[PATCH 0/1][PULL] fix bug 779

[PATCH 0/1][PULL] fix bug 779

[Dongxiao Xu]

From: Dongxiao Xu <dongxiao.xu@intel.com>

This pull request fixes bug 779, please help to review and pull.

After rootless X is enabled, connman-gnome is run under xuser,
so connman need to grant dbus access to that user.

Pull URL: git://git.pokylinux.org/poky-contrib.git
  Branch: dxu4/bugfix
  Browse: http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=dxu4/bugfix

Thanks,
    Dongxiao Xu <dongxiao.xu@intel.com>
---


Dongxiao Xu (1):
  connman: add xuser to the dbus permission list

 .../connman-0.65/add_xuser_dbus_permission.patch   |   21 ++++++++++++++++++++
 meta/recipes-connectivity/connman/connman_0.65.bb  |    3 +-
 2 files changed, 23 insertions(+), 1 deletions(-)
 create mode 100644 meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch

[PATCH 1/1] connman: add xuser to the dbus permission list

[Dongxiao Xu]

From: Dongxiao Xu <dongxiao.xu@intel.com>

Some platform (like atom-pc) enables rootless X,
thus the connman frontend run on it need the
permission to connect with connman by dbus.
This commit grants permission to xuser.

This fixes [BUGID #779]

Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
---
 .../connman-0.65/add_xuser_dbus_permission.patch   |   21 ++++++++++++++++++++
 meta/recipes-connectivity/connman/connman_0.65.bb  |    3 +-
 2 files changed, 23 insertions(+), 1 deletions(-)
 create mode 100644 meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch

diff --git a/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
new file mode 100644
index 0000000..787d49b
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
@@ -0,0 +1,21 @@
+Some platform (like atom-pc) enables rootless X,
+thus we need to add the xuser in the list.
+
+Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
+
+diff -ruN connman-0.65-orig/src/connman-dbus.conf connman-0.65/src/connman-dbus.conf
+--- connman-0.65-orig/src/connman-dbus.conf	2011-03-04 09:34:49.000000000 +0800
++++ connman-0.65/src/connman-dbus.conf	2011-03-04 09:35:21.000000000 +0800
+@@ -7,6 +7,12 @@
+         <allow send_interface="net.connman.Agent"/>
+         <allow send_interface="net.connman.Counter"/>
+     </policy>
++    <policy user="xuser">
++        <allow own="net.connman"/>
++        <allow send_destination="net.connman"/>
++        <allow send_interface="net.connman.Agent"/>
++        <allow send_interface="net.connman.Counter"/>
++    </policy>
+     <policy at_console="true">
+         <allow send_destination="net.connman"/>
+     </policy>
diff --git a/meta/recipes-connectivity/connman/connman_0.65.bb b/meta/recipes-connectivity/connman/connman_0.65.bb
index 0b077e1..8bb84a1 100644
--- a/meta/recipes-connectivity/connman/connman_0.65.bb
+++ b/meta/recipes-connectivity/connman/connman_0.65.bb
@@ -1,5 +1,5 @@
 require connman.inc
-PR = "r0"
+PR = "r1"
 
 EXTRA_OECONF += "\
   ac_cv_path_WPASUPPLICANT=/usr/sbin/wpa_supplicant \
@@ -21,6 +21,7 @@ EXTRA_OECONF += "\
 SRC_URI  = "\
   http://www.kernel.org/pub/linux/network/connman/connman-${PV}.tar.gz \
   file://fix-shutdown-ap-disconnect.patch \
+  file://add_xuser_dbus_permission.patch \
   file://connman \
 "
 
-- 
1.7.1

Re: [PATCH 1/1] connman: add xuser to the dbus permission list

[Xu, Dongxiao]

Dongxiao Xu wrote:
> From: Dongxiao Xu <dongxiao.xu@intel.com>
> 
> Some platform (like atom-pc) enables rootless X, thus the connman
> frontend run on it need the permission to connect with connman by
> dbus.  
> This commit grants permission to xuser.
> 
> This fixes [BUGID #779]

This line has been changed to [YOCTO #779] in the branch. I forgot to change it in pull request.
See http://git.pokylinux.org/cgit/cgit.cgi/poky-contrib/commit/?h=dxu4/bugfix&id=9bbd4a5d8521de2667bc13eb51023519653db3c4

Thanks,
Dongxiao

> 
> Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
> ---
>  .../connman-0.65/add_xuser_dbus_permission.patch   |   21
>  ++++++++++++++++++++
>  meta/recipes-connectivity/connman/connman_0.65.bb  |    3 +- 2 files
> changed, 23 insertions(+), 1 deletions(-)  create mode 100644
> meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> 
> diff --git
> a/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> new file mode 100644  
> index 0000000..787d49b
> --- /dev/null
> +++
> b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_perm
> +++ ission.patch @@ -0,0 +1,21 @@
> +Some platform (like atom-pc) enables rootless X, thus we need to add
> +the xuser in the list.
> +
> +Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
> +
> +diff -ruN connman-0.65-orig/src/connman-dbus.conf
> connman-0.65/src/connman-dbus.conf +---
> connman-0.65-orig/src/connman-dbus.conf	2011-03-04 09:34:49.000000000
> +0800 ++++ connman-0.65/src/connman-dbus.conf	2011-03-04
> 09:35:21.000000000 +0800 +@@ -7,6 +7,12 @@ +         <allow
> send_interface="net.connman.Agent"/> +         <allow
> send_interface="net.connman.Counter"/> +     </policy>
> ++    <policy user="xuser">
> ++        <allow own="net.connman"/>
> ++        <allow send_destination="net.connman"/>
> ++        <allow send_interface="net.connman.Agent"/>
> ++        <allow send_interface="net.connman.Counter"/>
> ++    </policy>
> +     <policy at_console="true">
> +         <allow send_destination="net.connman"/>
> +     </policy>
> diff --git a/meta/recipes-connectivity/connman/connman_0.65.bb
> b/meta/recipes-connectivity/connman/connman_0.65.bb 
> index 0b077e1..8bb84a1 100644
> --- a/meta/recipes-connectivity/connman/connman_0.65.bb
> +++ b/meta/recipes-connectivity/connman/connman_0.65.bb
> @@ -1,5 +1,5 @@
>  require connman.inc
> -PR = "r0"
> +PR = "r1"
> 
>  EXTRA_OECONF += "\
>    ac_cv_path_WPASUPPLICANT=/usr/sbin/wpa_supplicant \ @@ -21,6 +21,7
>    @@ EXTRA_OECONF += "\  SRC_URI  = "\
>   
> http://www.kernel.org/pub/linux/network/connman/connman-${PV}.tar.gz
>    \ file://fix-shutdown-ap-disconnect.patch \ + 
>  file://add_xuser_dbus_permission.patch \ file://connman \ "

Re: [PATCH 1/1] connman: add xuser to the dbus permission list

[Yu Ke]

Hi Dongxiao,

Thanks for the fix. I just feel it may be better to do it in rootless x routine, instead of connman. because the "xuser" is introduced by rootless x routine, and the user name is configurable by /etc/X11/Xusername (details in meta/recipes-graphics/x11-common/xserver-nodm-init.bb: pkg_postinst). if the user name changed by user configuration, the connman will break again.

So I wonder if connman has the standard interface to grant permission, so that rootless x routine can call it to grant xuser permission. e.g.
- A group-based policy, i.e. for any user belongs to the connman group, it will has the required dbus permission.
- or a standalone command like "connman-perm xuser" which can add xuser into connman-dbus.conf

Also another alternative is: in connman pkg_postinst, get x user name from /etc/X11/Xusername, then grant the user permission. in this case, at least you won't need to hardcode the xuser name.

Regards
Ke

On Mar 07, 16:00, Dongxiao Xu wrote:
> From: Dongxiao Xu <dongxiao.xu@intel.com>
> 
> Some platform (like atom-pc) enables rootless X,
> thus the connman frontend run on it need the
> permission to connect with connman by dbus.
> This commit grants permission to xuser.
> 
> This fixes [BUGID #779]
> 
> Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
> ---
>  .../connman-0.65/add_xuser_dbus_permission.patch   |   21 ++++++++++++++++++++
>  meta/recipes-connectivity/connman/connman_0.65.bb  |    3 +-
>  2 files changed, 23 insertions(+), 1 deletions(-)
>  create mode 100644 meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> 
> diff --git a/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> new file mode 100644
> index 0000000..787d49b
> --- /dev/null
> +++ b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permission.patch
> @@ -0,0 +1,21 @@
> +Some platform (like atom-pc) enables rootless X,
> +thus we need to add the xuser in the list.
> +
> +Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
> +
> +diff -ruN connman-0.65-orig/src/connman-dbus.conf connman-0.65/src/connman-dbus.conf
> +--- connman-0.65-orig/src/connman-dbus.conf	2011-03-04 09:34:49.000000000 +0800
> ++++ connman-0.65/src/connman-dbus.conf	2011-03-04 09:35:21.000000000 +0800
> +@@ -7,6 +7,12 @@
> +         <allow send_interface="net.connman.Agent"/>
> +         <allow send_interface="net.connman.Counter"/>
> +     </policy>
> ++    <policy user="xuser">
> ++        <allow own="net.connman"/>
> ++        <allow send_destination="net.connman"/>
> ++        <allow send_interface="net.connman.Agent"/>
> ++        <allow send_interface="net.connman.Counter"/>
> ++    </policy>
> +     <policy at_console="true">
> +         <allow send_destination="net.connman"/>
> +     </policy>
> diff --git a/meta/recipes-connectivity/connman/connman_0.65.bb b/meta/recipes-connectivity/connman/connman_0.65.bb
> index 0b077e1..8bb84a1 100644
> --- a/meta/recipes-connectivity/connman/connman_0.65.bb
> +++ b/meta/recipes-connectivity/connman/connman_0.65.bb
> @@ -1,5 +1,5 @@
>  require connman.inc
> -PR = "r0"
> +PR = "r1"
>  
>  EXTRA_OECONF += "\
>    ac_cv_path_WPASUPPLICANT=/usr/sbin/wpa_supplicant \
> @@ -21,6 +21,7 @@ EXTRA_OECONF += "\
>  SRC_URI  = "\
>    http://www.kernel.org/pub/linux/network/connman/connman-${PV}.tar.gz \
>    file://fix-shutdown-ap-disconnect.patch \
> +  file://add_xuser_dbus_permission.patch \
>    file://connman \
>  "
>  
> -- 
> 1.7.1
> 
> _______________________________________________
> poky mailing list
> poky@yoctoproject.org
> https://lists.yoctoproject.org/listinfo/poky

current master tree build failed.

[Kang Kai]

Hi,

I pull the master tree and HEAD is 
fab742bd4693ed3092690a20dd32d53fe27c3d4c. When I run bitbake, I got the 
error message:

ERROR:  Poky's config sanity checker detected a potential misconfiguration.
     Either fix the cause of this error or at your own risk disable the 
checker (see sanity.conf).
     Following is the list of potential problems / advisories:

     Please set TARGET_OS directly, or choose a MACHINE or DISTRO that 
does so.
DISTRO 'poky' not found. Please set a valid DISTRO in your local.conf

What can I  do to remove this? Thanks.

Regards,
Kang Kai

Re: current master tree build failed.

[Kang Kai]

On 2011年03月09日 13:53, Kang Kai wrote:
> Hi,
>
> I pull the master tree and HEAD is 
> fab742bd4693ed3092690a20dd32d53fe27c3d4c. When I run bitbake, I got 
> the error message:
>
> ERROR: Poky's config sanity checker detected a potential 
> misconfiguration.
> Either fix the cause of this error or at your own risk disable the 
> checker (see sanity.conf).
> Following is the list of potential problems / advisories:
>
> Please set TARGET_OS directly, or choose a MACHINE or DISTRO that does 
> so.
> DISTRO 'poky' not found. Please set a valid DISTRO in your local.conf
>
> What can I do to remove this? Thanks.
>
> Regards,
> Kang Kai
> _______________________________________________
> poky mailing list
> poky@yoctoproject.org
> https://lists.yoctoproject.org/listinfo/poky
Solved. Many thanks to Jingdong.
add meta-yocto directory to conf/bblayers.conf.

Re: [PATCH 1/1] connman: add xuser to the dbus permission list

[Xu, Dongxiao]

Hi Ke,

Yu, Ke wrote:
> Hi Dongxiao,
> 
> Thanks for the fix. I just feel it may be better to do it in rootless
> x routine, instead of connman. because the "xuser" is introduced by
> rootless x routine, and the user name is configurable by
> /etc/X11/Xusername (details in
> meta/recipes-graphics/x11-common/xserver-nodm-init.bb: pkg_postinst).
> if the user name changed by user configuration, the connman will
> break again.    

Thanks for pointing it out, your concern is reasonable. Hardcode xuser in
connman's config file will have problems if user did any change to the name.
  
> 
> So I wonder if connman has the standard interface to grant
> permission, so that rootless x routine can call it to grant xuser
> permission. e.g.  
> - A group-based policy, i.e. for any user belongs to the connman
> group, it will has the required dbus permission. 
> - or a standalone command like "connman-perm xuser" which can add
> xuser into connman-dbus.conf 

I found there is another item in the connman.conf, named "at_console",
which can authenticate permissions to user.
That module needs libpam as its basic. It seems that currently sato image
didn't install pam into target system.

The original commit was checked in master, at least it will not block QA's testings.

I will think about using more convenient way to fix the problem.

Thanks,
Dongxiao

> 
> Also another alternative is: in connman pkg_postinst, get x user name
> from /etc/X11/Xusername, then grant the user permission. in this
> case, at least you won't need to hardcode the xuser name.  
> 
> Regards
> Ke
> 
> On Mar 07, 16:00, Dongxiao Xu wrote:
>> From: Dongxiao Xu <dongxiao.xu@intel.com>
>> 
>> Some platform (like atom-pc) enables rootless X, thus the connman
>> frontend run on it need the permission to connect with connman by
>> dbus.
>> This commit grants permission to xuser.
>> 
>> This fixes [BUGID #779]
>> 
>> Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
>> ---
>>  .../connman-0.65/add_xuser_dbus_permission.patch   |   21
>>  ++++++++++++++++++++
>>  meta/recipes-connectivity/connman/connman_0.65.bb  |    3 +- 2
>> files changed, 23 insertions(+), 1 deletions(-)  create mode 100644
>> meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permissi
>> on.patch
>> 
>> diff --git
>> a/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permis
>> sion.patch
>> b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_permis
>> sion.patch
>> new file mode 100644
>> index 0000000..787d49b
>> --- /dev/null
>> +++
>> b/meta/recipes-connectivity/connman/connman-0.65/add_xuser_dbus_pe
>> +++ rmission.patch @@ -0,0 +1,21 @@ +Some platform (like atom-pc)
>> enables rootless X, thus we need to add +the xuser in the list. +
>> +Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com> +
>> +diff -ruN connman-0.65-orig/src/connman-dbus.conf
>> connman-0.65/src/connman-dbus.conf +---
>> connman-0.65-orig/src/connman-dbus.conf	2011-03-04
>> 09:34:49.000000000 +0800 ++++
>> connman-0.65/src/connman-dbus.conf	2011-03-04 09:35:21.000000000
>> +0800 +@@ -7,6 +7,12 @@ +         <allow
>> send_interface="net.connman.Agent"/> +         <allow
>> send_interface="net.connman.Counter"/> +     </policy> ++    <policy
>> user="xuser"> ++        <allow own="net.connman"/> ++        <allow
>> send_destination="net.connman"/> ++        <allow
>> send_interface="net.connman.Agent"/> ++        <allow
>> send_interface="net.connman.Counter"/> ++    </policy> +     <policy
>> at_console="true"> +         <allow send_destination="net.connman"/>
>> +     </policy> 
>> diff --git a/meta/recipes-connectivity/connman/connman_0.65.bb
>> b/meta/recipes-connectivity/connman/connman_0.65.bb
>> index 0b077e1..8bb84a1 100644
>> --- a/meta/recipes-connectivity/connman/connman_0.65.bb
>> +++ b/meta/recipes-connectivity/connman/connman_0.65.bb @@ -1,5 +1,5
>>  @@ require connman.inc
>> -PR = "r0"
>> +PR = "r1"
>> 
>>  EXTRA_OECONF += "\
>>    ac_cv_path_WPASUPPLICANT=/usr/sbin/wpa_supplicant \ @@ -21,6 +21,7
>> @@ EXTRA_OECONF += "\  SRC_URI  = "\
>>   
>>   
>> http://www.kernel.org/pub/linux/network/connman/connman-${PV}.tar.gz
>>    \ file://fix-shutdown-ap-disconnect.patch \ + 
>>  file://add_xuser_dbus_permission.patch \ file://connman \ "
>> 
>> --
>> 1.7.1
>> 
>> _______________________________________________
>> poky mailing list
>> poky@yoctoproject.org
>> https://lists.yoctoproject.org/listinfo/poky

Re: [PATCH 1/1] connman: add xuser to the dbus permission list

[Koen Kooi]

Op 10 mrt 2011, om 07:40 heeft Xu, Dongxiao het volgende geschreven:

> Hi Ke,
> 
> Yu, Ke wrote:
>> Hi Dongxiao,
>> 
>> Thanks for the fix. I just feel it may be better to do it in rootless
>> x routine, instead of connman. because the "xuser" is introduced by
>> rootless x routine, and the user name is configurable by
>> /etc/X11/Xusername (details in
>> meta/recipes-graphics/x11-common/xserver-nodm-init.bb: pkg_postinst).
>> if the user name changed by user configuration, the connman will
>> break again.    
> 
> Thanks for pointing it out, your concern is reasonable. Hardcode xuser in
> connman's config file will have problems if user did any change to the name.
> 
>> 
>> So I wonder if connman has the standard interface to grant
>> permission, so that rootless x routine can call it to grant xuser
>> permission. e.g.  
>> - A group-based policy, i.e. for any user belongs to the connman
>> group, it will has the required dbus permission. 
>> - or a standalone command like "connman-perm xuser" which can add
>> xuser into connman-dbus.conf 
> 
> I found there is another item in the connman.conf, named "at_console",
> which can authenticate permissions to user.
> That module needs libpam as its basic. It seems that currently sato image
> didn't install pam into target system.

Note that at_console is utterly broken, I discussed it with Marcel in the past and he agrees something different needs to get used, but at that time (2008) there wasn't a good candidate. 

regards,

Koen