Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1641456 - D-Bus activation broken, dbus-daemon-launch-helper has wrong permissions
Summary: D-Bus activation broken, dbus-daemon-launch-helper has wrong permissions
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: dbus
Version: 29
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: David King
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1640815 1641109 1646374 1651927 1653455 1655091 1655637 1657573 1662335 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-10-22 06:14 UTC by Martin Pitt
Modified: 2019-01-23 02:28 UTC (History)
31 users (show)

Fixed In Version: dbus-1.12.10-4.fc30 dbus-1.12.12-1.fc29
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-01-23 02:28:03 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)
Fix (1.25 KB, patch)
2018-10-22 06:17 UTC, Martin Pitt 		no flags Details | Diff
View All

Description Martin Pitt 2018-10-22 06:14:57 UTC 
Description of problem: Since the split of dbus-{common,daemon}, activation of services which *don't* have a systemd service, i. e. which go via dbus-daemon-launch-helper, is broken:

# busctl introspect org.libvirt /
Failed to introspect object / of service org.libvirt: Failed to execute program org.libvirt: Permission denied

# busctl introspect org.fedoraproject.Setroubleshootd /
Failed to introspect object / of service org.fedoraproject.Setroubleshootd: Failed to execute program org.fedoraproject.Setroubleshootd: Permission denied

This is because /usr/libexec/dbus-1/dbus-daemon-launch-helper is owned by root:root, instead of the intended root:dbus.

The group is created in dbus-common's %pre script:

%pre common
# Add the "dbus" user and group
/usr/sbin/groupadd -r -g %{dbus_user_uid} dbus 2>/dev/null || :
/usr/sbin/useradd -c 'System message bus' -u %{dbus_user_uid} -g %{dbus_user_uid} \
    -s /sbin/nologin -r -d '/' dbus 2> /dev/null || :

and it does exist:

  # getent group dbus
  dbus:x:81:

/usr/libexec/dbus-1/dbus-daemon-launch-helper is shipped in the dbus-daemon package. This means that it is necessary that dbus-common gets installed *before* dbus-daemon, otherwise unpacking dbus would not have the group created already. dbus-daemon correctly "Requires: dbus-common", which ought to enforce the unpack order.

But apparently this dependency isn't enough: In our image installation logs from virt-install, dbus-common gets installed *after* dbus-daemon:

[1;24r[23;1HInstalling dbus-daemon.x86_64 (190/360)[1;23r[23;80H
[1;24r[23;1HInstalling coreutils.x86_64 (191/360)[1;23r[23;80H
[1;24r[23;1HInstalling systemd-libs.x86_64 (192/360)[1;23r[23;80H
[1;24r[23;1HInstalling device-mapper-libs.x86_64 (193/360)[1;23r[23;80H
[1;24r[23;1HInstalling libblkid.x86_64 (194/360)[1;23r[23;80H
[1;24r[23;1HInstalling shadow-utils.x86_64 (195/360)[1;23r[23;80H
[1;24r[23;1HInstalling dbus-common.noarch (196/360)[1;23r[23;80H

So apparently dnf does not respect dependencies properly on package installation.


Version-Release number of selected component (if applicable):

dbus-1.12.10-1.fc28
Comment 1 Martin Pitt 2018-10-22 06:17:25 UTC 
Created attachment 1496295 [details]
Fix

Sorry, affected NVR should be

dbus-daemon-1.12.10-1.fc29.x86_64

The simplest fix seems to be to just move the %pre script into dbus-daemon. Nothing in dbus-common needs the group, and dbus-broker does not need it either.

(FTR, this was tested in RHEL development series downstream)
Comment 2 Fedora Update System 2018-10-22 08:27:51 UTC 
dbus-1.12.10-4.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1eff1712c2
Comment 3 Fedora Update System 2018-10-22 19:23:51 UTC 
dbus-1.12.10-4.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1eff1712c2
Comment 4 Kevin Fenzi 2018-10-23 18:38:54 UTC 
dbus-1.12.10-4.fc30 broke rawhide composes. You can see the Cloud Base failure here: 

https://koji.fedoraproject.org/koji/taskinfo?taskID=30412871

I've untagged this build and started a new compose.
Comment 5 David King 2018-10-24 07:34:39 UTC 
David Herrmann posted a patch that moves the useradd invocation to the correct subpackage, so I kicked off dbus-1.12.10-5.fc30 with that change to see if it fixes the compose.
Comment 6 Tomas Popela 2018-10-24 09:55:29 UTC 
I installed the F29 though net install and I'm being hit by this. I tried to changed the permission manually, but it didn't work and I'm still getting:

dbus.socket: Socket service dbus.service not loaded, refusing.
Failed to listen od D-Bus System Message Bus Socket.
Comment 7 David King 2018-10-24 10:00:28 UTC 
(In reply to Tomas Popela from comment #6)
> I installed the F29 though net install and I'm being hit by this. I tried to
> changed the permission manually, but it didn't work and I'm still getting:
> 
> dbus.socket: Socket service dbus.service not loaded, refusing.
> Failed to listen od D-Bus System Message Bus Socket.

This could well be the presets issue from bug 1638910.
Comment 8 Tomas Popela 2018-10-24 10:28:32 UTC 
I'm running dbus-1.12.10-4.fc29 and that should have that fix. Anyway I tried to execute the commands mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1638910#add_comment manually, but no change.
Comment 9 Tomas Popela 2018-10-24 12:45:19 UTC 
OK, what helped me was:

systemctl enable dbus-daemon.service
systemctl start dbus-daemon.service

then the dbus.socket was activated and after reboot the machined started successfully.
Comment 10 Stephen Gallagher 2018-10-25 15:24:34 UTC 
(In reply to Tomas Popela from comment #6)
> I installed the F29 though net install and I'm being hit by this. I tried to
> changed the permission manually, but it didn't work and I'm still getting:
> 
> dbus.socket: Socket service dbus.service not loaded, refusing.
> Failed to listen od D-Bus System Message Bus Socket.

Note that what you hit here was https://bugzilla.redhat.com/show_bug.cgi?id=1640626 as well; this dbus package was not in the stable repos and Anaconda should not have given it to you on install. We have karma'ed the offending update out of updates-testing for the time being.
Comment 11 Fedora Update System 2018-10-26 07:12:53 UTC 
dbus-1.12.10-5.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a232773e25
Comment 12 Martin Kutlak 2018-11-05 13:46:57 UTC 
*** Bug 1646374 has been marked as a duplicate of this bug. ***
Comment 13 Petr Lautrbach 2018-11-19 14:06:20 UTC 
*** Bug 1641109 has been marked as a duplicate of this bug. ***
Comment 14 Martin Kutlak 2018-11-21 09:16:36 UTC 
*** Bug 1651927 has been marked as a duplicate of this bug. ***
Comment 15 Martin Kutlak 2018-11-27 08:33:56 UTC 
*** Bug 1653455 has been marked as a duplicate of this bug. ***
Comment 16 Edgar Hoch 2018-11-27 09:51:32 UTC 
Ok, I have seen this bug report, but I wasn't sure that it describes the same problem as that of abrt-cli.

Current stable version for Fedora 29, dbus-1.12.10-1.fc29 is more than three months old. Newer versions for Fedora 29 was tested but proved bad and obsoleted in bodhi (dbus-1.12.10-{2,4,5}.fc29). More newer versions was only build for Fedora 30, lastest listed in koji is dbus-1.12.10-9.fc30.

Is any of the newer versions usable for Fedora 29 and solves the problem?
Comment 17 Petr Lautrbach 2018-12-03 13:21:52 UTC 
*** Bug 1655091 has been marked as a duplicate of this bug. ***
Comment 18 Petr Lautrbach 2018-12-03 16:38:06 UTC 
*** Bug 1655637 has been marked as a duplicate of this bug. ***
Comment 19 Arcadiy Ivanov 2018-12-06 23:01:26 UTC 
The workaround for his is as follows:
> sudo chown root:dbus /usr/libexec/dbus-1/dbus-daemon-launch-helper
> sudo chmod 4754 /usr/libexec/dbus-1/dbus-daemon-launch-helper

This allows abrt-cli to execute properly.
Comment 20 Arcadiy Ivanov 2018-12-06 23:19:08 UTC 
This apparently also fixes PowerDevil failing backlighthelper start in bug 1636690.
Comment 21 Vladimir Zhelezov 2018-12-07 07:01:15 UTC 
Confirmed, except I used `chmod 4750' i.e. preserved the original file mode bits.
Comment 22 Artem Silenkov 2018-12-22 20:37:53 UTC 
Workaround fixed abrt-cli and abrt-applet for me.
Comment 23 Petr Lautrbach 2019-01-02 11:16:22 UTC 
*** Bug 1662335 has been marked as a duplicate of this bug. ***
Comment 24 Zdenek Dohnal 2019-01-07 11:48:44 UTC 
*** Bug 1640815 has been marked as a duplicate of this bug. ***
Comment 25 Miroslav Suchý 2019-01-08 15:25:08 UTC 
As the update got negative karma, can we get a new fix and new update? Please.
Comment 26 karlp 2019-01-14 11:43:47 UTC 
Workaround from comment 19 fixes adding printers for me too, and also fixes adding world clocks
Comment 27 Andrew Travneff 2019-01-15 17:05:20 UTC 
Have same owner/mode as in comment 19:
  -rwsr-xr--. 1 root dbus 74320 Aug  3 09:10 /usr/libexec/dbus-1/dbus-daemon-launch-helper

but still have auth issues, for example:

  $ systemctl suspend --no-ask-password
  Failed to set wall message, ignoring: Interactive authentication required.
  Failed to suspend system via logind: Interactive authentication required.
  # have password request window here
  Failed to start suspend.target: Access denied
  See system logs and 'systemctl status suspend.target' for details.
Comment 28 Matej Marušák 2019-01-16 10:56:21 UTC 
*** Bug 1657573 has been marked as a duplicate of this bug. ***
Comment 29 Fedora Update System 2019-01-21 13:57:22 UTC 
dbus-1.12.12-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-192523204b
Comment 30 Fedora Update System 2019-01-22 03:03:58 UTC 
dbus-1.12.12-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-192523204b
Comment 31 Fedora Update System 2019-01-23 02:28:03 UTC 
dbus-1.12.12-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.