Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 365149 - sys-apps/openrc: start-stop-daemon should use system-services PAM stack (was: emacsclient cannot find emacs-daemon socket)
Summary: sys-apps/openrc: start-stop-daemon should use system-services PAM stack (was:...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Hosted Projects
Classification: Unclassified
Component: OpenRC (show other bugs)
Hardware: x86 Linux
: Normal normal (vote)
Assignee: OpenRC Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 347301 374183 381463
  Show dependency tree
 
Reported: 2011-04-28 03:52 UTC by Göktürk Yüksek
Modified: 2012-02-24 03:44 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge_info,4.19 KB, text/plain)
2011-04-28 03:53 UTC, Göktürk Yüksek
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Göktürk Yüksek archtester gentoo-dev 2011-04-28 03:52:35 UTC
emacsclient is unable to locate the socket of emacs daemon automatically.

$ emacsclient -c

returns:

emacsclient: can't find socket; have you started the server?
To start the server in Emacs, type "M-x server-start".
emacsclient: No socket or alternate editor.  Please use:

	--socket-name
	--server-file      (or environment variable EMACS_SERVER_FILE)
	--alternate-editor (or environment variable ALTERNATE_EDITOR)


Reproducible: Always

Steps to Reproduce:
1. sudo /etc/init.d/emacs.$USER start
2. emacsclient -c
3. 



Emacs source files:

lib-src/emacsclient.c:1250
===========================
tmpdir = egetenv ("TMPDIR");
if (!tmpdir)
  tmpdir = "/tmp";

list/server.el:219
===============
(defvar server-socket-dir
  (and (featurep 'make-network-process '(:family local))
       (format "%s/emacs%d" (or (getenv "TMPDIR") "/tmp") (user-uid)))

clearly state that both client and daemon check $TMPDIR environment variable to locate the server socket directory first, then use "/tmp" as a fallback. And the following shell commands give:

$ echo "echo \$TMPDIR" > foo.sh
$ chmod +x foo.sh
$ ./foo.sh
/tmp/.private/gokturk
$ sudo ./foo.sh

$ su -c ./foo.sh
/tmp/.private/root

Therefore, when the user types:
$ sudo /etc/init.d/emacs.$USER start
Emacs daemon puts its socket under under "/tmp" because, I guess, sudo unsets $TMPDIR variable.

And when the user types:
$ emacsclient -c
Emacs client sees the $TMPDIR variable and searches the wrong directory for the socket.

Note that it works fine with GNU screen for me because when I launch screen, $TMPDIR is not set.

Packages:
=========
sys-auth/pam_mktemp-1.0.3
app-admin/sudo-1.7.4_p5
app-emacs/emacs-daemon-0.17
Comment 1 Göktürk Yüksek archtester gentoo-dev 2011-04-28 03:53:30 UTC
Created attachment 271411 [details]
emerge --info
Comment 2 Göktürk Yüksek archtester gentoo-dev 2011-04-28 04:50:10 UTC
This worked as a workaround for me:

--- a/emacs-wrapper.sh	2011-04-28 00:48:00.000000000 -0400
+++ b/emacs-wrapper.sh	2011-04-28 00:47:53.000000000 -0400
@@ -3,6 +3,10 @@
 # Distributed under the terms of the GNU General Public License v2
 # $Id: emacs-wrapper.sh 1430 2009-10-04 22:55:33Z ulm $
 
+if [ -z "${TMPDIR}" ]; then
+    export TMPDIR="/tmp/.private/${USER}";
+fi
+
 # Save output in a temporary file and display in case of error
 logfile=$(mktemp ${TMPDIR:-/tmp}/emacs.log.XXXXXX)
 trap "rm -f '${logfile}'" EXIT
Comment 3 Ulrich Müller gentoo-dev 2011-04-28 06:45:32 UTC
emacs-wrapper.sh executes the user's login shell, i.e. does "exec -l ${SHELL}".

I don't know what your configuration is. But if you make sure that TMPDIR is set for a login shell then it should work.

Maybe pam_mktemp isn't called for some reason? CCing PAM team.
Comment 4 Ulrich Müller gentoo-dev 2011-04-28 07:09:58 UTC
Could you please post your /etc/pam.d/start-stop-daemon file?
Comment 5 Göktürk Yüksek archtester gentoo-dev 2011-04-28 17:55:54 UTC
(In reply to comment #2)
> This worked as a workaround for me:
> 
> --- a/emacs-wrapper.sh    2011-04-28 00:48:00.000000000 -0400
> +++ b/emacs-wrapper.sh    2011-04-28 00:47:53.000000000 -0400
> @@ -3,6 +3,10 @@
>  # Distributed under the terms of the GNU General Public License v2
>  # $Id: emacs-wrapper.sh 1430 2009-10-04 22:55:33Z ulm $
> 
> +if [ -z "${TMPDIR}" ]; then
> +    export TMPDIR="/tmp/.private/${USER}";
> +fi
> +
>  # Save output in a temporary file and display in case of error
>  logfile=$(mktemp ${TMPDIR:-/tmp}/emacs.log.XXXXXX)
>  trap "rm -f '${logfile}'" EXIT

I'd like to note that this doesn't work if you add emacs into default runlevel as ${USER} is not visible in this scope.
Comment 6 Göktürk Yüksek archtester gentoo-dev 2011-04-28 17:56:59 UTC
(In reply to comment #4)
> Could you please post your /etc/pam.d/start-stop-daemon file?

auth            required        pam_permit.so
account         required        pam_permit.so
password        required        pam_deny.so
session         optional        pam_limits.so
Comment 7 Ulrich Müller gentoo-dev 2011-04-28 18:23:49 UTC
(In reply to comment #5)
> > +if [ -z "${TMPDIR}" ]; then
> > +    export TMPDIR="/tmp/.private/${USER}";
> > +fi
>
> I'd like to note that this doesn't work if you add emacs into default runlevel
> as ${USER} is not visible in this scope.

We won't add such a workaround to emacs-wrapper.sh anyway. OpenRC should set the TMPDIR variable (possibly via PAM) when start-stop-daemon is called with the --user option.

(In reply to comment #6)
> > Could you please post your /etc/pam.d/start-stop-daemon file?
> 
> auth            required        pam_permit.so
> account         required        pam_permit.so
> password        required        pam_deny.so
> session         optional        pam_limits.so

I believe that there should be a line like the following:

  session         optional        pam_mktemp.so

@openrc, swegener: Could such a line be added to the default configuration, or would this cause other problems?
Comment 8 Diego Elio Pettenò (RETIRED) gentoo-dev 2011-04-28 18:27:09 UTC
OpenRC should use system-services PAM stack.

Or in alternative emacs should use a file in $HOME for the socket.
Comment 9 Göktürk Yüksek archtester gentoo-dev 2011-04-28 19:05:02 UTC
(In reply to comment #7)
> I believe that there should be a line like the following:
> 
>   session         optional        pam_mktemp.so
> 
> @openrc, swegener: Could such a line be added to the default configuration, or
> would this cause other problems?

Yep adding that line solved the problem. Furthermore, the ebuild actually prints out:

* Messages for package sys-auth/pam_mktemp-1.0.3:

* To enable pam_mktemp put something like
* 
* session    optional    pam_mktemp.so
* 
* into /etc/pam.d/system-auth!

I guess I missed that or forgot to add the line. It would be better if it becomes a part of the default configuration though, assuming that it doesn't cause any security issues.
Comment 10 Diego Elio Pettenò (RETIRED) gentoo-dev 2011-04-28 19:11:03 UTC
USE=mktemp emerge -1 pambase

That should be enough.

But OpenRC should include system-services, NOT only run pam_limits.
Comment 11 Göktürk Yüksek archtester gentoo-dev 2011-04-28 20:26:11 UTC
(In reply to comment #10)
> USE=mktemp emerge -1 pambase
> 
> That should be enough.
> 
> But OpenRC should include system-services, NOT only run pam_limits.

Well I already have:

sys-auth/pambase-20101024  USE="cracklib mktemp pam_ssh sha512"

I deleted the pam_mktemp line in /etc/pam.d/start-stop-daemon and did:

# emerge -1 pambase

and it didn't fix the problem.
Comment 12 Diego Elio Pettenò (RETIRED) gentoo-dev 2011-04-28 20:32:54 UTC
Read to the end of my comment please.
Comment 13 Göktürk Yüksek archtester gentoo-dev 2011-04-28 21:30:22 UTC
(In reply to comment #12)
> Read to the end of my comment please.

Do you mean adding

 session include system-services

to /etc/pam.d/start-stop-daemon?
Comment 14 Ulrich Müller gentoo-dev 2011-05-01 11:53:51 UTC
(In reply to comment #10)
> But OpenRC should include system-services, NOT only run pam_limits.

Reassigning, since there's nothing that the Emacs team could do to improve the situation.
Comment 15 William Hubbs gentoo-dev 2011-05-06 20:28:31 UTC
(In reply to comment #10)
> USE=mktemp emerge -1 pambase
> That should be enough.
> But OpenRC should include system-services, NOT only run pam_limits.

If I do that in the upstream source code, we break openrc for other distributions, so I would not want to do it there.

One option would be to overwrite /etc/pam.d/stop-start-daemon at the ebuild level. If I do that, what should the s-s-d file contain?
Comment 16 Ulrich Müller gentoo-dev 2011-05-16 17:01:25 UTC
(In reply to comment #15)
> One option would be to overwrite /etc/pam.d/stop-start-daemon at the ebuild
> level. If I do that, what should the s-s-d file contain?

Diego tells me that the file should just consist of the following two lines:

account required pam_permit.so
session include system-services
Comment 17 William Hubbs gentoo-dev 2011-09-01 15:01:28 UTC
All,

this is fixed in the openrc live ebuild and will be included in the next
release of openrc as shown on the tracker this bug now blocks.

I don't know of any reason to keep this bug open, but feel free to
reopen if you disagree.
Comment 18 Dennis Schridde 2012-02-23 17:38:27 UTC
Requesting to reopen, since I still get problems with TMPDIR and nobody in e.g. Apache. Apache seems to see TMPDIR=/tmp/.private/nobody, but runs as user apache, which is not allowed to write to that TMPDIR. Several webapps fail in non obvious ways, because they do not expect this.
Comment 19 Dennis Schridde 2012-02-23 17:39:35 UTC
# cat /etc/pam.d/start-stop-daemon 
account required pam_permit.so
session include system-services
# cat /etc/pam.d/system-services 
auth            sufficient      pam_permit.so
account         include         system-auth
session         optional        pam_loginuid.so
session         required        pam_limits.so 
session         required        pam_env.so 
session         optional        pam_mktemp.so
session         required        pam_unix.so 
session         optional        pam_permit.so

These are (iirc) the default files that come with pam_mktemp and openrc.
Comment 20 William Hubbs gentoo-dev 2012-02-23 19:54:40 UTC
(In reply to comment #18)
> Requesting to reopen, since I still get problems with TMPDIR and nobody in e.g.
> Apache. Apache seems to see TMPDIR=/tmp/.private/nobody, but runs as user
> apache, which is not allowed to write to that TMPDIR. Several webapps fail in
> non obvious ways, because they do not expect this.

This will not be reopened; the purpose of this bug was to fix the pam file for start-stop-daemon to include system services.

The information for the fix of the new issue is on bug #386623.