With a fresh install of: boinc-client-6.4.5-1.20081217svn.fc10.x86_64 boinc-manager-6.4.5-1.20081217svn.fc10.x86_64 boinc-client-debuginfo-6.4.5-1.20081217svn.fc10.x86_64 After "/sbin/service boinc-client start" as root, I ran "boincmgr" as beland. I got the GUI, but after a few seconds, it just displays a big red "X Error" and says "Unable to connect to the core client". If I were a novice user, it would be unclear what to do next. This is still the case with 6.4.5-1.20081217svn.fc11.x86_64. Milos Jakubicek said he would add: https://fedoraproject.org/wiki/User:Mjakubicek/HowToUseBoinc as a %doc as part of the 6.4.5 build, but I don't see any documentation for boincmgr in the RPM other than the manpage. http://boinc.berkeley.edu/wiki/Installing_BOINC_on_Fedora explains in more detail why normal users can't connect to the boinc-client service. It's a security feature to prevent users who don't know the root password from changing boinc settings. It would be more user friendly to request the root password when the connection fails (in order to read /var/lib/boinc/gui_rpc_auth.cfg) rather than relying on users to read documentation that's located somewhere else. "Allow all users to change BOINC settings" could be a GUI option rather than requiring users to run a typed command.
(In reply to comment #0) > Milos Jakubicek said he would add: > > https://fedoraproject.org/wiki/User:Mjakubicek/HowToUseBoinc > > as a %doc as part of the 6.4.5 build, but I don't see any documentation for > boincmgr in the RPM other than the manpage. Oops, sorry for that, I just completely forgot about it -- will be in the next update (*not* in the current security related which is already on the way). > > http://boinc.berkeley.edu/wiki/Installing_BOINC_on_Fedora > > explains in more detail why normal users can't connect to the boinc-client > service. It's a security feature to prevent users who don't know the root > password from changing boinc settings. It would be more user friendly to > request the root password when the connection fails (in order to read > /var/lib/boinc/gui_rpc_auth.cfg) rather than relying on users to read > documentation that's located somewhere else. "Allow all users to change BOINC > settings" could be a GUI option rather than requiring users to run a typed > command. This is not so easy. Of course it might be possible to employ consolehelper somehow, but then you would have to use the root password always, which is not good. I'll discuss this issue with upstream, maybe just a more descriptive error message would be enough (e.g. "You should connect using the password stored in /var/lib..."). As this topic occurs again and again, I'm considering to clear (=disable) the password by default -- not sure if this is the right way to go, but it would definitely be a solution.
I believe I have a work around for this problem that may be worth considering. When boinc is installed it creates the boinc group. All files in /var/lib/boinc need to be assigned to this group. Then add the user you want to be able to connect to boinc to this group. Lastly, set up a shell script for boincmgr that changes to the /var/lib/boinc directory and then starts boincmgr in that directory. The manager connects first time, everytime. Most of this solution could be built into the package. Then document the part about any user needing access to boinc should be added to the boinc group.
William, you proposal sounds good, I'll test the solution a bit and make it part of a planned update of the package.
I'm not sure most people just running Fedora as a desktop OS even know what a user group *is*, much less how to add someone to one. They would need to be prompted to do so and/or given explicit instructions.
Christopher, I know its not perfect, but it is definitely a very good trade-off between security and usability. Any other would require changes in BOINC itself (like asking for root password or similar) or clearing the password by default, which I'd really like to avoid if possible. The instructions regarding adding a user to group could be stated on http://boinc.berkeley.edu/wiki/Installing_BOINC_on_Fedora. There will be a USAGE_FEDORA file in the next update linking to that site (which I prefer to the mine, it has more info, it's upstream-maintained, I can make there changes too -- no reason to keep my own now).
Whatever solution you think is best for security is fine with me. But in the case of connection failure, I would recommend giving novice users an obvious way to get the client working. If it's not a PolicyKit authorization, then a pointer to the documentation would be helpful (even if it's distribution-neutral documentation that contains further links to distribution-specific setup). If that requires changes to boinc-client itself, then I think that would be what's required to make the software user-friendly, and it doesn't seem difficult to at least submit a request with the upstream maintainers to do that. I'm just afraid that some people will install it, try to use it, think it looks broken, and then just give up. Documentation in the RPM will be very helpful, but many people won't know how to access it. Sorry if this sounds picky, but since the success of BOINC depends on having as many people use it as possible, it seems to me it should be really easy to use out of the box.
I understand all your arguments, especially that BOINC needs as many people as possible, but this discussion needs definitely to happen upstream, not here. This small change in Fedora goes imho in right way, but needs to be accepted upstream and if possible by other distributions too so that we can move forward and try convincing upstream that BOINC needs some GUI info for auth failures etc. This will, however, be really not easy...they know that all Linux machines all together make only around 2%, so...:( I've commented on http://boinc.berkeley.edu/wiki/Talk:Installing_BOINC_on_Fedora and if you want to lay your hands in this, go ahead and file a ticket in their trac describing our needs (don't forget to make a cc: to "mjakubicek" and yourself as their trac has a "nice" feature called "do not mail the reporter"...)
boinc-client-6.4.7-1.r17542svn.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/boinc-client-6.4.7-1.r17542svn.fc10
boinc-client-6.4.7-1.r17542svn.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/boinc-client-6.4.7-1.r17542svn.fc9
Milos, I had a chance to look over the proposed fix today and determine that it will work as long as BOINCDIR=/var/lib/boinc. While there probably won't be too many people out there that decide to change boinc's working directory we should prepare for that possibility. This of course opens up a whole new issue of the location of the variables in either /etc/sysconfig/boinc-client or /etc/init.d/boinc-client. In my opinion they should all come out of sysconfig and be removed from init.d. Then it would be easy enough to source the sysconfig into the boincmgr wrapper. Perhaps we should save that issue for a separate discussion within the boinc development community. An interim solution would be to use something like awk to pull BOINCDIR first from init.d and then from sysconfig as long as it isn't commented out. This is the way they are sourced in init.d and should produce the desired result. I'll see if I can come up with something, but feel free to beat me to it. Sorry I didn't spot this sooner.
Ops, you're definitely right in this and there is no reason to be sorry, it's me who should have revealed this sooner, I completely forgot about the variability of the data directory:((( However, I think that we don't need to move all the settings to the sysconfig configuration file. We can just source it and if there is no $BOINCDIR specified, then grep it from the init script (which really shouldn't be user-modified, hence we can safely rely on its structure). This seems to work (testing appreciated): if [ -f /etc/sysconfig/boinc-client ]; then . /etc/sysconfig/boinc-client elif [ -f /etc/default/boinc-client ]; then . /etc/default/boinc-client fi if [ -z $BOINCDIR ]; then BOINCDIR=`grep 'BOINCDIR=' /etc/init.d/boinc-client | sed 's|BOINCDIR=||'`; fi cd $BOINCDIR boinc_gui I'll add it to the next release (solving also another small problem regarding the sysconfig file -- see bug 489199). And...yes, I'll raise a discussion on the usability point of view regarding passwords et al. on boinc-devel list soon.
boinc-client-6.4.7-2.r17542svn.fc10 has been pushed to the Fedora 10 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update boinc-client'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-2428
boinc-client-6.4.7-2.r17542svn.fc9 has been pushed to the Fedora 9 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing-newkey update boinc-client'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA-2009-2560
boinc-client-6.4.7-5.r17542svn.fc9 has been pushed to the Fedora 9 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing-newkey update boinc-client'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA-2009-2560
boinc-client-6.4.7-5.r17542svn.fc10 has been pushed to the Fedora 10 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update boinc-client'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-2428
boinc-client-6.4.7-8.r17542svn.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
boinc-client-6.4.7-7.r17542svn.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.