XDG_RUNTIME_DIR not created

[Denis01]

Hello,
Centos 7.3
XPRA proxy 2.1-r15785
After reboot of server and start of Proxy error appears:

Warning: failed to create socket directory '/var/run/user/1000/xpra'
[Errno 2] No such file or directory: '/var/run/user/1000/xpra'
Error: failed to setup control socket '/var/run/user/1003/xpra/localhost.localdomain-proxy-2244':
[Errno 2] No such file or directory

So the folder "/var/run/user/1000/xpra" should be created manually (with assigning the rights for the user to read/write ).
After that Proxy starts working

[Antoine Martin]

After reboot of server and start of Proxy error appears:

Please always include the commands you have used. Are you using the system wide proxy? (#1105)

The original XDG_RUNTIME_DIR ticket is #1129.
This particular problem is recorded here: ticket:1129#comment:23.
See also:

• ​Why does sudo -i not set XDG_RUNTIME_DIR for the target user?
• ​systemd-devel: Fix PAM module to not clobber XDG_RUNTIME_DIR with su

We have existing workarounds: r13367, and this has caused problems before: r12511.
I was hoping that centos would apply the fix that has been used on Fedora.
But it looks like we'll need to double check it and carefully create those directories if needed (yuk).

I have edited the ticket title as this has nothing to do with rebooting.

[Antoine Martin]

Ugly workaround applied in r16030: we try to create the missing directories as safely as we can. (mkdir + chown)

@Denis01: does that work for you?
(untested, as I have other problems to fix first on centos7: selinux policy for socket activation #1521, and some odd pam_auth errors)

[Denis01]

will take some time to test. As the remplacing of script.py is not enough - seems that there are many changes in other modules as well so Proxy just can't start.
Will prepare new test infra.
P.S. FYI, i'm using Proxy with selinux disabled

[Antoine Martin]

Fixups in r16092 + r16096. (also some proxy related changes in r16095)

Tested on Fedora with a server started with:

sudo xpra proxy --tcp-auth=sys --bind-ssl=0.0.0.0: -d auth,proxy --ssl-cert=./cert.pem

Then starting a new session using:

xpra start ssl/guest:[email protected]/ --ssl-server-verify=none

I have seen the occasional failure with "failed to identify the new server display!" because some sockets were left behind and the new server took longer than expected to startup. Somewhat similar to #1447.
This should be improved when we deal with #1535.
We also need to do the pam registration earlier as this is what creates the directory we need... the daemon + log code will need splitting up.

[Antoine Martin]

move pam earlier - work in progress

[Antoine Martin]

More changes:

• r16096: deal with XDG_RUNTIME_DIR workarounds before we launch Xorg so that we can use this location for the log files
• r16098: create the XDG_RUNTIME_DIR earlier so that the log location detection code will find it
• r16099: re-order server initialization code so we can try to ensure the XDG_RUNTIME_DIR directory is created as early as possible
• r16100: daemonize first, then do pam registration (to get XDG_RUNTIME_DIR) then we can create the log file and redirect stdout / stderr
• related changes in #1105: see ticket:1105#comment:19

Tested OK on Fedora 26 and centos 7.x

[Denis01]

Hello,
Had some prs problems.
So r16030 works well.
Now will try the recent ones.

[Antoine Martin]

@Denis01: works for me. Tested with all sorts of configurations, with selinux enabled and disabled (#1521), with the user account already logged in or not (and even logged out half way through), with the proxy killed and restarted, etc...

If you still find problems please post the full commands used so that I can reproduce. And include the log output.
If not, please just re-assign to "afarr" as a "FYI to close".

[Denis01]

Sorry but as usual i was not clear enough...
I had some personal problems so for 2 weeks was not able to test even r16030..
So the r16030 (the first urgent patch) works fine.
Now will try r16096,98,100 etc

[Denis01]

Hello,
perfectly works at me!
Closed.

Thanks a lot!

[Antoine Martin]

The correct fixes for this are actually recorded in #1105.