0

I have a small office with 5 desktops and a server, all of them running on Debian. I have just upgraded the clients to Stretch and see only 1 error in the journal that bothers me:

gnome-settings-[939]: failed to create profile from EDID data: failed to save ICC file: Error opening file ‘/var/data/users/Debian-gdm/icc/edid-93ed9b01fe8febb07668e99b557191e9.icc’: Access denied
gnome-settings-[939]: failed to create profile from EDID data: failed to save ICC file: Error opening file ‘/var/data/users/Debian-gdm/icc/edid-93ed9b01fe8febb07668e99b557191e9.icc’: Access denied
gnome-settings-[939]: failed to set screen _ICC_PROFILE: Opening file ‘/var/data/users/vincent/icc/edid-93ed9b01fe8febb07668e99b557191e9.icc’ failed: Access denied

As our users $HOME folders are mounted through NFS, I have made sure that all $XDG_DATA and $XDG_CACHE (at least for regular users) are stored locally on the client. Back in 2014 I had found a manual to do it like this:

In /etc/profile.d/xdg_dirs.sh:

if [ "$USER" == "root" ]; then
  unset XDG_CACHE_HOME
  unset XDG_DATA_HOME
else
  test -d $XDG_CACHE_HOME || mkdir -p $XDG_CACHE_HOME
  test -d $XDG_DATA_HOME || mkdir -p $XDG_DATA_HOME
fi

In /etc/security/pam_env.conf:

XDG_CACHE_HOME DEFAULT="/var/cache/users/@{PAM_USER}"
XDG_DATA_HOME  DEFAULT="/var/data/users/@{PAM_USER}"

I'm pretty sure this has messed up the correct permissions for the Debian-gdm user, but I don't know how to solve it. I tried creating the dir and giving r+w permissions to both Debian-gdm and the default user-groups, but this didn't work. I also tried exclusing the Debian-gdm user from the above script by adding:

if [ "$USER" == "root" ] || [ "$USER" == "Debian-gdm" ]; then

, but that didn't work as well.

Any thoughts?

1

I believe the main problem here is that /etc/profile.d/xdg_dirs.sh is not sourced when starting gdm since it's now using wayland and not X (Xsession script is not started anymore)

IMHO, you shouldn't mangle with these variables. The home of the Debian-gdm user is stored in /var/lib/gdm3 which should already be local on your client.

What I would do is to modify /etc/pam.d/gdm-launch-environment, in there you have two calls to pam_env.so on the first call, set conffile=to /dev/null. That will prevent the pam module to read the /etc/security/pam_env.conffile a keep the environment untouched.

An other solution is to try to start gdm using X instead of Wayland, set WaylandEnable=false in /etc/gdm3/daemon.conf

  • Thank you for sending me in the right direction. I have now read up on these changes related to the switch from X to Wayland, and I am reluctant to make changes that would potentially produce erratic behavior if a user were to chose 'Gnome on Wayland' or 'Gnome on X' in the GDM option menu. Therefore, I looked what was wrong in the current files. I inserted the variable-setting into the xdg_dirs.sh file, expanded the if-branch as I detailed in the question and removed the pam_env.conf file. This seems to solve it (and it also discloses that Gnome on Debian Stretch does source X vars) – zenlord Dec 31 '17 at 16:02
  • Ok, disregard my previous comment, as it didn't work out. If you change your answer to read 'gdm-password' instead of 'gdm-launch-environment' and hint at 'user_readenv=1' while you're at it, I'll approve it as the correct answer – zenlord Dec 31 '17 at 18:34
  • My initial change to the pam service config was meant to avoid changing XDG_CACHE_HOME and XDG_DATA_HOME for the gdm processes. Here you are requiring all your user to have a config file in their home directory and that this file is correct as well. – Bigon Jan 2 '18 at 8:49
  • Ah, I see. Your solution is to exclude the Debian-gdm user from changing those dirs, whereas my solution is to explicitly include all non-system users manually. I'll experiment with your solution, as it takes away the burden to manage a file per user. Thx! – zenlord Jan 2 '18 at 8:55
  • 1
    Quickly looking at the pam code, I think you need to pass conffile=/dev/null to the two calls to pam_env in /etc/pam.d/gdm-launch-environment, not only the first one – Bigon Jan 2 '18 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.