[Bug 1197395] Re: /run/user/$ID/pulse owned by root and not by the user

Fri Mar 30 20:10:55 UTC 2018

With the caveat that I haven't followed the entire thread, I had a
similar problem today on an older 14.04 release: the owner of
/run/user/$id/pulse would "spontaneously" become root. Comment #34 says
this is easily reproducible when running pkexec/synaptic. I believe I
can explain - broadly - what is happening by describing what I can
confirm.

First, here is one way to reproduce the problem:
*) PulseAudio (v4 in this case) starts as a normal user.
*) As root (via sudo su -), run 'aplay --list-devices'
*) /run/user/$id/pulse is now owned by root.

Tracing 'aplay' I can see that it is dlopen()ing a bunch of pulseaudio
support libraries. *Somehow* they (the pulseaudio support libraries, I
presume) determine that pusleaudio is running. They extract a cookie
from /root/.config/cookie and try to connect to the server via
/run/user/$id/pulse/native socket.

At this point, I don't know what the code is trying to do, but what it
_does_ do is this:

mkdir("/run/user/1000/pulse", 0700)     = -1 EEXIST (File exists)
open("/run/user/1000/pulse", O_RDONLY|O_NOCTTY|O_NOFOLLOW|O_CLOEXEC) = 5
fchown(5, 0, 0)                         = 0
fchmod(5, 0700)                         = 0
[...]
getuid()                                = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC, 0) = 5
connect(5, {sa_family=AF_LOCAL, sun_path="/run/user/1000/pulse/native"}, 110) = -1 ENOENT (No such file or directory)
[...]

If my supposition is true that this is in the pulseaudio libraries, any
application running as root (like synaptic) is going to disable the
sound server when it tries to play audio through pulseaudio.

I scanned the pulseaudio changelogs and didn't see anything mentioning
this, but I can also confirm that Ubuntu 17.10 with pulseaudio version
10 and aplay version 1.1.3 does not do this. The older aplay version was
1.0.27.2.

In Ubuntu 17.10 pulseaudio is being run by 'gdm' but the same aplay
strace shows that it now looks for the socket in /var/run/pulse/native
instead of any particular UID in /run. It's unclear to me if the problem
is solved (in pulseaudio, if the culprit) or just band-aided by changing
the configuration (perhaps of ALSA integration with pulseaudio).

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1197395

Title:
  /run/user/$ID/pulse owned by root and not by the user

Status in elementary OS:
  New
Status in pulseaudio package in Ubuntu:
  Invalid
Status in systemd package in Ubuntu:
  Fix Released
Status in pulseaudio source package in Saucy:
  Invalid
Status in systemd source package in Saucy:
  Fix Released
Status in systemd package in Fedora:
  Won't Fix

Bug description:
  I'm experiencing this problem with Ubuntu Saucy. Some times, when I start a media player (I use Musique), it freezes, as it finds that it cannot write into /run/user/$ID/pulse.
  If I change the owner of that directory to me, the media player starts as usual and is able to play music.
  I've never had this problem with previous versions of Ubuntu.
  Someone says that running PulseAudio with the -D argument changes the owner of that directory, but I didn't try.

  This is before manually changing the owner of that directory:
  $ musique
  Failed to create secure directory (/run/user/1000/pulse): Permission denied+

  ... # it doesn't crash, it keeps waiting

  If needed:
  (dmesg attached)
  lspci:
  00:00.0 Host bridge: Intel Corporation Mobile 4 Series Chipset Memory Controller Hub (rev 07)
  00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
  00:02.1 Display controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
  00:1a.0 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #4 (rev 03)
  00:1a.1 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #5 (rev 03)
  00:1a.2 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #6 (rev 03)
  00:1a.7 USB controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #2 (rev 03)
  00:1b.0 Audio device: Intel Corporation 82801I (ICH9 Family) HD Audio Controller (rev 03)
  00:1c.0 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 1 (rev 03)
  00:1c.1 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 2 (rev 03)
  00:1c.2 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 3 (rev 03)
  00:1c.4 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 5 (rev 03)
  00:1c.5 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 6 (rev 03)
  00:1d.0 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #1 (rev 03)
  00:1d.1 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #2 (rev 03)
  00:1d.2 USB controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #3 (rev 03)
  00:1d.7 USB controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #1 (rev 03)
  00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 93)
  00:1f.0 ISA bridge: Intel Corporation ICH9M LPC Interface Controller (rev 03)
  00:1f.2 SATA controller: Intel Corporation 82801IBM/IEM (ICH9M/ICH9M-E) 4 port SATA Controller [AHCI mode] (rev 03)
  02:00.0 Network controller: Qualcomm Atheros AR9285 Wireless Network Adapter (PCI-Express) (rev 01)
  85:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8072 PCI-E Gigabit Ethernet Controller (rev 10)

  From /var/log/syslog:
  Jul  3 14:44:12 Davideddu-Laptop pulseaudio[11387]: [pulseaudio] core-util.c: Failed to create secure directory (/run/user/1000/pulse): Permission denied
  Jul  3 14:44:12 Davideddu-Laptop pulseaudio[11387]: [pulseaudio] main.c: User-configured server at {781995e0a8db2617790d55ca51c37499}unix:/run/user/1000/pulse/native, refusing to start/autospawn.
  Jul  3 14:46:08 Davideddu-Laptop pulseaudio[11443]: [pulseaudio] core-util.c: Failed to create secure directory (/run/user/1000/pulse): Permission denied
  Jul  3 14:46:08 Davideddu-Laptop pulseaudio[11443]: [pulseaudio] main.c: User-configured server at {781995e0a8db2617790d55ca51c37499}unix:/run/user/1000/pulse/native, refusing to start/autospawn.

  This is a fresh installation, I haven't updated it from a previous version. I'm using Ubuntu with Unity, not a derivative.
  These are my PPAs:
  canonical-qt5-edgers-qt5-proper-saucy.list
  dropbox.list
  dukto.list
  google-earth.list
  jd-team-jdownloader-saucy.list
  kivy-team-kivy-saucy.list
  mitya57-ppa-saucy.list
  numix-icon-theme-dev-utouch-saucy.list
  otto-kesselgulasch-gimp-saucy.list
  phablet-team-desktop-deps-saucy.list
  satyajit-happy-themes-saucy.list
  steam.list
  ubuntu-sdk-team-ppa-saucy.list
  ubuntutrucchi.list
  ubuntutrucchi-testing.list
  ubuntu-wine-ppa-saucy.list
  webupd8team-y-ppa-manager-saucy.list

  SRU INFORMATION
  ===============
  TEST CASE:
  - Ensure that as a normal user "echo $XDG_RUNTIME_DIR" is something like "/run/user/1000"
  - do "sudo su -" to get a root shell
  - In that root shell, do "echo $XDG_RUNTIME_DIR". In the saucy final package this still gives /run/user/1000, which is incorrect for root and leads to destroying the real 
  user's runtime dir. With the fixed package it should be empty.

  Fix: http://bazaar.launchpad.net/~ubuntu-
  branches/ubuntu/trusty/systemd/trusty/revision/58 : This checks if the
  runtime dir delivered by logind (which is based on the session uid) is
  owned by the target user, and only puts it in the environment if it
  is.

  Regression potential: The only case where a runtime dir from a
  different user could work at all is for opening a su/pkexec session as
  root; but any client using the runtime dir (pulseaudio, dconf, etc.)
  would destroy the original user's runtime dir, and we don't have any
  functionality which depends on this. For non-root su/pkexec targets
  this potentially leads to different errors (inaccessible
  $XDG_RUNTIME_DIR vs. a nonexisting one). But again the practical
  impact is limited to things that you do in su/pkexec shells, not in
  "real" desktop/ssh/VT login sessions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/elementaryos/+bug/1197395/+subscriptions