or display-config. Just grep for gksu resp. su-to-root in your /usr/share/applications and see what I mean.

This should not be decided on a per package basis, but by policy, and at the moment, either policy or best practice seems to be to use gksu. So I would prefer at least to include it with the same functionality as in Gutsy without mandatory recommendation/dependencies on another package with no other use for.

I agree with you, that a dependency on menu is not the right thing to do, because there may be one or the other, who only want to use wireshark to analyze logs or don't use the menu entries at all. So I would either prefer to stay with gksu, as it was in Gutsy and as other packages do it, or use gksu, su-to-root and maybe kdesudo as multiple working alternatives, like explained above.

gksu is already included in ubuntu-, xubuntu-, edubuntu- and gobuntu-desktop, and if you install recommended packages per default, as you say is the way to do, even many KDE users would have it already on their systems. I do not see the point of making a solo run here.

[otzenpunk (reisswolf-nospam)]

So my proposal is this:

The attachment is supposed to be installed as /usr/bin/wireshark-root. It tries su-to-root, gksu and kdesudo in this order, (although I don't know if I got the options for kdesudo right), and when nothing's there it opens x-terminal-emulator with plain sudo.

wireshark-root.desktop should include the following lines:
TryExec=wireshark-root
Exec=wireshark-root

And the wireshark package should recommend menu | gksu | kdesudo as alternatives.

[Nathan Handler (nhandler)]

Let me try to clear some things up. su-to-root "will automatically call either gksu (default) or kdesu (when being launched under KDE) for better integration into the running desktop environment." Otzenpunk's script seems to attempt to do the same thing. One issue I have come across is that menu does not suggests gksu, kdebase-bin, kdebase-runtime, or sux. It does not depend on them. As a result, By just adding menu as a recommended package in wireshark, we are not guaranteeing that the user is able to use gksu (or any of the variants). Personally, I think we should recommend menu in wireshark, and then try to get menu to depend on (instead of suggest) gksu, kdebase-bin, kdebase-runtime, or sux.

I am not sure what Debian/Ubuntu policy has to say about this. gksu is fine for use on Ubuntu. However, I don't think we should be using it for applications installed on Kubuntu. su-to-root was designed to solve this issue. I think it is much simpler to recommend menu, and then use su-to-root for the .desktop file than to have to create a custom shell script like Otzenpunk did, for each application that needs to be run as root.

[otzenpunk (reisswolf-nospam)]

> su-to-root "will automatically call either gksu (default) or kdesu (when being launched under KDE) for better integration into the running desktop environment."

Yes, I know that. I've just put it on top of my selection, because it tries to detect the currently running desktop environment, and so it calls kdesu on KDE even if you happen to have gksu installed, too. Thus it is the best choice, if you have it already on your system.

But we should differentiate between the better solution on the long run, and what to do now. Hardy is an LTS version at the beginning of its lifecycle, wireshark is nearly useless without root permissions and the absence of an appropriate menu entry is confusing to users. So there should come an updated package for Hardy, and I don't think that adding dependencies and doing it in a way totally different from every other package is the right thing to do.

Regarding the future, the Debian way seems to be to use su-to-root. But that doesn't mean for sure that Ubuntu will follow this way. Even among the Debian people it's not totally clear. If you've read the whole thread I've linked above, you've noticed that there are proposals to move su-to-root out of the menu package, either into debianutils or into its own stand-alone deb, to address the dependency/suggest problem you mentioned above.

But the Ubuntu policy on this topic should not be discussed here. I'm not a developer and I'm not very familiar with the way those things are handled but this is a design decision concerning the whole distribution and should be decided globally in a more central place than this is.

Bringing gksu back into the .desktop file would fix the regression for everyone using Gnome or Xfce and would at least keep the status quo for the others, too, which is they don't have the root entry in the menu. My proposal with this tiny script was, to make the situation better for this second group while not making it worse for anyone else. Not as a solution forever, but for Hardy and until the Ubuntu decision makers have made a generic choice how to handle this in the future.

[Nathan Handler (nhandler)]

You are right. The policy won't be decided by this bug. I have provided two different debdiffs. One of them uses gksu, and the other uses su-to-root. I feel there is no point in further debate over which is the better solution. We should let a MOTU make the final decision about which debdiff should be used.

[otzenpunk (reisswolf-nospam)]

That's ok for me, of course.

[Mackenzie Morgan (maco.m)]

The option is there in Hardy.

[Hew (hew)]

I don't think so. Make sure you don't mean the user-privilege Wireshark option, and also that you don't already have 'menu' installed.

The correct outcome should be two Wireshark menu entries; one for user, and one for root.

[Scott Kitterman (kitterman)]

Since recommends are installed by default in Intrepid, the point about recommends/depends is moot. su-to-root is the right way to solve the problem. Nothing more to do. Also, not SRU worthy for Hardy because there is an easy fix.

[Hew (hew)]

This has not been fixed in Intrepid (I just checked). Since Scott Kitterman confirms su-to-root is the correct option, the solution is to replace gksu with menu as Nathan Handler did with his last debdiff.

[Hew (hew)]

Subscribed ubuntu-universe-sponsors to take care of the latest debdiff posted by Nathan Handler. I removed the two earlier debdiffs of the same name to avoid confusion.

[Scott Kitterman (kitterman)]

Right. I got lost in the discussion and thought it was recommends menu already. Thanks for catching that.

[Nathan Handler (nhandler)]

Since we have come to an agreement about which debdiff should be used to patch this bug, I am setting the status of this bug to 'Confirmed' to ensure that it gets looked at by MOTUs in the ubuntu-universe-sponsors team.

[Scott Kitterman (kitterman)]

Currently we have wireshark (1.0.2-1) in the archive, so the debdiff needs updating.

[Nathan Handler (nhandler)]

wireshark (1.0.2-1ubuntu1) intrepid; urgency=low

  * Replace gksu with menu in Recommends (LP: #209084)
  * Bump Standards-Version to 3.8.0
    - Add debian/README.source

 -- Nathan Handler <email address hidden> Sun, 27 Jul 2008 08:42:05 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package wireshark - 1.0.2-1ubuntu1

---------------
wireshark (1.0.2-1ubuntu1) intrepid; urgency=low

  [ Nathan Handler ]
  * Replace gksu with menu in Recommends (LP: #209084)
  * Add debian/README.source

  [ Michael Casadevall ]
  * Corrected FTBFS on all architectures related to autotools and
    config.guess/config.status by allowing a check to fail in some cases

  [ Scott Kitterman ]
  * Remove 'Bump Standards-Version to 3.8.0'
    - Recommended against in Ubuntu Policy
  * Integrate changes from Nathan Handler and Michael Casadevall

 -- Scott Kitterman <email address hidden> Wed, 17 Sep 2008 21:36:52 -0400

[james kienlen (jnjkienlen)]

wireshark was freezing up when I tried with gksu so I:

1. sudo apt-get install menu

2. the recommended menu enrty still was causing problems so changed:

 su-to-root -X -c /usr/bin/wireshark
to
su-to-root -c /usr/bin/wireshark

and it works perfectly now

[Nathan Handler (nhandler)]

James, if possible, could you please try version 1.0.2-1ubuntu1 in Intrepid? As of Intrepid, recommended packages are installed automatically. This means that when you install wireshark, menu will also be installed. For me, this was enough to get the .desktop file to appear in the Applications menu. Could you please report back and let us know if this works for you?

[Brett Randall (javabrett)]

Since we have kernel 2.6.26 or better, could we automatically run (on Wireshark installation):

setcap cap_net_raw=+ep /usr/bin/dumpcap

? Allows capture as non-root, and seems better than a setuid root solution.

[Scott Kitterman (kitterman)]

Please file a new bug for this.

[bodhi.zazen (bodhi.zazen)]

I agree with Brett Randall

There is no need to run wireshark as root.

[Richard Laager (rlaager)]

bodhi.zazen: See bug #513903.