[Pkg-utopia-maintainers] Bug#996418: dbus-update-activation-environment: sets wrong PATH since March 2021

[Thorsten Glaser]

Package: dbus-x11
Version: 1.12.20-2
Severity: normal
X-Debbugs-Cc: tg at mirbsd.de

Hi, not sure which package is actually at fault here, but here we go.
Please reassign (and notify the target package maintainers) as needed.

This machine used to be an unstable machine but some time before the
release I switched it to bullseye. The date range in question (February
to March 2021) are when it still was on sid.

I have not yet noticed this because it only affects one command. The
problem is that it picked up the "wrong" version of the command, the
one from /usr/bin instead of the one from /usr/local/bin.

This machine is a regular desktop but also has xrdp+xorgxrdp installed
so I can use it while working remotely. The xrdp sessions log to
~/.xsession-errors which is where I could spot the first possible cause
for this error.

My ~/.xsession-errors contains, with some information snipped for
legibility:

-----cutting here may damage your screen surface-----
⇒ Feb 25  2021, 16:22:09+0100 (CET), 2021-W08-4 (Thu) ⇐
Xsession: X session started for tglase at Thu Feb 25 16:22:09 CET 2021
WARNING: tempfile is deprecated; consider using mktemp instead.
localuser:tglase being added to access control list
localuser:boinc being added to access control list
dbus-update-activation-environment: systemd --user not found, ignoring --systemd argument
[…]
dbus-update-activation-environment: setting PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
[…]
Xsession: X session started for tglase at Fri Mar 12 19:11:35 CET 2021
WARNING: tempfile is deprecated; consider using mktemp instead.
localuser:tglase being added to access control list
localuser:boinc being added to access control list
X Error of failed request:  BadMatch (invalid parameter attributes)
  Major opcode of failed request:  140 (RANDR)
[…]
dbus-update-activation-environment: setting PATH=/sbin:/bin:/usr/bin:/usr/local/bin
[…]
-----cutting here may damage your screen surface-----

From the top, these are:

- one line from my ~/.profile
- 5 + 1 lines from the session start
- 6 + 1 lines from the start of the next session

The lower session is definitely xrdp+xorgxrdp, as one of the xset
calls from ~/.xsessionrc failed. The first call may very well be
from kdm. These are the two oldest entries in that file.

There are *three* different PATH values set, apparently:

tglase at tglase:~ $ fgrep 'setting PATH=' .xsession-errors | sort | uniq -c
      1 dbus-update-activation-environment: setting PATH=/home/tglase/.etc/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
     27 dbus-update-activation-environment: setting PATH=/sbin:/bin:/usr/bin:/usr/local/bin
      1 dbus-update-activation-environment: setting PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games

The middle one is the one causing me trouble.

The first and the last one are okay and differ only by the first one
having one entry prepended, which my shell startup file (not .profile
but the actual interactive(!) shell startup file) sets. This was one
session in June I have no idea how I started it, looks like Xorg, not
xrdp+xorgxrdp though. (Normally, when starting services (such as a
login manager) I use a wrapper script around /etc/init.d/* that clears
all environment variables.)

So the questions are, (a) where does this bad environment variable
come from, and (b) why is it also set in my user X session, when
dbus-update-activation-environment runs as a separate thing, although
in the X session start process?

I would have expected a user X11 session to use this:
/etc/environment:PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"

Instead we're getting a PATH set that nowhere even is configured:

$ sudo fgrep -r /sbin:/bin:/usr/bin:/usr/local/bin /etc
/etc/init.d/edac:PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin

Specifically, the presence of /sbin without /usr/sbin in the "bad"
PATH causes questions; as far as I know, this is not used anywhere
in Debian like that: either you get both sbins (admin account) or
(almost everywhere) neither, but not just one of them.

-- System Information:
Debian Release: 11.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'oldstable-updates'), (500, 'oldoldstable'), (500, 'stable'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-9-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)

Versions of packages dbus-x11 depends on:
ii  dbus         1.12.20-2
ii  libc6        2.31-13+deb11u2
ii  libdbus-1-3  1.12.20-2
ii  libx11-6     2:1.7.2-1

dbus-x11 recommends no packages.

dbus-x11 suggests no packages.

-- no debconf information