Bug 2363531

Not much to go on.  Try stracing the program to see if you can isolate what it's doing.

(In reply to Richard W.M. Jones from comment #1)
> Not much to go on.  Try stracing the program to see if you can isolate what
> it's doing.

Attaching the output of strace -o vpnc.strace -f vpnc vpnc.conf to the original post.

Created attachment 2088017 [details]
output of strace -o vpnc.strace -f vpnc vpnc.conf

Unclear .. I'm going to guess this is from a library as the source of vpnc
does not contain the string "Unknown error" (with capital).  You might want
to try 'gdb' to see if you can grab a stack trace where it's calling exit(255).

I don't get anything useful with gdb either.

Yet, it seems that there is some problem related with sbin being now a symlink.
The command

        rpm -ql vpnc | grep '/vpnc$'

gives:

        /usr/bin/vpnc
        /usr/share/doc/vpnc
        /usr/share/licenses/vpnc

Yet, /usr/bin/vpnc is just a symlink to /user/bin/consolehelper, and just executing either

        /usr/bin/vpnc

or

        /usr/bin/consolehelper

by themselves, with no arguments, already give "Unknown error."

Maybe consolehelper from usermode-1.114-12.fc42 is broken?

In fact, in the working downgraded vpnc for FC41, /usr/sbin/vpnc points to /usr/bin/vpnc, but /usr/bin/vpnc is a true executable, and not a symlink to consolehelper.

...and there is no other link on the system pointing to /usr/bin/consolehelper

I just noticed there's another similar bug: https://bugzilla.redhat.com/show_bug.cgi?id=2362815

Yes, I realized that one. But I think it just says that vpnc requires consolehelper (usermode package), which is not in the dependencies. In FC42,  vpnc is just a symlink. I installed usermode, and the problem persists.

Please see pull request https://src.fedoraproject.org/rpms/vpnc/pull-request/4 regarding a possible solution. The current idea is to use separate file names for starting/stopping vpnc via consolehelper. An unprivileged user would need to run "vpnc-user" / "vpnc-disconnect-user".

*** Bug 2362815 has been marked as a duplicate of this bug. ***

FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-827423d3dd

FEDORA-2025-827423d3dd has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-827423d3dd`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-827423d3dd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

(In reply to Fedora Update System from comment #14)
> FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been
> pushed to the Fedora 42 stable repository.
> If problem still persists, please make note of it in this bug report.

Just to confirm that it appears to be working fine.

(I cannot remember when was the last time that I reported a Fedora bug that was actually solved! Maybe... never before??).
 
Thanks!!

(In reply to Fedora Update System from comment #14)
> FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been
> pushed to the Fedora 42 stable repository.
> If problem still persists, please make note of it in this bug report.

It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The same error occurred on both machines.

Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info>  [1747317418.4014] vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc
Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info>  [1747317418.4017] audit: op="connection-activate" uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000 result="success"
Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn>  [1747317418.4681] vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine Berechtigung)'

Sorry for the German output. Basically, the network manager can't start the child process. The executable seems to be in the right place.

> sudo ls -la /usr/sbin/vpnc
-rwxr-xr-x. 1 root root 170080 20. Jul 2024  /usr/sbin/vpnc

Thanks for your help!

Regards,
Danny

(In reply to Danny Schellnock from comment #16)
> (In reply to Fedora Update System from comment #14)
> > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been
> > pushed to the Fedora 42 stable repository.
> > If problem still persists, please make note of it in this bug report.
> 
> It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The
> same error occurred on both machines.
> 
> Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> 
> [1747317418.4014]
> vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc
> Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> 
> [1747317418.4017] audit: op="connection-activate"
> uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000
> result="success"
> Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn> 
> [1747317418.4681]
> vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to
> connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine
> Berechtigung)'
> 
> Sorry for the German output. Basically, the network manager can't start the
> child process. The executable seems to be in the right place.
> 
> > sudo ls -la /usr/sbin/vpnc
> -rwxr-xr-x. 1 root root 170080 20. Jul 2024  /usr/sbin/vpnc
> 
> Thanks for your help!
> 
> Regards,
> Danny

Sorry, there was a mistake in my last comment. After the update to version 0.5.3^20241114.git11e15a1-2.fc42, the executable file is no longer in the right place, but is replaced by symlinks.

sudo ls -la /usr/sbin/vpnc
lrwxrwxrwx. 1 root root 11 15. Mai 17:42 /usr/sbin/vpnc -> ../bin/vpnc
sudo ls -la /usr/bin/vpnc 
lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc -> consolehelper

Regards,
Danny

(In reply to Danny Schellnock from comment #17)
> (In reply to Danny Schellnock from comment #16)
> > (In reply to Fedora Update System from comment #14)
> > > FEDORA-2025-827423d3dd (vpnc-0.5.3^20241114.git11e15a1-2.fc42) has been
> > > pushed to the Fedora 42 stable repository.
> > > If problem still persists, please make note of it in this bug report.
> > 
> > It isn't working for me. I tested it on two Fedora 42 Workstation PCs. The
> > same error occurred on both machines.
> > 
> > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> 
> > [1747317418.4014]
> > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: starting vpnc
> > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <info> 
> > [1747317418.4017] audit: op="connection-activate"
> > uuid="af85ab7d-77f0-4ef9-97f8-1b9854e72961" name="UBT" pid=2567 uid=1000
> > result="success"
> > Mai 15 15:56:58 neuromancer.localdomain NetworkManager[1311]: <warn> 
> > [1747317418.4681]
> > vpn[0x56125d0f6820,af85ab7d-77f0-4ef9-97f8-1b9854e72961,"UBT"]: failed to
> > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine
> > Berechtigung)'
> > 
> > Sorry for the German output. Basically, the network manager can't start the
> > child process. The executable seems to be in the right place.
> > 
> > > sudo ls -la /usr/sbin/vpnc
> > -rwxr-xr-x. 1 root root 170080 20. Jul 2024  /usr/sbin/vpnc
> > 
> > Thanks for your help!
> > 
> > Regards,
> > Danny
> 
> Sorry, there was a mistake in my last comment. After the update to version
> 0.5.3^20241114.git11e15a1-2.fc42, the executable file is no longer in the
> right place, but is replaced by symlinks.
> 
> sudo ls -la /usr/sbin/vpnc
> lrwxrwxrwx. 1 root root 11 15. Mai 17:42 /usr/sbin/vpnc -> ../bin/vpnc
> sudo ls -la /usr/bin/vpnc 
> lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc -> consolehelper
> 
> Regards,
> Danny

I had a similar problem. I upgraded from FC40 to FC42 with dnf, so not a clean upgrade. My problem was that FC40 used /usr/sbin as a folder, and in FC42 /usr/sbin is a symlink to /usr/bin. The upgrade did not make this symlink, so everything was a mess.

My solution was to analyze /usr/sbin and check that the only non-link was precisely vpnc - related. So I removed /usr/sbin, created the symlink manually /usr/sbin --> /usr/bin (as it should be in FC42), and reinstalled vpnc.

L.

(In reply to Luis A. Florit from comment #18)
> 
> I had a similar problem. I upgraded from FC40 to FC42 with dnf, so not a
> clean upgrade. My problem was that FC40 used /usr/sbin as a folder, and in
> FC42 /usr/sbin is a symlink to /usr/bin. The upgrade did not make this
> symlink, so everything was a mess.
> 
> My solution was to analyze /usr/sbin and check that the only non-link was
> precisely vpnc - related. So I removed /usr/sbin, created the symlink
> manually /usr/sbin --> /usr/bin (as it should be in FC42), and reinstalled
> vpnc.
> 
> L.

Hey Luis,

thanks for your help. I'm having the same problem with FC42 /usr/sbin as you are. I analysed and deleted /usr/sbin, created the symlink, and then reinstalled all the vpnc-related packages. But the problem persists. What is the consolehelper program for?

ls -la /usr/sbin
lrwxrwxrwx. 1 root root    8 15. Mai 18:35 sbin -> /usr/bin

ls -la /usr/bin/vpn*
lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc -> consolehelper
lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc-disconnect -> consolehelper

journalctl -f -u NetworkManager.service
Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info>  [1747327411.5980] audit: op="connection-activate" uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000 result="success"
Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn>  [1747327411.6807] vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine Berechtigung)'

Danny

(In reply to Danny Schellnock from comment #19)
> (In reply to Luis A. Florit from comment #18)
> thanks for your help. I'm having the same problem with FC42 /usr/sbin as you
> are. I analysed and deleted /usr/sbin, created the symlink, and then
> reinstalled all the vpnc-related packages. But the problem persists. What is
> the consolehelper program for?
> 
> ls -la /usr/sbin
> lrwxrwxrwx. 1 root root    8 15. Mai 18:35 sbin -> /usr/bin
> 
> ls -la /usr/bin/vpn*
> lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc -> consolehelper
> lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc-disconnect ->
> consolehelper

- consolehelper is a tool a to allow an unprivileged user to start vpnc with its default config (authentication and authorization handled via PAM)
- due to the /usr/bin /usr/sbin merge, the vpnc package us now using consolehelper even when root starts vpnc
- in my setup, starting vpnc in all variants work (including starting via NetworkManager), so we need to check, why it is not working for you

> journalctl -f -u NetworkManager.service
> Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info> 
> [1747327411.5980] audit: op="connection-activate"
> uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000
> result="success"
> Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn> 
> [1747327411.6807]
> vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to
> connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine
> Berechtigung)'

a) check, that vpnc is installed in the correct version (please provide the output of "rpm -q vpnc")
b) check, that all needed packages are correctly installed ("sudo rpm -V vpnc usermode NetworkManager-vpnc")
c) check, that root can run vpnc ("sudo vpnc --help")
d) do you have SELinux enabled? (please provide the output of "sudo getenforce")

(In reply to Christian Krause from comment #20)
> (In reply to Danny Schellnock from comment #19)
> > (In reply to Luis A. Florit from comment #18)
> > thanks for your help. I'm having the same problem with FC42 /usr/sbin as you
> > are. I analysed and deleted /usr/sbin, created the symlink, and then
> > reinstalled all the vpnc-related packages. But the problem persists. What is
> > the consolehelper program for?
> > 
> > ls -la /usr/sbin
> > lrwxrwxrwx. 1 root root    8 15. Mai 18:35 sbin -> /usr/bin
> > 
> > ls -la /usr/bin/vpn*
> > lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc -> consolehelper
> > lrwxrwxrwx. 1 root root 13  7. Mai 02:00 /usr/bin/vpnc-disconnect ->
> > consolehelper
> 
> - consolehelper is a tool a to allow an unprivileged user to start vpnc with
> its default config (authentication and authorization handled via PAM)
> - due to the /usr/bin /usr/sbin merge, the vpnc package us now using
> consolehelper even when root starts vpnc
> - in my setup, starting vpnc in all variants work (including starting via
> NetworkManager), so we need to check, why it is not working for you

Thanks again! In the meantime, I read the proposal to move /usr/sbin to /usr/bin in Fedora 42, and I found out what this has to do with the ConsoleHelper command.
 
> > journalctl -f -u NetworkManager.service
> > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <info> 
> > [1747327411.5980] audit: op="connection-activate"
> > uuid="4e2ceb1b-39af-45df-8169-64cbbcae7d28" name="UBT" pid=2535 uid=1000
> > result="success"
> > Mai 15 18:43:31 neuromancer.localdomain NetworkManager[1247]: <warn> 
> > [1747327411.6807]
> > vpn[0x5612e1cce590,4e2ceb1b-39af-45df-8169-64cbbcae7d28,"UBT"]: failed to
> > connect: 'Kindprozess »/usr/sbin/vpnc« konnte nicht ausgeführt werden (Keine
> > Berechtigung)'
> 
> a) check, that vpnc is installed in the correct version (please provide the
> output of "rpm -q vpnc")
rpm -q vpnc
vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64

> b) check, that all needed packages are correctly installed ("sudo rpm -V
> vpnc usermode NetworkManager-vpnc")
sudo rpm -V vpnc usermode NetworkManager-vpnc
Does no output mean no error?

> c) check, that root can run vpnc ("sudo vpnc --help")
sudo vpnc --help
Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help] [options] [config files]
..
Looks good.

> d) do you have SELinux enabled? (please provide the output of "sudo
> getenforce")
sudo getenforce
Enforcing

SELinux is enabled. 

Danny

Thanks for providing all information.

(In reply to Danny Schellnock from comment #21)
> (In reply to Christian Krause from comment #20)
> > (In reply to Danny Schellnock from comment #19)
> > > (In reply to Luis A. Florit from comment #18)
> > a) check, that vpnc is installed in the correct version (please provide the
> > output of "rpm -q vpnc")
> rpm -q vpnc
> vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64
> 
> > b) check, that all needed packages are correctly installed ("sudo rpm -V
> > vpnc usermode NetworkManager-vpnc")
> sudo rpm -V vpnc usermode NetworkManager-vpnc
> Does no output mean no error?

Yes, correct.

> 
> > c) check, that root can run vpnc ("sudo vpnc --help")
> sudo vpnc --help
> Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help]
> [options] [config files]
> ..
> Looks good.

Good!

> > d) do you have SELinux enabled? (please provide the output of "sudo
> > getenforce")
> sudo getenforce
> Enforcing

Ok, that's the problem! The changes to vpnc for the /usr/(s)bin merge are causing now trouble with SELinux.

That problem got already reported and will be handled in https://bugzilla.redhat.com/show_bug.cgi?id=2366041. Please subscribe to that bug report for updates.

(In reply to Christian Krause from comment #22)
> Thanks for providing all information.
> 
> (In reply to Danny Schellnock from comment #21)
> > (In reply to Christian Krause from comment #20)
> > > (In reply to Danny Schellnock from comment #19)
> > > > (In reply to Luis A. Florit from comment #18)
> > > a) check, that vpnc is installed in the correct version (please provide the
> > > output of "rpm -q vpnc")
> > rpm -q vpnc
> > vpnc-0.5.3^20241114.git11e15a1-2.fc42.x86_64
> > 
> > > b) check, that all needed packages are correctly installed ("sudo rpm -V
> > > vpnc usermode NetworkManager-vpnc")
> > sudo rpm -V vpnc usermode NetworkManager-vpnc
> > Does no output mean no error?
> 
> Yes, correct.
> 
> > 
> > > c) check, that root can run vpnc ("sudo vpnc --help")
> > sudo vpnc --help
> > Usage: /usr/libexec/vpnc [--version] [--print-config] [--help] [--long-help]
> > [options] [config files]
> > ..
> > Looks good.
> 
> Good!
> 
> > > d) do you have SELinux enabled? (please provide the output of "sudo
> > > getenforce")
> > sudo getenforce
> > Enforcing
> 
> Ok, that's the problem! The changes to vpnc for the /usr/(s)bin merge are
> causing now trouble with SELinux.
> 
> That problem got already reported and will be handled in
> https://bugzilla.redhat.com/show_bug.cgi?id=2366041. Please subscribe to
> that bug report for updates.

Thanks. I will do.