Bug 1641456

Summary: D-Bus activation broken, dbus-daemon-launch-helper has wrong permissions
Product: [Fedora] Fedora Reporter: Martin Pitt <mpitt>
Component: dbusAssignee: David King <dking>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 29CC: akarshan.biswas, alciregi, alex.barborica, amigadave, arcadiy, artem.silenkov, cristianofurtadoba, dhcpme, edgar.hoch, ego.cordatus, ekulik, Gecko8211, goodyca48, john.j5live, karlp, kevin, lpoetter, mclasen, mfabian, msuchy, ng0177, pmkellly72, rhughes, rstrode, sandmann, sbueno, sgallagh, tpopela, travneff, walters, zhelezov
Target Milestone: ---Keywords: Regression, Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: dbus-1.12.10-4.fc30 dbus-1.12.12-1.fc29 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-01-23 02:28:03 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fix none

Description Martin Pitt 2018-10-22 06:14:57 UTC
Description of problem: Since the split of dbus-{common,daemon}, activation of services which *don't* have a systemd service, i. e. which go via dbus-daemon-launch-helper, is broken:

# busctl introspect org.libvirt /
Failed to introspect object / of service org.libvirt: Failed to execute program org.libvirt: Permission denied

# busctl introspect org.fedoraproject.Setroubleshootd /
Failed to introspect object / of service org.fedoraproject.Setroubleshootd: Failed to execute program org.fedoraproject.Setroubleshootd: Permission denied

This is because /usr/libexec/dbus-1/dbus-daemon-launch-helper is owned by root:root, instead of the intended root:dbus.

The group is created in dbus-common's %pre script:

%pre common
# Add the "dbus" user and group
/usr/sbin/groupadd -r -g %{dbus_user_uid} dbus 2>/dev/null || :
/usr/sbin/useradd -c 'System message bus' -u %{dbus_user_uid} -g %{dbus_user_uid} \
    -s /sbin/nologin -r -d '/' dbus 2> /dev/null || :

and it does exist:

  # getent group dbus
  dbus:x:81:

/usr/libexec/dbus-1/dbus-daemon-launch-helper is shipped in the dbus-daemon package. This means that it is necessary that dbus-common gets installed *before* dbus-daemon, otherwise unpacking dbus would not have the group created already. dbus-daemon correctly "Requires: dbus-common", which ought to enforce the unpack order.

But apparently this dependency isn't enough: In our image installation logs from virt-install, dbus-common gets installed *after* dbus-daemon:

[1;24r[23;1HInstalling dbus-daemon.x86_64 (190/360)[1;23r[23;80H
[1;24r[23;1HInstalling coreutils.x86_64 (191/360)[1;23r[23;80H
[1;24r[23;1HInstalling systemd-libs.x86_64 (192/360)[1;23r[23;80H
[1;24r[23;1HInstalling device-mapper-libs.x86_64 (193/360)[1;23r[23;80H
[1;24r[23;1HInstalling libblkid.x86_64 (194/360)[1;23r[23;80H
[1;24r[23;1HInstalling shadow-utils.x86_64 (195/360)[1;23r[23;80H
[1;24r[23;1HInstalling dbus-common.noarch (196/360)[1;23r[23;80H

So apparently dnf does not respect dependencies properly on package installation.


Version-Release number of selected component (if applicable):

dbus-1.12.10-1.fc28

Comment 1 Martin Pitt 2018-10-22 06:17:25 UTC
Created attachment 1496295 [details]
Fix

Sorry, affected NVR should be

dbus-daemon-1.12.10-1.fc29.x86_64

The simplest fix seems to be to just move the %pre script into dbus-daemon. Nothing in dbus-common needs the group, and dbus-broker does not need it either.

(FTR, this was tested in RHEL development series downstream)

Comment 2 Fedora Update System 2018-10-22 08:27:51 UTC
dbus-1.12.10-4.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-1eff1712c2

Comment 3 Fedora Update System 2018-10-22 19:23:51 UTC
dbus-1.12.10-4.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-1eff1712c2

Comment 4 Kevin Fenzi 2018-10-23 18:38:54 UTC
dbus-1.12.10-4.fc30 broke rawhide composes. You can see the Cloud Base failure here: 

https://koji.fedoraproject.org/koji/taskinfo?taskID=30412871

I've untagged this build and started a new compose.

Comment 5 David King 2018-10-24 07:34:39 UTC
David Herrmann posted a patch that moves the useradd invocation to the correct subpackage, so I kicked off dbus-1.12.10-5.fc30 with that change to see if it fixes the compose.

Comment 6 Tomas Popela 2018-10-24 09:55:29 UTC
I installed the F29 though net install and I'm being hit by this. I tried to changed the permission manually, but it didn't work and I'm still getting:

dbus.socket: Socket service dbus.service not loaded, refusing.
Failed to listen od D-Bus System Message Bus Socket.

Comment 7 David King 2018-10-24 10:00:28 UTC
(In reply to Tomas Popela from comment #6)
> I installed the F29 though net install and I'm being hit by this. I tried to
> changed the permission manually, but it didn't work and I'm still getting:
> 
> dbus.socket: Socket service dbus.service not loaded, refusing.
> Failed to listen od D-Bus System Message Bus Socket.

This could well be the presets issue from bug 1638910.

Comment 8 Tomas Popela 2018-10-24 10:28:32 UTC
I'm running dbus-1.12.10-4.fc29 and that should have that fix. Anyway I tried to execute the commands mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1638910#add_comment manually, but no change.

Comment 9 Tomas Popela 2018-10-24 12:45:19 UTC
OK, what helped me was:

systemctl enable dbus-daemon.service
systemctl start dbus-daemon.service

then the dbus.socket was activated and after reboot the machined started successfully.

Comment 10 Stephen Gallagher 2018-10-25 15:24:34 UTC
(In reply to Tomas Popela from comment #6)
> I installed the F29 though net install and I'm being hit by this. I tried to
> changed the permission manually, but it didn't work and I'm still getting:
> 
> dbus.socket: Socket service dbus.service not loaded, refusing.
> Failed to listen od D-Bus System Message Bus Socket.

Note that what you hit here was https://bugzilla.redhat.com/show_bug.cgi?id=1640626 as well; this dbus package was not in the stable repos and Anaconda should not have given it to you on install. We have karma'ed the offending update out of updates-testing for the time being.

Comment 11 Fedora Update System 2018-10-26 07:12:53 UTC
dbus-1.12.10-5.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-a232773e25

Comment 12 Martin Kutlak 2018-11-05 13:46:57 UTC
*** Bug 1646374 has been marked as a duplicate of this bug. ***

Comment 13 Petr Lautrbach 2018-11-19 14:06:20 UTC
*** Bug 1641109 has been marked as a duplicate of this bug. ***

Comment 14 Martin Kutlak 2018-11-21 09:16:36 UTC
*** Bug 1651927 has been marked as a duplicate of this bug. ***

Comment 15 Martin Kutlak 2018-11-27 08:33:56 UTC
*** Bug 1653455 has been marked as a duplicate of this bug. ***

Comment 16 Edgar Hoch 2018-11-27 09:51:32 UTC
Ok, I have seen this bug report, but I wasn't sure that it describes the same problem as that of abrt-cli.

Current stable version for Fedora 29, dbus-1.12.10-1.fc29 is more than three months old. Newer versions for Fedora 29 was tested but proved bad and obsoleted in bodhi (dbus-1.12.10-{2,4,5}.fc29). More newer versions was only build for Fedora 30, lastest listed in koji is dbus-1.12.10-9.fc30.

Is any of the newer versions usable for Fedora 29 and solves the problem?

Comment 17 Petr Lautrbach 2018-12-03 13:21:52 UTC
*** Bug 1655091 has been marked as a duplicate of this bug. ***

Comment 18 Petr Lautrbach 2018-12-03 16:38:06 UTC
*** Bug 1655637 has been marked as a duplicate of this bug. ***

Comment 19 Arcadiy Ivanov 2018-12-06 23:01:26 UTC
The workaround for his is as follows:
> sudo chown root:dbus /usr/libexec/dbus-1/dbus-daemon-launch-helper
> sudo chmod 4754 /usr/libexec/dbus-1/dbus-daemon-launch-helper

This allows abrt-cli to execute properly.

Comment 20 Arcadiy Ivanov 2018-12-06 23:19:08 UTC
This apparently also fixes PowerDevil failing backlighthelper start in bug 1636690.

Comment 21 Vladimir Zhelezov 2018-12-07 07:01:15 UTC
Confirmed, except I used `chmod 4750' i.e. preserved the original file mode bits.

Comment 22 Artem Silenkov 2018-12-22 20:37:53 UTC
Workaround fixed abrt-cli and abrt-applet for me.

Comment 23 Petr Lautrbach 2019-01-02 11:16:22 UTC
*** Bug 1662335 has been marked as a duplicate of this bug. ***

Comment 24 Zdenek Dohnal 2019-01-07 11:48:44 UTC
*** Bug 1640815 has been marked as a duplicate of this bug. ***

Comment 25 Miroslav Suchý 2019-01-08 15:25:08 UTC
As the update got negative karma, can we get a new fix and new update? Please.

Comment 26 karlp 2019-01-14 11:43:47 UTC
Workaround from comment 19 fixes adding printers for me too, and also fixes adding world clocks

Comment 27 Andrew 2019-01-15 17:05:20 UTC
Have same owner/mode as in comment 19:
  -rwsr-xr--. 1 root dbus 74320 Aug  3 09:10 /usr/libexec/dbus-1/dbus-daemon-launch-helper

but still have auth issues, for example:

  $ systemctl suspend --no-ask-password
  Failed to set wall message, ignoring: Interactive authentication required.
  Failed to suspend system via logind: Interactive authentication required.
  # have password request window here
  Failed to start suspend.target: Access denied
  See system logs and 'systemctl status suspend.target' for details.

Comment 28 Matej Marušák 2019-01-16 10:56:21 UTC
*** Bug 1657573 has been marked as a duplicate of this bug. ***

Comment 29 Fedora Update System 2019-01-21 13:57:22 UTC
dbus-1.12.12-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-192523204b

Comment 30 Fedora Update System 2019-01-22 03:03:58 UTC
dbus-1.12.12-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-192523204b

Comment 31 Fedora Update System 2019-01-23 02:28:03 UTC
dbus-1.12.12-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.