KDEneon sudoers.d files not working again

[claydoh]

I never use "upgrade" only "full-upgrade" so that's why I never noticed the change. Old habits...

Well, the old habits are the correct ones for *buntus of course. If Neon was Debian based, it might might make a mess if you didn't larn noo wuns.

[oshunluvr]

Funny that neon still says:

stuart@office:/usr/share/X11/xorg.conf.d$ apper

Command 'apper' not found, but can be installed with:


sudo apt install apper

[oshunluvr]

I never use "upgrade" only "full-upgrade" so that's why I never noticed the change. Old habits...

[claydoh]

I was looking at the contents of the neon-settings package, but didn't dig too deep, but one of the things neon-settings adds is the /usr/sbin/apt and /usr/sbin/apt-get, which are actually symlinks to a ruby script /usr/sbin/apt-overlay:

# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

# Intercept apt calls and inform the user that upgrade is not a valid argument
# on neon.

# Apt is a CLI tool. I don't think this is worth faffing about with translations
# for, so we just use verbatim strings here without any l10n rigging.

# When in batch mode let 'upgrade' through all the same. Batch mode is when
# no tty is attached to stdout. This is in line with how apt's interface
# stability warning works.
# This is specifically to prevent scripts from breaking. e.g. ubiquity
# will attempt to run upgrade but should generally qualify as !tty.
if ARGV.include?('upgrade') && STDOUT.isatty
 [COLOR="#FF0000"] warn 'On KDE neon you should use `pkcon update` to install updates.'
  warn 'If you absolutely must use apt you do have to use dist-upgrade or' \
       ' full-upgrade in place of the upgrade command.'
  warn '  [url]https://neon.kde.org/faq#command-to-update[/url]'
[/COLOR]
  abort 'Abort.' unless ARGV.include?('-y') || ARGV.include?('--yes')
end

basename = File.basename(__FILE__)
exec("/usr/bin/#{basename}", *ARGV)

So basically, this is to give a warning to Neon users who attempt to use apt as if it were a Debian distro , where upgrade is the the correct usage, over dist-upgrade of full-upgrade.
This was sort of a rampant issue early on, which is why the devs chose to promote pkcon, as the commands there are the same no matter the distro (including Suse and Fedora)

/usr/sbin takes precedence over /usr/bin, and the script calling /usr/bin/apt , but adding the message only if upgrade is called

[oshunluvr]

I guess neon-settings must contain a piece that redirects bin/apt to sbin/apt - to explain why that package made a difference.

[oshunluvr]

That's interesting. /usr/sbin/apt and apt-get are links to /usr/sbin/apt-overlay, which unless I'm mistaken uses /usr/bin/apt and apt-get:

[FONT=monospace][COLOR=#000000]if ARGV.include?('upgrade') && STDOUT.isatty[/COLOR]
  warn 'On KDE neon you should use `pkcon update` to install updates.'
  warn 'If you absolutely must use apt you do have to use dist-upgrade or' \
       ' full-upgrade in place of the upgrade command.'
  warn '  https://neon.kde.org/faq#command-to-update'

  abort 'Abort.' unless ARGV.include?('-y') || ARGV.include?('--yes')
end

basename = File.basename(__FILE__)
exec("/usr/bin/#{basename}", *ARGV)

[/FONT]

The key being the last line. Strange way to implement this.

[Snowhog]

I have to amend my earlier statement that it all works here in my KDE neon User Edition installation. I just now tried running sudo apt update and was prompted for my password, so yes, what you are experiencing affects me as well. My /etc/sudoers.d/paul contents:

paul barley-cat = (root) NOPASSWD: /usr/bin/apt,/usr/bin/apt-get,/usr/bin/add-apt-repository,/usr/bin/apt-add-repository,/usr/bin/ucaresystem-core

Executing sudo apt (or apt-get) update prompts for my password.

Harald Sitter just commented on your bug report. Says, and I confirmed here, that KDE neon now uses /usr/sbin/apt and /usr/sbin/apt-get. I changed my references in /etc/sudoers.d/paul and verified that apt and apt-get now don't prompt for my password.

[oshunluvr]

More info:

Here's the bug report: https://bugs.kde.org/show_bug.cgi?id=407729

Basically, I've narrowed the behavior down to just apt and apt-get. All my other commands in sudoers.d work including those in the same file and line as /usr/bin/apt and /usr/bin/apt-get regardless of the installation of neon-settings except for apt and apt-get. Once neon-settings is uninstalled, apt and apt-get will work without a sudo password. I've been able to replicate this in VMs and well as on my system.

Weirdly specific. isn't it? I'm thinking it's likely something apt and apt-get access rather than the actual binaries themselves but I don't know what to look at next.

[Snowhog]

Curiouser and curiouser.

Here:

show neon-settings

Package: neon-settings
Priority: optional
Section: kde
Installed-Size: 324
Maintainer: Neon CI <[EMAIL="neon@kde.org"]neon@kde.org[/EMAIL]>
Architecture: all
Version: 0.0+p18.04+git20190506.0955
Depends: ruby, debconf (>= 0.5) | debconf-2.0
Conflicts: kubuntu-settings-desktop
Filename: pool/main/n/neon-settings/neon-settings_0.0+p18.04+git20190506.0955_all.deb
Size: 41716
MD5sum: 8b7166ccd8e174021818530fcb02cb1e
SHA1: 9538c21ad5545b68ce2a085af2a8f3fa36b99820
SHA256: 428a7c57de0db820d7e23d8c0cd1b6fa334c987ebd16edf965a36e9932828603
SHA512: 5a1433f09eae498662b35eafa31865d371ccabfd384b82d6a804c36a97dfd192e23035754b275160f4ac22555cd50603b1982929e737c05a78a3bcba3c7c178c
Description: Settings and artwork for KDE neon
 This package contains settings used by KDE neon. It also
 includes artwork and KDE neon branding.
 .
 The settings apply to plasma-desktop based workspaces.
Description-md5: 4da8a2413e6f90e043e971e4e24451dc

Package: neon-settings
Priority: optional
Section: kde
Installed-Size: 324
Maintainer: Neon CI <[EMAIL="neon@kde.org"]neon@kde.org[/EMAIL]>
Architecture: all
Version: 0.0+p18.04+git20190502.1557
Depends: ruby, debconf (>= 0.5) | debconf-2.0
Conflicts: kubuntu-settings-desktop
Filename: pool/main/n/neon-settings/neon-settings_0.0+p18.04+git20190502.1557_all.deb
Size: 41576
MD5sum: 104b378ec588d4570c1c0531a31bd917
SHA1: bbb2ecf5f8bff8decf4dde78176b220d4a248837
SHA256: bac7b0d903fc150411775892835520b3b715fb3209376229982ba7fb93300d0c
SHA512: 66b0071626241eacf7e836ea193516cc8f18c28e3f96f85348a1e2dba12a9ad4cef9bfc67bf0aa9d14f48076dd69584d2c66825a5ac31bc95192b671219ec7d9
Description: Settings and artwork for KDE neon
 This package contains settings used by KDE neon. It also
 includes artwork and KDE neon branding.
 .
 The settings apply to plasma-desktop based workspaces.
Description-md5: 4da8a2413e6f90e043e971e4e24451dc

Package: neon-settings
Priority: optional
Section: kde
Installed-Size: 323
Maintainer: Neon CI <[EMAIL="neon@kde.org"]neon@kde.org[/EMAIL]>
Architecture: all
Version: 0.0+p18.04+git20190429.1237
Depends: ruby, debconf (>= 0.5) | debconf-2.0
Conflicts: kubuntu-settings-desktop
Filename: pool/main/n/neon-settings/neon-settings_0.0+p18.04+git20190429.1237_all.deb
Size: 41484
MD5sum: 8e926f0497612c9d16366c5cbf9bedea
SHA1: 9d4526a945cf8dacc3dcc303956a93b0362723d9
SHA256: bf2156abd6a69ddc2b6c4619bf38c7623e3070954807b1972b1c0734cf845f3c
SHA512: f6395ade39589e815c213cbd7663d0cf97d6eac83f2f5cf7d8bd9606c609d98667ae8ecd2b25f757f3cc2687cef09ce769c6a0df1cbddfe893d3f2fd695dfc3d
Description: Settings and artwork for KDE neon
 This package contains settings used by KDE neon. It also
 includes artwork and KDE neon branding.
 .
 The settings apply to plasma-desktop based workspaces.
Description-md5: 4da8a2413e6f90e043e971e4e24451dc

Package: neon-settings
Priority: optional
Section: kde
Installed-Size: 319
Maintainer: Neon CI <[EMAIL="neon@kde.org"]neon@kde.org[/EMAIL]>
Architecture: all
Version: 0.0+p18.04+git20190423.1433
Depends: ruby, debconf (>= 0.5) | debconf-2.0
Conflicts: kubuntu-settings-desktop
Filename: pool/main/n/neon-settings/neon-settings_0.0+p18.04+git20190423.1433_all.deb
Size: 41044
MD5sum: 6d34d533a9518725f1717ecfd3c0950f
SHA1: 27733103765ce42d885490fa4e5640ec76ce8c23
SHA256: b6391d81b8ca431575f8fa95962580abe949fab1823e70c42d8d08761a540146
SHA512: 797b6ada36d6989af309e4eb0a0e40157883e30c34ece46f727fd125b2edda8a0f0654c0dee7868410a70929877fae50d205c6a9fb90bd6a48eb7fc5ff02ae7b
Description: Settings and artwork for KDE neon
 This package contains settings used by KDE neon. It also
 includes artwork and KDE neon branding.
 .
 The settings apply to plasma-desktop based workspaces.
Description-md5: 4da8a2413e6f90e043e971e4e24451dc



sudo apt install --simulate neon-settings


[sudo] password for paul: 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
neon-settings is already the newest version (0.0+p18.04+git20190506.0955).
neon-settings set to manually installed.
Starting pkgProblemResolver with broken count: 0
Starting 2 pkgProblemResolver with broken count: 0
Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

And in this KDE neon User Edition, as stated, it works.

[oshunluvr]

OK, here's a new item: I uninstalled kubuntu-settings-desktop and this did not bring back in the two neon packages. sudoers is working normally. Then I re-installed neon-settings and sudoers broke again:

stuart@office:~$ sudo apt install neon-settings
Reading package lists... Done
Building dependency tree
Reading state information... Done
Starting pkgProblemResolver with broken count: 0
Starting 2 pkgProblemResolver with broken count: 0
Done
The following package was automatically installed and is no longer required:
ttf-ubuntu-font-family
Use 'sudo apt autoremove' to remove it.
The following NEW packages will be installed:
neon-settings
0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
Need to get 41.7 kB of archives.
After this operation, 332 kB of additional disk space will be used.
Get:1 http://archive.neon.kde.org/user/lts bionic/main amd64 neon-settings all 0.0+p18.04+git20190506.0955 [41.7 kB]
Fetched 41.7 kB in 1s (58.3 kB/s)
Preconfiguring packages ...
Selecting previously unselected package neon-settings.
(Reading database ... 273949 files and directories currently installed.)
Preparing to unpack .../neon-settings_0.0+p18.04+git20190506.0955_all.deb ...
Adding 'diversion of /usr/share/applications/display-im6.desktop to /usr/share/applications/display-im6.desktop.distrib by neon-settings'
Adding 'diversion of /usr/share/applications/display-im6.q16.desktop to /usr/share/applications/display-im6.q16.desktop.distrib by neon-settings'
Adding 'diversion of /usr/share/applications/vim.desktop to /usr/share/applications/vim.desktop.distrib by neon-settings'
Adding 'diversion of /lib/systemd/system/setvtrgb.service to /lib/systemd/system/setvtrgb.service.distrib by neon-settings'
Adding 'diversion of /usr/bin/firefox to /usr/bin/_neon.firefox by neon-settings'
Unpacking neon-settings (0.0+p18.04+git20190506.0955) ...
Processing triggers for mime-support (3.60ubuntu1) ...
Processing triggers for desktop-file-utils (0.23-1ubuntu3.18.04.2) ...
Setting up neon-settings (0.0+p18.04+git20190506.0955) ...
Installing new version of config file /etc/xdg/kcm-about-distrorc ...
Processing triggers for hicolor-icon-theme (0.17-2) ...
stuart@office:~$

[oshunluvr]

I installed all the dependencies prior to installing the kubuntu-settings-desktop. Still, that did not solve the problem.

When I did finally install kubuntu-settings-desktop only neon-settings and neon-desktop were auto-uninstalled and no other packages were installed. Miraculously, sudoers began working.

I just did it again this time on my actual desktop install rather than a VM. It did install ttf-ubuntu-font-family, but on the VM I had already installed that before testing sudo. This means all the dependencies were already present on my desktop except ttf-ubuntu-font-family.

Here's the terminal output:

stuart@office:/shared/Documents$ sudo apt install kubuntu-settings-desktop
Reading package lists... Done
Building dependency tree
Reading state information... Done
Starting pkgProblemResolver with broken count: 1
Starting 2 pkgProblemResolver with broken count: 1
Investigating (0) neon-settings:amd64 < 0.0+p18.04+git20190506.0955 @ii mK Ib >
Broken neon-settings:amd64 Conflicts on kubuntu-settings-desktop:amd64 < none -> 1:18.04ubuntu11 @un puN >
Considering kubuntu-settings-desktop:amd64 9998 as a solution to neon-settings:amd64 3
Removing neon-settings:amd64 rather than change kubuntu-settings-desktop:amd64
Investigating (0) neon-desktop:amd64 < 4+p18.04+git20181030.2058 @ii mK NPb Ib >
Broken neon-desktop:amd64 Depends on neon-settings:amd64 < 0.0+p18.04+git20190506.0955 @ii mR >
Considering neon-settings:amd64 3 as a solution to neon-desktop:amd64 0
Removing neon-desktop:amd64 rather than change neon-settings:amd64
Done
The following packages were automatically installed and are no longer required:
linux-headers-4.18.0-17 linux-headers-4.18.0-17-generic linux-image-4.18.0-17-generic linux-modules-4.18.0-17-generic linux-modules-extra-4.18.0-17-generic
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
ttf-ubuntu-font-family
The following packages will be REMOVED:
neon-desktop neon-settings
The following NEW packages will be installed:
kubuntu-settings-desktop ttf-ubuntu-font-family
0 upgraded, 2 newly installed, 2 to remove and 1 not upgraded.
Need to get 313 kB of archives.
After this operation, 158 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://us.archive.ubuntu.com/ubuntu bionic/universe amd64 ttf-ubuntu-font-family all 1:0.83-2 [10.2 kB]
Get:2 http://us.archive.ubuntu.com/ubuntu bionic/universe amd64 kubuntu-settings-desktop all 1:18.04ubuntu11 [303 kB]
Fetched 313 kB in 0s (1,094 kB/s)
(Reading database ... 308696 files and directories currently installed.)
Removing neon-desktop (4+p18.04+git20181030.2058) ...
Removing neon-settings (0.0+p18.04+git20190506.0955) ...
Removing 'diversion of /usr/share/applications/display-im6.desktop to /usr/share/applications/display-im6.desktop.distrib by neon-settings'
Removing 'diversion of /usr/share/applications/display-im6.q16.desktop to /usr/share/applications/display-im6.q16.desktop.distrib by neon-settings'
Removing 'diversion of /usr/share/applications/vim.desktop to /usr/share/applications/vim.desktop.distrib by neon-settings'
Removing 'diversion of /lib/systemd/system/setvtrgb.service to /lib/systemd/system/setvtrgb.service.distrib by neon-settings'
Removing 'diversion of /usr/bin/firefox to /usr/bin/_neon.firefox by neon-settings'
Selecting previously unselected package ttf-ubuntu-font-family.
(Reading database ... 308643 files and directories currently installed.)
Preparing to unpack .../ttf-ubuntu-font-family_1%3a0.83-2_all.deb ...
Unpacking ttf-ubuntu-font-family (1:0.83-2) ...
Selecting previously unselected package kubuntu-settings-desktop.
Preparing to unpack .../kubuntu-settings-desktop_1%3a18.04ubuntu11_all.deb ...
Unpacking kubuntu-settings-desktop (1:18.04ubuntu11) ...
Processing triggers for mime-support (3.60ubuntu1) ...
Processing triggers for desktop-file-utils (0.23-1ubuntu3.18.04.2) ...
Setting up ttf-ubuntu-font-family (1:0.83-2) ...
Processing triggers for hicolor-icon-theme (0.17-2) ...
Setting up kubuntu-settings-desktop (1:18.04ubuntu11) ...
Installing new version of config file /etc/xdg/kcm-about-distrorc ...
update-alternatives: using /etc/newt/palette.original to provide /etc/newt/palette (newt-palette) in manual mode
Sourcing file `/etc/default/grub'
Sourcing file `/etc/default/grub.d/99_breeze-grub.cfg'
Generating grub configuration file ...
Found theme: /boot/grub/themes/breeze/theme.txt
Found linux image: /boot/vmlinuz-4.18.0-20-generic
Found initrd image: /boot/initrd.img-4.18.0-20-generic
Found linux image: /boot/vmlinuz-4.18.0-18-generic
Found initrd image: /boot/initrd.img-4.18.0-18-generic
Found linux image: /boot/vmlinuz-4.18.0-17-generic
Found initrd image: /boot/initrd.img-4.18.0-17-generic

Whatever it is, it's not easy to find. The "diversion" statements are interesting, but I haven't the time to run them down at the moment.

My next test will be to install neon yet again, install all that's needed EXCEPT kubuntu-settings-desktop, then snapshot, then install the final package and do a diff of the snapshot against the install. At least we'll know what was added, removed, or edited.

[claydoh]

I have looked at the contents of neon-settings source, and I can't see any scripts or modifications that blatantly involve sudo in any way, at least not anything obvious. I highly doubt it is an dependency difference, as the only deps it has for installation is ruby.

I think it must be doing something on the packagekit side maybe? It does disable unattended upgrades via packagekit, so maybe something is affecting polkit and/or packagekit?

[Snowhog]

Back in my KDE neon User Edition VM.

kubuntu-settings-desktop is available for installation. A simulated install shows:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Starting pkgProblemResolver with broken count: 1
Starting 2 pkgProblemResolver with broken count: 1
Investigating (0) neon-settings:amd64 < 0.0+p18.04+git20190506.0955 @ii mK Ib >
Broken neon-settings:amd64 Conflicts on kubuntu-settings-desktop:amd64 < none -> 1:18.04ubuntu11 @un puN >
  Considering kubuntu-settings-desktop:amd64 9998 as a solution to neon-settings:amd64 3
  Removing neon-settings:amd64 rather than change kubuntu-settings-desktop:amd64
Investigating (0) neon-desktop:amd64 < 4+p18.04+git20190322.1030 @ii mK Ib >
Broken neon-desktop:amd64 Depends on neon-settings:amd64 < 0.0+p18.04+git20190506.0955 @ii mR >
  Considering neon-settings:amd64 3 as a solution to neon-desktop:amd64 0
  Removing neon-desktop:amd64 rather than change neon-settings:amd64
Done
The following additional packages will be installed:
  ttf-ubuntu-font-family
The following packages will be REMOVED:
  neon-desktop neon-settings
The following NEW packages will be installed:
  kubuntu-settings-desktop ttf-ubuntu-font-family
0 upgraded, 2 newly installed, 2 to remove and 0 not upgraded.
Remv neon-desktop [4+p18.04+git20190322.1030]
Remv neon-settings [0.0+p18.04+git20190506.0955]
Inst ttf-ubuntu-font-family (1:0.83-2 Ubuntu:18.04/bionic [all])
Inst kubuntu-settings-desktop (1:18.04ubuntu11 Ubuntu:18.04/bionic [all])
Conf ttf-ubuntu-font-family (1:0.83-2 Ubuntu:18.04/bionic [all])
Conf kubuntu-settings-desktop (1:18.04ubuntu11 Ubuntu:18.04/bionic [all])

[Snowhog]

Installing kubuntu-desktop-settings forces removal of neon-settings.

And why would one want to install kubuntu-desktop-settings on a KDE neon installation? I know you wouldn't do that, so what other installed package brought it in as a dependency?

Added:

Okay, back at the house and have KDE neon User Edition fired up. kubuntu-desktop-settings isn't installed (expected), so I can't do a reverse depends (apt-cache showpkg) on it. That supports my view that some other package you installed; one that isn't part of KDE neon (from a PPA maybe?); has kubuntu-desktop-settings as a dependency.

Added:

Just now fired up my Kubuntu 18.10 VM. kubuntu-desktop-settings isn't installed, nor can it be installed (E: Unable to locate package kubuntu-desktop-settings). Search in Muon Package Manager finds that it is actually kubuntu-settings-desktop, and is (of course) installed.

apt-cache showpkg kubuntu-settings-desktop

Package: kubuntu-settings-desktop
Versions: 
1:18.10ubuntu2 (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_cosmic_universe_binary-amd64_Packages) (/var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_cosmic_universe_binary-i386_Packages) (/var/lib/dpkg/status)
 Description Language: 
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_cosmic_universe_binary-amd64_Packages
                  MD5: c117d536547fca68e9e608d52e89c5f3
 Description Language: en
                 File: /var/lib/apt/lists/us.archive.ubuntu.com_ubuntu_dists_cosmic_universe_i18n_Translation-en 
                  MD5: c117d536547fca68e9e608d52e89c5f3


Reverse Depends: 
  kubuntu-desktop,kubuntu-settings-desktop
  kubuntu-full,kubuntu-settings-desktop
Dependencies: 
1:18.10ubuntu2 - libnewt0.52 (2 0.52.11-2ubuntu7) python (0 (null)) ttf-ubuntu-font-family (0 (null)) kubuntu-default-settings (3 1:13.04ubuntu1~) plasma-nm (3 0.9.3.1-0ubuntu1) kubuntu-default-settings (3 1:13.04ubuntu1~) plasma-nm (3 0.9.3.1-0ubuntu1) plasma-nm:i386 (3 0.9.3.1-0ubuntu1) plasma-nm:i386 (3 0.9.3.1-0ubuntu1) 
Provides: 
1:18.10ubuntu2 - 
Reverse Provides:

[oshunluvr]

Well, interesting for sure.

I know you are no novice, but, after installing and creating the file in /etc/sudoers.d, did you logout/reboot?

Actually that's not necessary in this case. The sudoers files work immediately.