docker-for-win: --pulseaudio authentication fails

[mviereck]

Coming from #145 (comment)

@1138-4eb wrote:

When I try ./x11docker --display 101 --pulseaudio --clipboard --no-auth x11docker/check now, a Volume Control@42b289e5501a window is opened, and the following message is shown Establishing connection to PulseAudio. Please wait.... It never connects, but it does neither freeze nor crash.

[mviereck]

I have added auth-anonymous=1 to the pactl command. Now each client should be able to connect without authentication, and a warning is shown.

That is not a good solution, but worth a test. @1138-4eb Could you please try out?

[mviereck]

Now x11docker also shares the pulseaudio cookie from host.

Currently there are two attempts to fix the issue, the shared pulse cookie and disabled TCP authentication.

If pulseaudio works now, please remove auth-anonymous=1 in https://github.com/mviereck/x11docker/blob/master/x11docker#L5443 and try again.

[eine]

I get the same result. The warning is shown, but it does not connect:

# ./x11docker --pulseaudio --clipboard --no-auth x11docker/check
x11docker note: Failed to check for sshd. ps -p not supported.

x11docker note: Using X server option --vcxsrv

x11docker note: Per default x11docker stores its cache files on drive C:.
  docker setup may not allow to share files from drive C:.
  If startup fails with an 'access denied' error,
  please either allow access to drive C: or specify a custom folder for cache
  storage with option '--cachebasedir D:/some/cache/folder'.
  Same issue can occur with option '--home'.
  Use option '--homebasedir D:/some/home/folder' in that case.

x11docker note: Windows firewall settings can forbid application access
  to the X server. If no application window appears, but no obvious error
  is shown, please check your firewall settings. Compare issue #108 on github.

x11docker WARNING: Option --pulseaudio allows container applications
  to catch your audio output and microphone input.

x11docker note: Option --pulseaudio: Pulseaudio daemon will continue
  to run after x11docker terminates. You can kill pulseaudio manually
  in Windows cmd.exe with:
    taskkill.exe /PID pulseaudio.exe /F

x11docker WARNING: Option --no-auth: SECURITY RISK!
  Allowing access to X server for everyone.

x11docker note: Your docker version does not support option --group-add.
  Possible sound or GPU setup may fail. Please update your docker installation.

x11docker WARNING: --vcxsrv: X server 10.0.75.1:101 runs without cookie authentication.

x11docker WARNING: Option --pulseaudio: Authentication for Pulseaudio TCP clients is disabled.

x11docker.log

[mviereck]

Thanks for the test.
I found this in the log:

'F:/cygwin64/bin/pactl.exe' is not recognized as an internal or external command,
operable program or batch file.

Is pulseaudio installed at all in Cygwin?

[eine]

Is pulseaudio installed at all in Cygwin?

Indeed... once again pactl is not installed with pulseaudio, pulseaudio-utils is required.

It now works successfully. I can open pavucontrol. If I change the volume there, I can see that it is changed in the Windows Volume Mixer too.

Also, the 'sound check Pulseaudio' works now.

I tried after removing auth-anonymous=1 too. It does not work.

[mviereck]

Indeed... once again pactl is not installed with pulseaudio, pulseaudio-utils is required.

oh, ok...

It now works successfully. I can open pavucontrol. If I change the volume there, I can see that it is changed in the Windows Volume Mixer too.

Great!

I tried after removing auth-anonymous=1 too. It does not work.

sigh.
I am not sure what to do. Without authentication everyone can access the pulseaudio server, at least within the local network. It could be abused as a microphone to catch conversations. I'd say that is a no-go.

Could you have a look if ~/.config/pulse/cookie exists in the container? It should be the same as in Cygwin in the same folder. However, because it is in a HOME folder, some user name mismatch may disturb here.

Maybe I should drop --pulseaudio on Windows at all.

[eine]

Could you have a look if ~/.config/pulse/cookie exists in the container? It should be the same as in Cygwin in the same folder. However, because it is in a HOME folder, some user name mismatch may disturb here.

There is no such folder in the container:

eine@ae37a1b4cf40:~$ ls -la ~/.config
total 16
drwxr-xr-x 3 eine None 4096 May 22 21:22 .
drwxr-xr-x 5 eine None 4096 May 22 21:22 ..
-rw-r--r-- 1 eine None  344 May 22 21:22 Trolltech.conf
drwxr-xr-x 3 eine None 4096 May 22 21:22 xfce4

However, it does exist in F:\cygwin64\home\eine\.config\pulse. There are other *.tdb and *-runtime files here.

I am not sure what to do. Without authentication everyone can access the pulseaudio server, at least within the local network. It could be abused as a microphone to catch conversations. I'd say that is a no-go.

Maybe I should drop --pulseaudio on Windows at all.

I think that you might require that --pulseaudio in windows is used with --unsecure-audio. So the user must explicitly acknowledge that it is using an unsecure option.

[mviereck]

I'll drop '--pulseaudio` for windows in upcoming releases.
I don't want to support unauthenticated setups.
Also, as already said in #160, I want to simplify the Windows code pathes and to shrink down to a more stable base with less features.

Thanks for your tests!