Fix orbit process launch issues that can hit /proc/keys limits by sgress454 · Pull Request #32309 · fleetdm/fleet

sgress454 · 2025-08-26T13:40:41Z

Details

This PR reverts some earlier work using runuser and runcon intended to allow Orbit to launch Fleet Desktop in the logged-in user's SELinux context. This didn't work for out-of-the-box SELinux enforcement setups, with a side-effect of each failed attempt to launch the desktop app creating a new kernel keyring that doesn't get cleaned up until Orbit quits (or GC runs, although I didn't see that happen in testing). While using runuser has some possible benefits over using sudo to launch processes, it also (when using -l to start a login shell) creates a new keyring. This is not an issue if the command to launch the process succeeds, but if it fails and retries over and over, we start amassing keyrings.

It is the opinion of several other engineers (and now myself as well) that the real solution to various Fleet Desktop launching issues is to launch the desktop app as a user service using systemctl --user so that it automatically inherits the user's environment, context, etc.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.

Testing

QA'd all new/changed functionality manually
- ~~Ubuntu with SELinux on~~ this is a very uncommon setup
- Ubuntu with SELinux off
- Fedora with SELinux on - double checked that getenforce returned Enforcing this time
- Fedora with SELinux off
- ~~Debian with SELinux on~~ this is a very uncommon setup
- Debian with SELinux off
- runWithOutput still works (tested with go run ./tools/dialog/main.go --dialog=zenity on all platforms)
- ~~runWithStdin still works~~ (this isn't currently used by Linux)

fleetd/orbit/Fleet Desktop

Verified compatibility with the latest released version of Fleet (see Must rule)
If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
Verified that fleetd runs on macOS, Linux and Windows
Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

codecov · 2025-08-26T13:53:28Z

Codecov Report

❌ Patch coverage is 0% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.03%. Comparing base (0a4d03f) to head (2af0c8c).
⚠️ Report is 38 commits behind head on main.

Files with missing lines	Patch %	Lines
orbit/pkg/execuser/execuser_linux.go	0.00%	14 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32309   +/-   ##
=======================================
  Coverage   64.03%   64.03%           
=======================================
  Files        1987     1987           
  Lines      194543   194542    -1     
  Branches     6444     6444           
=======================================
+ Hits       124573   124574    +1     
+ Misses      60255    60253    -2     
  Partials     9715     9715

Flag	Coverage Δ
backend	`65.29% <0.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

lucasmrod

LGTM!

sgress454 · 2025-08-27T15:15:05Z

I don't feel super comfortable merging this with the Orbit test failing. The failure seems to be in Cloudflare but it means we don't actually run the tests.

This pull request addresses a startup issue with Fleet Desktop on openSUSE Leap 16 and similar Linux distributions. The main change is to adjust how Fleet Desktop and key-escrow dialogs are launched to avoid environment variable loss caused by login shell profile scripts. The fix is scoped specifically to openSUSE Leap 16+ to avoid impacting other distributions. **Distribution-specific sudo invocation changes:** * The `-i` (login shell) flag is now omitted from the `sudo` command when launching Fleet Desktop and key-escrow dialogs on openSUSE Leap 16 and newer, preventing environment variables from being lost due to profile script interference. [[1]](diffhunk://#diff-633ab361af6795ef458233819e2806dfba4ca56f684866d956321825b8fd2e91R1) [[2]](diffhunk://#diff-3e8315d9f12512bce490457c5d20bd7c5aebaa2a8e18b1abf50e504815dd7a9dR178-R193) * For all other supported distributions, the previous behavior (using `-i`) is preserved to maintain compatibility and avoid unnecessary re-testing. **Detection logic:** * Introduced a new helper function `isOpenSUSELeap16Plus` in `execuser_linux.go` to detect if the host is running openSUSE Leap 16 or newer by parsing `/etc/os-release`. This ensures the workaround is only applied where necessary. --- **Related issue:** N/A — surfaced via field investigation on openSUSE Leap 16 (arm64). This PR addresses two distinct issues that together prevent Fleet Desktop from working on openSUSE Leap 16, both validated end-to-end on a real Leap 16 (arm64) host. ## 1. Launch reliability — drop `sudo -i` `orbit/pkg/execuser/execuser_linux.go` On Linux, Orbit launches Fleet Desktop with: ``` sudo -n -i -u <user> -H env WAYLAND_DISPLAY=… … FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH=/opt/orbit/identifier … /…/fleet-desktop ``` The `-i` flag makes sudo "simulate initial login" — it runs the target user's shell as a login shell and wraps the rest of the command in `bash --login -c '<escaped>'`. That sources `/etc/profile` and every script in `/etc/profile.d/*` before our `env KEY=val … fleet-desktop` line runs, and shell metacharacters (`=`, `:`, `/`, `.`) get backslash-escaped through the shell layer. On **openSUSE Leap 16 (arm64)**, that indirection causes the inline env-var assignments to not reach `fleet-desktop`, which exits immediately with: ``` FTL missing URL environment FLEET_DESKTOP_DEVICE_IDENTIFIER_PATH ``` Orbit then respawns it every ~15 s in a tight kill-and-respawn loop, so the tray icon never appears. **Fix:** drop `-i` from the sudo invocation. We don't need a login shell: - `-H` already sets `HOME` to the target user. - sudo's default `env_reset` sets `USER` / `LOGNAME` / `SHELL` / `MAIL` and `PATH` to `secure_path`. - All session vars (`WAYLAND_DISPLAY`, `DISPLAY`, `DBUS_SESSION_BUS_ADDRESS`, `LD_LIBRARY_PATH`) and every `FLEET_DESKTOP_*` var are already passed explicitly via `env KEY=val …`. After the change, sudo `execve()`s `env` directly with no shell layer in between, so `/etc/profile.d` sourcing and shell-escaping are out of the picture. The `runuser -l` /proc/keys-leak regression from PR #32309 does not apply — that was specific to `runuser -l` creating session keyrings; sudo without `-i` doesn't. # Checklist for submitter - [x] Changes file added: `orbit/changes/fleet-desktop-linux-no-login-shell` - [x] Input data is properly validated; untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [x] Timeouts are implemented and retries are limited to avoid infinite loops (script's wait loop now bounded at 90s). - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes — N/A. ## Testing Manual QA needed before merge: - [x] **openSUSE Leap 16 (arm64)** — Fleet Desktop process starts, stays running, env vars present, no FTL respawn loop. Done via `sudo` shim. - [x] **openSUSE Leap 16 (arm64) — extension fallback** — manual tarball install + schema compilation produces a working tray icon (matching what the script automates). - [ ] **Ubuntu 22.04 / 24.04** — regression check: Fleet Desktop tray icon still appears, key-escrow zenity dialog still renders, AppIndicator script still installs via the official path. - [ ] **Fedora (recent)** — regression check: same as above. - [ ] **Debian** — regression check: same as above. - [ ] **openSUSE Tumbleweed** — confirm `InstallRemoteExtension` path still works (no fallback path triggered). ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet — pure launch-flag change plus a script update; no protocol or schema impact. - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes — Go change is in `execuser_linux.go`, only built on Linux. The script is Linux-only by construction. - [ ] Verified that fleetd runs on macOS, Linux and Windows — Linux re-verification pending QA above; macOS/Windows code paths unchanged. - [ ] Verified auto-update works from the released version of component to the new version. ## Notes for reviewers - The tray-icon visibility issue is an OS-side prerequisite (GNOME 3.26+ has no native tray), so the AppIndicator extension is required regardless. Even after installing it, Wayland requires a logout/login to pick up new extensions — this is documented behavior and not specific to the fallback path.

sgress454 added 3 commits August 25, 2025 14:50

fallback to runuser if runcon fails

7c2f92a

go back to sudo

64ca145

changelog

3ed0ccb

sgress454 temporarily deployed to Docker Hub August 26, 2025 13:40 — with GitHub Actions Inactive

sgress454 assigned lucasmrod Aug 26, 2025

sgress454 marked this pull request as ready for review August 26, 2025 14:43

sgress454 requested a review from a team as a code owner August 26, 2025 14:43

lucasmrod previously approved these changes Aug 26, 2025

View reviewed changes

lucasmrod reviewed Aug 26, 2025

View reviewed changes

Comment thread changes/32112-revert-to-sudo

sgress454 added 2 commits August 26, 2025 14:10

move changelog

d469e6c

Merge branch 'main' into sgress454/32112-runcon-not-working

2af0c8c

sgress454 dismissed lucasmrod’s stale review via 2af0c8c August 26, 2025 19:11

sgress454 temporarily deployed to Docker Hub August 26, 2025 19:11 — with GitHub Actions Inactive

lucasmrod approved these changes Aug 26, 2025

View reviewed changes

sgress454 merged commit 0966e9e into main Aug 28, 2025
74 of 77 checks passed

sgress454 deleted the sgress454/32112-runcon-not-working branch August 28, 2025 14:20

allenhouchins mentioned this pull request Apr 30, 2026

Fix Fleet Desktop not launching on OpenSUSE 16 #44482

Merged

14 tasks

lucasmrod mentioned this pull request May 1, 2026

Add fleetd support for openSUSE Leap 16 #44612

Closed

31 tasks

Navigation Menu

Uh oh!

Fix orbit process launch issues that can hit /proc/keys limits - #32309

Fix orbit process launch issues that can hit /proc/keys limits#32309
sgress454 merged 5 commits into
mainfrom
sgress454/32112-runcon-not-working

sgress454 commented Aug 26, 2025 •

edited

Loading

Uh oh!

codecov Bot commented Aug 26, 2025 •

edited

Loading

Uh oh!

lucasmrod left a comment

Uh oh!

Uh oh!

sgress454 commented Aug 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

sgress454 commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Checklist for submitter

Testing

fleetd/orbit/Fleet Desktop

Uh oh!

codecov Bot commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

lucasmrod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sgress454 commented Aug 27, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sgress454 commented Aug 26, 2025 •

edited

Loading

codecov Bot commented Aug 26, 2025 •

edited

Loading