Re: Bug#973474: gnome: Unable to log back in in after screen lock

[Simon McVittie <smcv@debian.org>]

Control: clone -1 -2 -3
Control: retitle -2 cinnamon-session: Should not upload XDG_SESSION_ID to systemd --user
Control: reassign -2 cinnamon-session 4.8.0-2
Control: retitle -3 mate-session-manager: Should not upload XDG_SESSION_ID to systemd --user
Control: reassign -3 mate-session-manager 1.24.1-1
Control: retitle -1 gnome-session: Should work around session managers that upload XDG_SESSION_ID to systemd --user
Control: reassign -1 gnome-session 3.38.0-3
Control: forwarded -1 https://gitlab.gnome.org/GNOME/gnome-session/-/issues/86

A summary of this bug for MATE and Cinnamon maintainers:

Steps to reproduce:
* Install a bullseye system with GNOME and Cinnamon, or GNOME and MATE,
  or all three. I used GNOME and Cinnamon (only) in a VM to diagnose what
  was happening, and then installed MATE on the same VM to verify whether
  it has the same bug as Cinnamon (it does).
* Configure gdm to be the display manager (I don't know whether this is
  actually important, but it's what I had)
* Have Debian's default systemd-logind configuration with
  KillUserProcesses=no (contrary to the systemd upstream default of
  KillUserProcesses=yes)
* Log in as a test user. Before entering the password, set the requested
  desktop session to Cinnamon or MATE using the cogwheel icon in the lower
  right corner.
* Log out, returning to the gdm greeter.
* Quickly log back in as the same user, but before entering the password,
  set the requested desktop session to something GNOME-based.
  I tested "GNOME" and "GNOME on Xorg", but GNOME Classic would probably
  behave the same.
* Lock the screen (Super+L, where Super is usually the Windows logo key)
* Try to unlock the screen with the password

Expected result:
* Screen successfully unlocks

Actual result:
* An error message like this appears during GNOME startup:
  gnome-shell[2218]: JS ERROR: Could not get a proxy for the current session: Gio.IOErrorEnum: GDBus.Error:org.freedesktop.login1.NoSuchSession: No session '2' known
  where 2 is the session ID that was allocated to Cinnamon or MATE (and not
  the numerically larger session ID that was allocated to GNOME).
* Screen does not unlock, password prompt immediately reappears.

Logs with extra debugging (see below) are available in
<https://people.debian.org/~smcv/bug973474/>.

The root cause is that in GNOME 3.38, GNOME Shell is run as a
`systemd --user` service, which inherits the activation environment
variables that are uploaded to `systemd --user` by user processes such as
gnome-session, cinnamon-session, mate-session-manager, and (if installed)
/etc/X11/Xsession.d/95dbus_update-activation-env. gnome-session and
95dbus_update-activation-env are careful to avoid sending variables
that should be specific to one particular login session - particularly
XDG_SEAT, XDG_SESSION_ID and XDG_VTNR - to `systemd --user`. However,
cinnamon-session and mate-session-manager do not have the same special
case for those variables and will indiscriminately upload everything.

For example, looking for "New session" in journal-cinnamon.txt.gz, we can
see Cinnamon session 2 start at 12:16:07, and XDG_SESSION_ID=2 is uploaded
to `dbus-daemon --session` and copied from there to `system --user` at
12:16:09. After we log out and back in, GNOME session 6 starts at 12:17:08.
If everything worked correctly, we should see messages like this:

    gnome-shell[1234]: Unset XDG_SESSION_ID, getCurrentSessionProxy() called outside a user session. Asking logind directly.
    gnome-shell[1234]: Will monitor session 6

but instead gnome-shell inherits XDG_SESSION_ID=2 from the activation
environment, and tries (and fails) to monitor that. The MATE log shows
similar symptoms.

Helpful steps to debug:
* Boot with systemd.log_level=debug on the kernel command-line so you can
  see more of what is going on
* Put this unit in /etc/systemd/system/dbus-monitor.service with a symlink
  to ../dbus-monitor.service in /etc/systemd/system/multi-user.target.wants:
    [Unit]
    Description=System bus monitor
    Before=gdm.service
    Wants=dbus.socket
    After=dbus.socket
    [Service]
    User=root
    ExecStart=/usr/bin/dbus-monitor --system
* Put this unit in /etc/systemd/user/dbus-monitor.service with a symlink
  to ../dbus-monitor.service in /etc/systemd/user/default.target.wants:
    [Unit]
    Description=Session bus monitor
    Before=org.gnome.Shell@wayland.service org.gnome.Shell@x11.service
    Wants=dbus.socket
    After=dbus.socket
    [Service]
    ExecStart=/usr/bin/dbus-monitor --session
* Before logging out from Cinnamon or MATE, use logger(1) to record a
  message in the system log
* Before locking the screen in GNOME, use logger(1) again

I think this is really a bug in cinnamon-session and mate-session-manager:
they should not be adding highly login-session-specific variables like
XDG_SESSION_ID to the activation environment. However, when there's a bad
interaction between two components it's often better to fix both ends,
so I'm testing a patch for gnome-session that will make it work around this.

    smcv