Newer x11-libs/gksu is available and this new version also fixes a bug which is hit when using gnome-2.24 in conjunction with gnome-cups-manager or gnome-root-terminal. I also tried running gconf-editor through gksu and this also had same problems so the bug might be system wide. Reproducible: Always Steps to Reproduce: 1. Have gksu 2.0.0-r2 and libgksu-2.0.7 installed in your system with gnome-2.24 2. Either try to run gnome-root-terminal or try to add printer through gnome-cups-manager 3. Actual Results: - gnome-root-terminal does open a terminal but not with root privileges - gnome-cups-manager shows an error (also shown in linked screenshot): Failed to contact configuration server; some possible causes are that you need to enable TCP/IP networking for ORBit, or you have stale NFS locks due to a system crash. See http://www.gnome.org/projects/gconf/ for information. (Details - 1: Failed to get connection to session: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.) Expected Results: Programs should work normally and get needed privileges. Portage 2.1.6.8 (default/linux/x86/2008.0/desktop, gcc-4.3.3, glibc-2.9_p20081201-r2, 2.6.28-gentoo-r3 i686) ================================================================= System uname: Linux-2.6.28-gentoo-r3-i686-Intel-R-_Pentium-R-_4_CPU_3.20GHz-with-glibc2.0 Timestamp of tree: Tue, 17 Mar 2009 14:15:02 +0000 app-shells/bash: 4.0_p10-r1 dev-java/java-config: 2.1.7 dev-lang/python: 2.5.4-r2 dev-python/pycrypto: 2.0.1-r8 dev-util/cmake: 2.6.3 sys-apps/baselayout: 2.0.0 sys-apps/openrc: 0.4.3-r1 sys-apps/sandbox: 1.6 sys-devel/autoconf: 2.13, 2.63 sys-devel/automake: 1.5, 1.7.9-r1, 1.9.6-r2, 1.10.2 sys-devel/binutils: 2.19.1-r1 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.6a virtual/os-headers: 2.6.28-r1 ACCEPT_KEYWORDS="x86 ~x86" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ARCH="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CLEAN_DELAY="5" COLLISION_IGNORE="/lib/modules" COLORTERM="gnome-terminal" CONFIG_PROTECT="/etc" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/udev/rules.d" CVS_RSH="ssh" CXXFLAGS="-march=native -O2 -pipe -fomit-frame-pointer" DBUS_SESSION_BUS_ADDRESS="unix:abstract=/tmp/dbus-M3iu7b7NzY,guid=e027415e4130893d7139080a49c2a37b" DESKTOP_SESSION="gnome" DISPLAY=":0.0" DISTDIR="/usr/portage/distfiles" EDITOR="/bin/nano" ELIBC="glibc" EMERGE_DEFAULT_OPTS="--ask --verbose" EMERGE_WARNING_DELAY="10" FEATURES="distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch" FETCHCOMMAND="/usr/bin/wget -t 5 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}"" GCC_SPECS="" GDK_USE_XFT="1" GDMSESSION="gnome" GDM_LANG="C" GDM_XSERVER_LOCATION="local" GENTOO_MIRRORS="http://trumpetti.atm.tut.fi/gentoo/ " GNOME_DESKTOP_SESSION_ID="Default" GNOME_KEYRING_PID="2598" GNOME_KEYRING_SOCKET="/tmp/keyring-RWOg2e/socket" GPG_AGENT_INFO="/tmp/seahorse-0Zyahn/S.gpg-agent:2644:1" GTK_MODULES="gnomebreakpad" GTK_RC_FILES="/etc/gtk/gtkrc:/home/corec/.gtkrc-1.2-gnome2" HOME="/root" INFOPATH="/usr/share/info:/usr/share/binutils-data/i686-pc-linux-gnu/2.19.1/info:/usr/share/gcc-data/i486-pc-linux-gnu/4.1.2/info:/usr/share/gcc-data/i686-pc-linux-gnu/4.3.3/info" INPUT_DEVICES="keyboard mouse evdev wacom" JAVAC="/etc/java-config-2/current-system-vm/bin/javac" JAVA_HOME="/etc/java-config-2/current-system-vm" JDK_HOME="/etc/java-config-2/current-system-vm" KERNEL="linux" LANG="C" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LC_COLLATE="fi_FI.UTF-8" LC_CTYPE="fi_FI.UTF-8" LC_MONETARY="fi_FI.UTF-8" LC_NUMERIC="fi_FI.UTF-8" LC_TIME="fi_FI.UTF-8" LDFLAGS="-Wl,-O1" LESS="-R -M --shift 5" LESSOPEN="|lesspipe.sh %s" LINGUAS="en fi" LOGNAME="root" MAKEOPTS="-j3" MANPATH="/etc/java-config-2/current-system-vm/man:/usr/local/share/man:/usr/share/man:/usr/share/binutils-data/i686-pc-linux-gnu/2.19.1/man:/usr/share/gcc-data/i486-pc-linux-gnu/4.1.2/man:/usr/share/gcc-data/i686-pc-linux-gnu/4.3.3/man:/etc/java-config/system-vm/man/" NETBEANS="apisupport cnd groovy gsf harness ide identity j2ee java mobility nb php profiler soa visualweb webcommon websvccommon xml" NOCOLOR="true" OPENGL_PROFILE="xorg-x11" ORBIT_SOCKETDIR="/tmp/orbit-corec" PAGER="/usr/bin/less" PATH="/sbin:/bin:/usr/sbin:/usr/bin" PKGDIR="/usr/portage/packages" PORTAGE_ARCHLIST="ppc s390 amd64 x86 ppc64 x86-fbsd m68k arm sparc sh mips ia64 alpha hppa amd64-fbsd sparc-fbsd" PORTAGE_BINHOST_CHUNKSIZE="3000" PORTAGE_BIN_PATH="/usr/lib/portage/bin" PORTAGE_COMPRESS_EXCLUDE_SUFFIXES="css gif htm[l]? jp[e]?g js pdf png" PORTAGE_CONFIGROOT="/" PORTAGE_DEBUG="0" PORTAGE_DEPCACHEDIR="/var/cache/edb/dep" PORTAGE_ELOG_CLASSES="log warn error" PORTAGE_ELOG_MAILFROM="portage@localhost" PORTAGE_ELOG_MAILSUBJECT="[portage] ebuild log for ${PACKAGE} on ${HOST}" PORTAGE_ELOG_MAILURI="root" PORTAGE_ELOG_SYSTEM="save_summary echo" PORTAGE_FETCH_CHECKSUM_TRY_MIRRORS="5" PORTAGE_FETCH_RESUME_MIN_SIZE="350K" PORTAGE_GID="250" PORTAGE_INST_GID="0" PORTAGE_INST_UID="0" PORTAGE_PYM_PATH="/usr/lib/portage/pym" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_RSYNC_RETRIES="3" PORTAGE_TMPDIR="/var/tmp" PORTAGE_VERBOSE="1" PORTAGE_WORKDIR_MODE="0700" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise /usr/local/portage/custom" PROFILE_ONLY_VARIABLES="ARCH ELIBC KERNEL USERLAND" PWD="/home/corec/Desktop" RESUMECOMMAND="/usr/bin/wget -c -t 5 -T 60 --passive-ftp -O "${DISTDIR}/${FILE}" "${URI}"" ROOT="/" ROOTPATH="/opt/bin:/usr/i486-pc-linux-gnu/gcc-bin/4.1.2:/usr/i686-pc-linux-gnu/gcc-bin/4.3.3" RPMDIR="/usr/portage/rpm" SESSION_MANAGER="local/blue:@/tmp/.ICE-unix/2610,unix/blue:/tmp/.ICE-unix/2610" SHELL="/bin/bash" SHLVL="2" SSH_AUTH_SOCK="/tmp/keyring-RWOg2e/ssh" SYNC="rsync://trumpetti.atm.tut.fi/gentoo-portage" TERM="xterm" USE="X a52 aac acl acpi alsa avahi bash-completion berkdb bluetooth branding bzip2 cairo cddb cdparanoia cdr cli cracklib crypt css cups curl dbus dri dvd dvdr dvdread eds emboss encode evo exif fam ffmpeg firefox flac fortran gdbm gif gnome gnome-keyring gnutls gphoto2 gpm gstreamer gtk hal iconv ipv6 isdnlog jabber jingle jpeg ldap libnotify mad matroska midi mikmod mmx mp3 mpeg msn mudflap musicbrainz ncurses nls nptl nptlonly ogg opengl openmp oss pam pango pcre pdf perl png ppds pppd python qt3support quicktime readline reflection samba sdl session smp spell spl sse sse2 ssl startup-notification svg sysfs taglib tcpd theora threads tiff truetype unicode usb vorbis win32codecs x264 x86 xcb xcomposite xml xorg xulrunner xv xvid zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev wacom" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en fi" USERLAND="GNU" VIDEO_CARDS="radeon" USER="root" USERLAND="GNU" USERNAME="corec" USE_EXPAND="ALSA_CARDS ALSA_PCM_PLUGINS APACHE2_MODULES APACHE2_MPMS CAMERAS CROSSCOMPILE_OPTS DVB_CARDS ELIBC FCDSL_CARDS FOO2ZJS_DEVICES FRITZCAPI_CARDS INPUT_DEVICES KERNEL LCD_DEVICES LINGUAS LIRC_DEVICES MISDN_CARDS NETBEANS_MODULES USERLAND VIDEO_CARDS" USE_EXPAND_HIDDEN="CROSSCOMPILE_OPTS ELIBC KERNEL USERLAND" USE_ORDER="env:pkg:conf:defaults:pkginternal:env.d" VIDEO_CARDS="radeon" WINDOWID="18875131" WINDOWPATH="7" XAUTHORITY="/root/.xauthmHm8B0" XDG_DATA_DIRS="/usr/local/share/:/usr/share/:/usr/share/gdm/" XDG_SESSION_COOKIE="0c25a0c5d3d89d500c9bb7ca49856b44-1237492603.42948-1594976526"
Created attachment 185569 [details] x11-libs/gksu proposed ebuild copied this from the old x11-libs/gksu-2.0.0-r2 ebuild. The new-nautilus patch was not needed anymore. I also removed the gnome-2.22 patch, which added module checking for gnome-vfs, because changelog said that gksu was ported to gio. (hopefully I did the right thing to remove that patch and to add gvfs as dependency).
Created attachment 185570 [details] x11-libs/libgksu proposed ebuild Copied this from the old libgksu-2.0.7.ebuild. All old patches seemed to be valid from what I understood about them.
Messed up the summary when adding the bug, version should be 2.0.9 for x11-libs/libgksu and should probably mention x11-libs/gksu-2.0.2 too, sorry about that.
@security, do you have something about this in your books ?
(In reply to comment #4) > @security, do you have something about this in your books ? Nothing in the usual channels. Besides, I think that this is a reverse privilege escalation, and thus not a security thing: You don't get root privileges where you should have them, not the other way around. ;) The issue looks similar to this: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519773 Debian also don't have any correlation to a security problem, so I'm taking the liberty to un-CC us. Feel free to readd if you don't agree.
in tree. Thanks for reporting.
