Bug 7755 - gksudo does not work
: gksudo does not work
Status: VERIFIED FIXED
Product: Desktop Bugs
Classification: ROSA Desktop
Component: Main Packages
: Fresh
: All Linux
: Normal normal
: ---
Assigned To: ROSA Linux Bugs
: ROSA Linux Bugs
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-03-03 13:00 MSK by Vladimir Potapov
Modified: 2017-12-12 05:39 MSK (History)
2 users (show)

See Also:
RPM Package: sudo-1.8.19p2-3.src.rpm
ISO-related:
Bad POT generating:
Upstream:
andrey.bondrov: qa_verified?


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Potapov 2017-03-03 13:00:00 MSK
gksu work, gksudo segfault
Comment 1 Dmitry Mikhirev 2017-05-26 16:48:32 MSD
The reason why gksudo is unuseable is that the `requiretty' option is enabled by default in /etc/sudoers. This setting does not allow sudo to accept the password from gksudo.

The `requiretty' option also causes numerous other problems while not providing additional security. Please consider disabling it in default sudoers file.

Related bug reports for RHEL (closed as ERRATA) and Fedora (fixed 3 years ago):

https://bugzilla.redhat.com/show_bug.cgi?id=1196451
https://bugzilla.redhat.com/show_bug.cgi?id=1020147

Other distros, like Debian, never enabled this option by default. It is also disabled in upstream configuration.
Comment 2 Dmitry Mikhirev 2017-05-26 17:34:27 MSD
I'm sorry, this is not only configuration option that affects gksudo. The another one is `secure_path'. Only after I comment it out, gksudo begins working correctly. I don't know why.

Well, almost correctly. It still segfaults if I enter wrong password.
Comment 3 Andrey Bondrov 2017-12-06 18:59:44 MSK
Dmitry, thanx for the investigation. Can you please check if it's still valid (note that I didn't drop secure_path from the default config yet).

Advisory: "Update sudo to new version 1.8.21p2. Drop requiretty option (sync defaults with Fedora)."

https://abf.rosalinux.ru/build_lists/2914434
https://abf.rosalinux.ru/build_lists/2914435

Advisory: "Fix segmentation fault in libgksu when user enters incorrect password"

https://abf.rosalinux.ru/build_lists/2914432
https://abf.rosalinux.ru/build_lists/2914433
Comment 4 Andrey Bondrov 2017-12-07 06:58:42 MSK
Advisory: "Fix segmentation fault in libgksu when user enters incorrect password. Properly handle wrong password message from sudo."

https://abf.rosalinux.ru/build_lists/2914459
https://abf.rosalinux.ru/build_lists/2914460
Comment 5 Andrey Bondrov 2017-12-07 11:05:16 MSK
Meanwhile the only way I found to make gksudo work is to add "Defaults   !tty_tickets" to /etc/sudoers.

Looks like we get a ticket for non-existent tty or something like that when we enter correct password in gksudo dialog. And this ticket is not valid for actual sudo command call. But if we already got a ticket with plain sudo (not gksudo) before, gksudo WILL work.
Comment 6 Andrey Bondrov 2017-12-07 13:15:17 MSK
Advisory: "Update sudo to new version 1.8.21p2. Drop requiretty option (sync defaults with Fedora)."

https://abf.rosalinux.ru/build_lists/2914434
https://abf.rosalinux.ru/build_lists/2914435

Advisory: "Update libgksu to new version 2.0.13-pre1 (it works with tty_tickets option in sudoers). Fix segmentation fault in libgksu when user enters incorrect password. Properly handle wrong password message from sudo."

https://abf.rosalinux.ru/build_lists/2914477
https://abf.rosalinux.ru/build_lists/2914478
Comment 7 Dmitry Mikhirev 2017-12-07 14:48:51 MSK
I confirm that gksudo works after updating libgksu and sudo. But there is another issue: if password was typed incorrectly, it shows an empty dialog window (according to warnings in the console output, this can be caused by invalid XML markup).
Comment 8 Andrey Bondrov 2017-12-07 16:04:33 MSK
(In reply to comment #7)
> But there is another issue: if password was typed incorrectly, it shows an
> empty dialog window (according to warnings in the console output, 
> this can be  caused by invalid XML markup).

Now it's a gksu package error, missing opening <b> tag in string translation.

Advisory: "Fix Russian error message in gksudo when incorrect password was given 3 times"

https://abf.rosalinux.ru/build_lists/2914489
https://abf.rosalinux.ru/build_lists/2914490
Comment 9 Vladimir Potapov 2017-12-07 18:07:31 MSK
The update is sent to expanded testing
*****************************************
Comment 10 Vladimir Potapov 2017-12-11 19:23:41 MSK
sudo-1.8.21p2-3
https://abf.rosalinux.ru/build_lists/2914434
https://abf.rosalinux.ru/build_lists/2914435

libgksu-2.0.13-0.pre1.3
https://abf.rosalinux.ru/build_lists/2914477
https://abf.rosalinux.ru/build_lists/2914478

gksu-2.0.2-15
https://abf.rosalinux.ru/build_lists/2914489
https://abf.rosalinux.ru/build_lists/2914490

************************** Advisory ****************************
Update sudo to new version 1.8.21p2. Drop requiretty option (sync defaults with Fedora).
Update libgksu to new version 2.0.13-pre1 (it works with tty_tickets option in sudoers). Fix segmentation fault in libgksu when user enters incorrect password. Properly handle wrong password message from sudo.
Fix Russian error message in gksudo when incorrect password was given 3 times"
****************************************************************
QA Verified
Comment 11 Andrey Bondrov 2017-12-12 05:39:45 MSK
For rosa2014.1:

Advisory: "Update sudo to new version 1.8.21p2. Drop requiretty option (sync defaults with Fedora)."

https://abf.rosalinux.ru/build_lists/2914757
https://abf.rosalinux.ru/build_lists/2914758

Advisory: "Update libgksu to new version 2.0.13-pre1 (it works with tty_tickets option in sudoers). Fix segmentation fault in libgksu when user enters incorrect password. Properly handle wrong password message from sudo."

https://abf.rosalinux.ru/build_lists/2914759
https://abf.rosalinux.ru/build_lists/2914760

Advisory: "Fix Russian error message in gksudo when incorrect password was given 3 times"

https://abf.rosalinux.ru/build_lists/2914761
https://abf.rosalinux.ru/build_lists/2914762