[SOLVED] Guest account error...

[invex]

LM20 Cinnamon

I rarely use a guest account.
It always worked but now I can't log in.
I get this error (after upgrade from 19.3 but I'm not sure):

Could not update file ICEauthority file /run/user/997/ICEauthority

TIA

[Pjotr]

LM20 Cinnamon

I rarely use a guest account.
It always worked but now I can't log in.
I get this error (after upgrade from 19.3 but I'm not sure):

Could not update file ICEauthority file /run/user/997/ICEauthority

TIA

Yes, I've had the same experience (clean installation of 20).... It's a bug. The guest session in 20 works best in the Xfce edition, but even then it doesn't work well.

Currently, the guest session only works well in 19.x. Hopefully this will be fixed soon, because it's a useful feature.

[Kadaitcha Man]

Currently, the guest session only works well in 19.x. Hopefully this will be fixed soon, because it's a useful feature.

Do you know if it's been reported?

The only reference I could find to Ulyana and that error was a comment under a post in the Mint blog.

[Pjotr]

Currently, the guest session only works well in 19.x. Hopefully this will be fixed soon, because it's a useful feature.

Do you know if it's been reported?

I haven't been able to find any bug report.... Maybe I should file one myself. It looks like Cinnamon is the guilty party here, because the ICEauthority bug doesn't happen in Xfce.

The guest session in Xfce does have another bug, though: it wouldn't let me reboot or shutdown by means of the Whisker menu buttons for it.

[jcentel]

Same error here

[mrkskwsnck]

Hello dear fellows,

it appears to me as if I've found the root cause for the guest session not to work at all in Linux Mint 20: The security feature AppArmor is preventing access to required resources for the profile /usr/lib/lightdm/lightdm-guest-session. These are the indicating lines from my dmesg output…

Code: Select all

[  +2,924588] audit: type=1400 audit(1602867040.911:48): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/13374/fd/" pid=13374 comm="gpg-agent" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[  +0,488097] audit: type=1400 audit(1602867041.399:49): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/1/cgroup" pid=13316 comm="cinnamon-sessio" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[  +0,000060] audit: type=1400 audit(1602867041.399:50): apparmor="DENIED" operation="sendmsg" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/systemd/journal/dev-log" pid=13316 comm="cinnamon-sessio" requested_mask="w" denied_mask="w" fsuid=998 ouid=0
[  +0,001387] audit: type=1400 audit(1602867041.399:51): apparmor="DENIED" operation="link" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/user/998/ICEauthority-l" pid=13316 comm="cinnamon-sessio" requested_mask="l" denied_mask="l" fsuid=998 ouid=998 target="/run/user/998/ICEauthority-c"
[  +0,000030] audit: type=1400 audit(1602867041.399:52): apparmor="DENIED" operation="sendmsg" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/systemd/journal/dev-log" pid=13316 comm="cinnamon-sessio" requested_mask="w" denied_mask="w" fsuid=998 ouid=0

The solution (or workaround) for this issue is to tell AppArmor not to deny access to required resources by setting the profile /usr/lib/lightdm/lightdm-guest-session to complain mode.

Code: Select all

sudo apt-get install apparmor-utils
sudo aa-complain /usr/lib/lightdm/lightdm-guest-session

In this mode security policy is not enforced but rather access violations are logged to the system log.

See the man pages of aa-status and aa-complain for further information.

Best regards and good luck

/EDIT: This workaround was successfully tested with Linux MInt 20 Cinnamon and MATE.
/EDIT: Added line to install missing dependencies for AppArmor utilities (thanks @alLa).

[invex]

It works!
Thank you very much.

[alLa]

Thank you very much, I've also been looking for this solution since I installed LM 20...

I want to add that I didn't have aa-complain installed by default, I had to get it first:

Code: Select all

sudo apt-get install apparmor-utils

Thanks again!

[Pjotr]

Hello dear fellows,

it appears to me as if I've found the root cause for the guest session not to work at all in Linux Mint 20: The security feature AppArmor is preventing access to required resources for the profile /usr/lib/lightdm/lightdm-guest-session. These are the indicating lines from my dmesg output…

Code: Select all

[  +2,924588] audit: type=1400 audit(1602867040.911:48): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/13374/fd/" pid=13374 comm="gpg-agent" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[  +0,488097] audit: type=1400 audit(1602867041.399:49): apparmor="DENIED" operation="open" profile="/usr/lib/lightdm/lightdm-guest-session" name="/proc/1/cgroup" pid=13316 comm="cinnamon-sessio" requested_mask="r" denied_mask="r" fsuid=998 ouid=0
[  +0,000060] audit: type=1400 audit(1602867041.399:50): apparmor="DENIED" operation="sendmsg" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/systemd/journal/dev-log" pid=13316 comm="cinnamon-sessio" requested_mask="w" denied_mask="w" fsuid=998 ouid=0
[  +0,001387] audit: type=1400 audit(1602867041.399:51): apparmor="DENIED" operation="link" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/user/998/ICEauthority-l" pid=13316 comm="cinnamon-sessio" requested_mask="l" denied_mask="l" fsuid=998 ouid=998 target="/run/user/998/ICEauthority-c"
[  +0,000030] audit: type=1400 audit(1602867041.399:52): apparmor="DENIED" operation="sendmsg" profile="/usr/lib/lightdm/lightdm-guest-session" name="/run/systemd/journal/dev-log" pid=13316 comm="cinnamon-sessio" requested_mask="w" denied_mask="w" fsuid=998 ouid=0

The solution (or workaround) for this issue is to tell AppArmor not to deny access to required resources by setting the profile /usr/lib/lightdm/lightdm-guest-session to complain mode.

Code: Select all

sudo aa-complain /usr/lib/lightdm/lightdm-guest-session

In this mode security policy is not enforced but rather access violations are logged to the system log.

See the man pages of aa-status and aa-complain for further information.

Best regards and good luck

/EDIT: This workaround was successfully tested with Linux MInt 20 Cinnamon and MATE.

Excellent! Thanks for sharing this fine workaround!

Like aiLa, i had to install apparmor-utils first, though.

I'll test it on an Mint 20 Xfce box as well, and will report here.

[mrkskwsnck]

Thank you very much, I've also been looking for this solution since I installed LM 20...

I want to add that I didn't have aa-complain installed by default, I had to get it first:

Code: Select all

sudo apt-get install apparmor-utils

Thanks again!

Thanks for that hint! I edited my previous post accordingly, as probably more user will stumble over this detail.

[alLa]

I want to add that I didn't have aa-complain installed by default, I had to get it first:

Code: Select all

sudo apt-get install apparmor-utils

Thanks for that hint! I edited my previous post accordingly, as probably more user will stumble over this detail.

Fabulous!

[Pjotr]

I'm happy to report: this workaround also fixes the reboot/shutdown issue in the guest session of the Xfce edition of Mint 20.