Below is the email I accidentally sent directly to the maintainer, instead of pressing reply-all
> > Sorry about taking so long to get back to you: I have been really > > busy > > recently. > > No problem, I got ill immediately afterwards! :-/ That sucks, hope you're doing better! > But now, I finally found some time to spend on investigating this > bug. > I have mixed news for you. > > [...] > > > First of all: it seems to me that you have firefox-esr unpacked, > > > but > > > not configured. In other words, firefox-esr does not seem to be > > > properly installed on your system: > > > > > > [from System Information in your bug report...] > > > > iu firefox-esr [www-browser] 68.4.1esr-1 > > > [...] > > > > > > This could be responsible for a number of errors you encounter, > > > when > > > trying to start firefox... > > > > Okay. I did test a bit, and firefox is definatly working: so if > > its > > not unpacked, then somthing weird is going on... > > Did you fix the installation status of firefox-esr? > What's the output of the command > > $ dpkg -l | grep firefox > > on your system, now? I put it below: I did some re-wrapping of lines, because I couldnt quickly figure out how to make evolution stop wrapping the selection. $ dpkg -l | grep firefox ii firefox-esr 68.4.1esr-1 amd64 Mozilla Firefox web browser - Extended Support Release (ESR) > As explained below, this is not the cause of your errors, but > something > to be fixed anyway... > > > > I guess xdg-open (internally used by querybts to find a browser) > > > eventually selected a text browser, such as lynx or w3m: > > > > It did. I think the errors made that more clear: I'm setting up a > > controlled test to capture a few. > [...] > > Now I managed to reproduce the issue, at least with a bunch of > similar > errors from firefox (including dialog windows to click into). > The key point is that you are using "sudo" to become root, while I > use > "su -", thus missing one subtle difference. > > Your controlled test was useful in clarifying what you experienced. > Thanks for taking the time to transcript it (and comment it!). No problem > So, without further ado, what happened? > > • regular user calls sudo to run apt as root > • apt calls apt-listbugs > • apt-listbugs invokes s6-setuidgid to drop root privileges and run > querybts as the original regular user > • querybts wants to invoke a browser and calls xdg-open on the URL > > [...] > > OK, I think I shared enough of my headache! ;-) Thanks for the explaination: it's all making sence now. > [...] > > Of course, I could completely drop these features, so that apt- > listbugs > will no longer be able to invoke querybts or to launch a browser. > After all, there are other, more comfortable, ways to read bug logs. > Usually, if you are already in a graphical session, you can start > your > favorite browser and copy and paste the bug numbers there. This can > perhaps be possible even when switching between text consoles... > > But I think there are situations where these strategies are not > available. Maybe you are stuck in a single text console, and no other > means to access the web... > As a consequence, I would like to keep these features, although I > should probably document that they should be regarded as "last > resort" approaches... There is also the fact that it is somtimes handy to be able to get a full view of the bug quicky: so while copy-paste replicates the functionality, it also drops the convinience of being able to get more info about bugs with minimal effort. > I could drop the s6-setuidgid trick (which will be replaced by > setpriv in the next version of apt-listbugs, which is however > equivalent). But running querybts or a browser as root is not a good > idea, security-wise, and should hence be avoided, wherever possible. > So, no, I would like to keep the root privilege dropping mechanism, > to the maximum possible extent. > > Maybe apt-listbugs could drop the DISPLAY enviroment variable before > invoking querybts or any browser. > The equivalent of > > $ sudo env -u DISPLAY -u XAUTHORITY s6-setuidgid MYREGULARUSER xdg- > open http://bugs.debian.org/948697 > > which directly chooses a text browser, which many less needs than > firefox! > I acknowledge that this is not a perfect workaround, but, at least, > it > seems to reduce to the more minimalist situations, where the features > are really needed... > > Let me think about it some more (and feel free to express your > thoughts!). That definatly would work for me. The importance of apt-listbugs, to me, is being able to take a look at what might break, weigh its importance, and making a decision on whether or not I should upgrade. I can't really think of a reason why reading the bug info in a text browser would fail to accomplish that goal just as well as a full- fledged web browser: and if there is some weird edge case where a user needs the full Firefox display, they can do the copy-paste you mentioned earlier. Of cource, the way you described it, it sounds like this could just as easily be thought of as a bug in xdg-open/sensible-browser: they ought to check if the profile for firefox is accsessible in additon to seeing whether DISPLAY is set before trying to launch firefox, or else catch the errors that stem from launching firefox without a profile. Any idea on what was up with the pulse audio errors? Or are they probably just collateral damage from firefox's Halt and Catch Fire?
