Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect: Connection refused

Workaround typed into a terminal: xhost +si:localuser:root

then 'sudo synaptic' works as usual

Thanks for your report.

This is a known issue with wayland and documented on https://fedoraproject.org/wiki/How_to_debug_Wayland_problems#Graphical_applications_can.27t_be_run_as_root_from_terminal

Annoying -- the developers over at Fedora seem to suggest that there is an unwillingness to provide support for any GUI that runs as root. Surely a problem for many admin tools like this?

Workaround is easy though:

command-line:
xhost + && sudo synaptic && xhost -

Probably there is something similar that could be done to change the launcher for synaptic, along similar lines?

Discussed on Debian mailing list:
https://<email address hidden>/msg1541135.html

(Xwayland authorization not configured)

@John

a more sophisticated workaround:
https://ask.fedoraproject.org/en/question/108631/running-command-after-gnome-login/

cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
[Desktop Entry]
Name=xhost
Comment=Fix graphical root applications
Exec="xhost +si:localuser:root"
Terminal=false
Type=Application
EOF

Is it more elegant?

Just installed Artful x86 on USB-flash.

Without xhost commands Synaptic does not start with
$ synaptic-pkexec
No protocol specified
Unable to init server: Could not connect: Connection refused

(synaptic:1688): Gtk-WARNING **: cannot open display: :0

After setting xhost Synaptic starts.

As I predict zenmap (as root) is affected too (see bug 1713311).

Just installed Artful x86 on USB-flash.

Without xhost commands Synaptic does not start with
$ synaptic-pkexec
No protocol specified
Unable to init server: Could not connect: Connection refused

(synaptic:1688): Gtk-WARNING **: cannot open display: :0

After setting xhost Synaptic starts.
Gparted and backintime (see 1713313) may be fixed with xhost command.

As I predict zenmap (as root) and other at least 18 applications too (see bug 1713311). They use su-to-root from menu package. Setting "xhost +si:localuser:root" does not help for them (produce another messages: in console "Error copying '/home/artful/.Xauthority' to '/tmp/libgksu-VXhFz5': No such file or directory
" and window with "Failed to run zenmap as user root.
Unable to copy the user's Xauthorization file.").

I'm not an expert, but it seems that `su-to-root` must be changed to `pkexec` anywhere to lower user disappointment.

In artful the problem seems no more be limited to wayland, but to extend to all kinds of gnome session.

@PeterPall (peterpall)
The full list of pkexec'ed applications is located in bug 1713313. It is long.

Debian report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872553

Ubuntu 17.10 with all updates, bug is not fixed. Still can't use Synaptic on Wayland.

Ubuntu 17.10 beta installed on 6.10.2017:
Still the same problem, not only with synaptic but also octave wouldn't work properly, gave similar error.

Solution was, as posted by dino99 to type: xhost +si:localuser:root.

@matej
please describe when and why GNU Octave needs root access.
You can post answer here, or mark bug 1713313 as affecting Octave package (use "Also affects distribution/package" link) with corresponding comment.

Affects Bleachbit too. Ubuntu 11.10 vanilla gnome-session.

On Fri, Oct 6, 2017 at 6:25 AM Norbert <email address hidden> wrote:

> @matej
> please describe when and why GNU Octave needs root access.
> You can post answer here, or mark bug 1713313 as affecting Octave package
> (use "Also affects distribution/package" link) with corresponding comment.
>
> ** Description changed:
>
> + The full list of pkexec'ed applications is located in bug 1713313. It is
> + long.
> +
> Posting here what gnome says about porting to wayland, and their tests:
>
> GNOME Applications under Wayland
> GTK+ has a Wayland backend. If it was enabled at compile-time, you can
> run a GTK+ application under Wayland simply by:
>
> GDK_BACKEND=wayland gnome-calculator
> Applications that use Clutter or clutter-gtk also need the Clutter
> Wayland backend enabled:
>
> GDK_BACKEND=wayland CLUTTER_BACKEND=wayland cheese
>
> https://wiki.gnome.org/Initiatives/Wayland/Applications
>
> ======> so hope the settings are well set at compile time; maybe a
> rebuilt to get sure all apps are ok.
>
>
> ********************************************************************************************************************************************
>
> With the today packages upgrade, switching from X11 to wayland, synaptic
> refuse to load/open:
>
> from the icon into the dash-to-dock, nothing happen
> from the terminal:
>
> sudo synaptic
> [sudo] password for oem:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect:
> Connection refused
>
> (synaptic:2154): Gtk-WARNING **: cannot open display: :0
>
> Previous days already have switching some packages to wayland, but
> synaptic was still working. Its only with the today upgrades, after a
> cold reboot, that synaptic gui is broken.
>
> Today possibly sources problem:
>
> Unpacking console-setup-linux (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking console-setup (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking keyboard-configuration (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking gnome-session-bin (3.24.1-0ubuntu22) over (3.24.1-0ubuntu21)
> ...
>
> Unpacking gdm3 (3.25.90.1-0ubuntu2) over (3.25.90.1-0ubuntu1) ...
>
> Unpacking libgdm1 (3.25.90.1-0ubuntu2) over (3.25.90.1-0ubuntu1) ...
>
> Unpacking gir1.2-gdm-1.0 (3.25.90.1-0ubuntu2) over (3.25.90.1-0ubuntu1)
> ...
>
> Unpacking ubuntu-session (3.24.1-0ubuntu22) over (3.24.1-0ubuntu21) ...
>
> Unpacking gnome-session (3.24.1-0ubuntu22) over (3.24.1-0ubuntu21) ...
> ...
> Unpacking gnome-session-common (3.24.1-0ubuntu22) over
> (3.24.1-0ubuntu21) ...
> Setting up keyboard-configuration (1.142ubuntu7) ...
>
> ProblemType: Bug
> DistroRelease: Ubuntu 17.10
> Package: synaptic 0.84.2
> ProcVersionSignature: Ubuntu 4.12.0-12.13-generic 4.12.8
> Uname: Linux 4.12.0-12-generic x86_64
> ApportVersion: 2.20.6-0ubuntu6
> Architecture: amd64
> CurrentDesktop: GNOME
> Date: Mon Aug 21 16:21:47 2017
> EcryptfsInUse: Yes
> SourcePackage: synaptic
> UpgradeStatus: No upgrade log present (probably fresh install)
>
> --
> You received this bug notification because you are subsc...

Got this warning message on "dpkg-reconfigure keyboard-configuration":

$ sudo dpkg-reconfigure keyboard-configuration
[sudo] password for artful:
Invalid MIT-MAGIC-COOKIE-1 keyCannot open display ":0"
Your console font configuration will be updated the next time your system
boots. If you want to update it now, run 'setupcon' from a virtual console.
update-initramfs: deferring update (trigger activated)
Processing triggers for initramfs-tools (0.125ubuntu11) ...
update-initramfs: Generating /boot/initrd.img-4.13.0-12-generic

Should we add `debconf` to bug-reports?

According to https://bugzilla.redhat.com/show_bug.cgi?id=1274451 there are no plans for Wayland to support running graphical applications as root so that bug has been closed as WONTFIX. The correct fix is for Synaptic, and other graphical apps needing root, to be rewritten to run the GUI as a normal user and to use "polkit" for the parts where they need root access.

Thanks a lot! I've got a script that I run on each login to fix that.

On Sun, Oct 22, 2017 at 8:01 PM Mark <email address hidden> wrote:

> According to https://bugzilla.redhat.com/show_bug.cgi?id=1274451 there
> are no plans for Wayland to support running graphical applications as
> root so that bug has been closed as WONTFIX. The correct fix is for
> Synaptic, and other graphical apps needing root, to be rewritten to run
> the GUI as a normal user and to use "polkit" for the parts where they
> need root access.
>
>
> ** Bug watch added: Red Hat Bugzilla #1274451
> https://bugzilla.redhat.com/show_bug.cgi?id=1274451
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1705955).
> https://bugs.launchpad.net/bugs/1712089
>
> Title:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not
> connect: Connection refused
>
> Status in synaptic package in Ubuntu:
> Triaged
>
> Bug description:
> List of pkexec'ed applications is located in bug 1713313.
> List of packages which use su-to-root and gksu/gksudo is located in bug
> 1713311.
>
>
> -----------------------------------------------------------------------------
> pkexec'ed applications may be healed with "xhost +si:localuser:root"
> placed in XDG autostart as follows:
>
> cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
> [Desktop Entry]
> Name=xhost
> Comment=Fix graphical root applications
> Exec="xhost +si:localuser:root"
> Terminal=false
> Type=Application
> EOF
>
>
> -----------------------------------------------------------------------------
>
> Posting here what gnome says about porting to wayland, and their
> tests:
>
> GNOME Applications under Wayland
> GTK+ has a Wayland backend. If it was enabled at compile-time, you can
> run a GTK+ application under Wayland simply by:
>
> GDK_BACKEND=wayland gnome-calculator
> Applications that use Clutter or clutter-gtk also need the Clutter
> Wayland backend enabled:
>
> GDK_BACKEND=wayland CLUTTER_BACKEND=wayland cheese
>
> https://wiki.gnome.org/Initiatives/Wayland/Applications
>
> ======> so hope the settings are well set at compile time; maybe a
> rebuilt to get sure all apps are ok.
>
>
> ********************************************************************************************************************************************
>
> With the today packages upgrade, switching from X11 to wayland,
> synaptic refuse to load/open:
>
> from the icon into the dash-to-dock, nothing happen
> from the terminal:
>
> sudo synaptic
> [sudo] password for oem:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect:
> Connection refused
>
> (synaptic:2154): Gtk-WARNING **: cannot open display: :0
>
> Previous days already have switching some packages to wayland, but
> synaptic was still working. Its only with the today upgrades, after a
> cold reboot, that synaptic gui is broken.
>
> Today possibly sources problem:
>
> Unpacking console-setup-linux (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking console-setup (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking keyboard-configuration (1...

sudo gedit fstab
Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect: Connection refused

(gedit:17700): Gtk-WARNING **: cannot open display: :0

Re comment #21, according to https://bugzilla.redhat.com/show_bug.cgi?id=1274451

"GEdit now (on Gnome 3.24) has a mode where it can transparently edit files with root permissions without running as root."

However I've not been able to find any trace of that in the GEdit included with Ubuntu 17.10.

ah, the xhost command still works, even though on wayland; I didn't expect that.
executing the below xhost on the command line worked, so I assume the creation of the xhost.desktop file (described below) will indeed do the trick.
thanks!

On Tue, Oct 24, 2017 at 01:23:12PM -0000, jervin wrote:
> sudo gedit fstab
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect: Connection refused
>
> (gedit:17700): Gtk-WARNING **: cannot open display: :0
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1726742).
> https://bugs.launchpad.net/bugs/1712089
>
> Title:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not
> connect: Connection refused
>
> Status in synaptic package in Ubuntu:
> Triaged
>
> Bug description:
> List of pkexec'ed applications is located in bug 1713313.
> List of packages which use su-to-root and gksu/gksudo is located in bug 1713311.
>
> -----------------------------------------------------------------------------
> pkexec'ed applications may be healed with "xhost +si:localuser:root" placed in XDG autostart as follows:
>
> cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
> [Desktop Entry]
> Name=xhost
> Comment=Fix graphical root applications
> Exec="xhost +si:localuser:root"
> Terminal=false
> Type=Application
> EOF
>
> -----------------------------------------------------------------------------
>
> Posting here what gnome says about porting to wayland, and their
> tests:
>
> GNOME Applications under Wayland
> GTK+ has a Wayland backend. If it was enabled at compile-time, you can run a GTK+ application under Wayland simply by:
>
> GDK_BACKEND=wayland gnome-calculator
> Applications that use Clutter or clutter-gtk also need the Clutter Wayland backend enabled:
>
> GDK_BACKEND=wayland CLUTTER_BACKEND=wayland cheese
>
> https://wiki.gnome.org/Initiatives/Wayland/Applications
>
> ======> so hope the settings are well set at compile time; maybe a
> rebuilt to get sure all apps are ok.
>
> ********************************************************************************************************************************************
>
> With the today packages upgrade, switching from X11 to wayland,
> synaptic refuse to load/open:
>
> from the icon into the dash-to-dock, nothing happen
> from the terminal:
>
> sudo synaptic
> [sudo] password for oem:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect: Connection refused
>
> (synaptic:2154): Gtk-WARNING **: cannot open display: :0
>
> Previous days already have switching some packages to wayland, but
> synaptic was still working. Its only with the today upgrades, after a
> cold reboot, that synaptic gui is broken.
>
> Today possibly sources problem:
>
> Unpacking console-setup-linux (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking console-setup (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking keyboard-configuration (1.142ubuntu7) over (1.142ubuntu5)
> ...
>
> Unpacking gnome-session-bin (3.24.1-0ubuntu22) over (3.24.1-0ubuntu21)
> ...
>
> Unpacking gdm3 (3....

> ah, the xhost command still works, even though on wayland; I didn't expect that.

That's because with xhost set, apps fall back to using XWayland. At some point in the future XWayland will disappear and this hack will no longer work.

Comments in https://bugzilla.redhat.com/show_bug.cgi?id=1274451 suggest that the xhost hack opens up potential security holes allowing anything run by root to connect to your session.

BTW, unlike here, that bug contains an explanation of why the xhost hack (currently) works.

A Complaint: The work-arounds given here no longer function after the recent updates. WTF! How about fixing this requirements-related bug so I can partition my new drive? Barring that give me an Ubuntu-supported path back to 17.04 that doesn't involve my losing all my data.

A Suggestion: provide a configuration option to turn this behavior off in setup. It would still be annoying but at least we would be able to get our work done. Oh, and how about ASSIGNING someone to fix the bloody bug???

It's a bug in the individual packages, not Wayland.

On Fri, Oct 27, 2017 at 7:05 PM steve lubbs <email address hidden>
wrote:

> A Complaint: The work-arounds given here no longer function after the
> recent updates. WTF! How about fixing this requirements-related bug so I
> can partition my new drive? Barring that give me an Ubuntu-supported
> path back to 17.04 that doesn't involve my losing all my data.
>
> A Suggestion: provide a configuration option to turn this behavior off
> in setup. It would still be annoying but at least we would be able to
> get our work done. Oh, and how about ASSIGNING someone to fix the bloody
> bug???
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1705955).
> https://bugs.launchpad.net/bugs/1712089
>
> Title:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not
> connect: Connection refused
>
> Status in synaptic package in Ubuntu:
> Triaged
>
> Bug description:
> List of pkexec'ed applications is located in bug 1713313.
> List of packages which use su-to-root and gksu/gksudo is located in bug
> 1713311.
>
>
> -----------------------------------------------------------------------------
> pkexec'ed applications may be healed with "xhost +si:localuser:root"
> placed in XDG autostart as follows:
>
> cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
> [Desktop Entry]
> Name=xhost
> Comment=Fix graphical root applications
> Exec="xhost +si:localuser:root"
> Terminal=false
> Type=Application
> EOF
>
>
> -----------------------------------------------------------------------------
>
> Posting here what gnome says about porting to wayland, and their
> tests:
>
> GNOME Applications under Wayland
> GTK+ has a Wayland backend. If it was enabled at compile-time, you can
> run a GTK+ application under Wayland simply by:
>
> GDK_BACKEND=wayland gnome-calculator
> Applications that use Clutter or clutter-gtk also need the Clutter
> Wayland backend enabled:
>
> GDK_BACKEND=wayland CLUTTER_BACKEND=wayland cheese
>
> https://wiki.gnome.org/Initiatives/Wayland/Applications
>
> ======> so hope the settings are well set at compile time; maybe a
> rebuilt to get sure all apps are ok.
>
>
> ********************************************************************************************************************************************
>
> With the today packages upgrade, switching from X11 to wayland,
> synaptic refuse to load/open:
>
> from the icon into the dash-to-dock, nothing happen
> from the terminal:
>
> sudo synaptic
> [sudo] password for oem:
> Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect:
> Connection refused
>
> (synaptic:2154): Gtk-WARNING **: cannot open display: :0
>
> Previous days already have switching some packages to wayland, but
> synaptic was still working. Its only with the today upgrades, after a
> cold reboot, that synaptic gui is broken.
>
> Today possibly sources problem:
>
> Unpacking console-setup-linux (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking console-setup (1.142ubuntu7) over (1.142ubuntu5) ...
>
> Unpacking keyboard-con...

Invalid MIT-MAGIC-COOKIE-1 keyUnable to init server: Could not connect: Connection refused

(gedit:3053): Gtk-WARNING **: cannot open display: :0

answer #2 worked for me. could start synaptic again on Ubuntu 17.10

Intel® Core™ i5-6500 CPU @ 3.20GHz × 4
Intel® HD Graphics 530 (Skylake GT2)
3.26.2
64-bit

Answer #2 works but needs to be used prior to any attempt to use gui for gedit.

@PeterPall, why did you make bug #1551951 a duplicate of this bug? See comments 7 & 8 in bug #1551951 for explanation of why I separated all the Synaptic bugs from this bug in the first place.

This bug is a generic bug stating that graphical suid applications do not work on Wayland. This is *by design* therefore this bug will almost certainly be closed WONTFIX. The correct fix is for each application to be modified to not run its GUI as root and to use polkit to elevate privileges when it needs to write to files. Therefore there needs to be a bug for each app that can be tracked until the app is fixed. A single bug for all these apps will make managing the fixes very difficult.

Please undo what you did and make all the Synaptic bug reports separate again.

"Wayland" doesn't appear to care how many bugs they have created with their philosophical decision to not allow actions like "sudo synaptic" starting a graphical application from the command line. Is there any rationale??

Thanks, Jerry

I have a variation of this: pardon any imprecision here I am NOT an expert sysadmin, I am a mid-stage learning Linux enthusiast.

I am running Lubuntu 16.04 on a home server and want to use VNC to vino to reach it remotely.

Vino works fine - tested local and remote, *when I have the desktop of the server PC open and logged in*.

What I want to do is leave vino NOT running, until I use an SSH session to start it.

When remoting in to do this, I DO get the MIT-MAGIC-COOKIE issue here, initially, until I issue

    export DISPLAY=:0

- which then solves that, and lets me run the /usr/lib/vino/vino-server command and allworks fine.

BUT::: that only works when the server PC has a local (idle) login active at it's desktop.

If I log OUT that local session, then any remote SSH attempt lets me in normally, but
attempting then to run vino, gives this error

"Failed to connect to Mir: Failed to connect to server socket: No such file or directory
Unable to init server: Could not connect: Connection refused "

-- REGARDLESS of using export DISPLAY=:0 on either (or both) client and server.

So the distinction is purely, is there a locally logged-in session, or not. How does that affect this, and is there a workaround ?

I have researched this, and advice such as 'xhost +' has been tried and does not work.

I've also been advised to use more complex forms of he export command such as

    export DISPLAY=1.0

and
    export DISPLAY-<locapipaddress>:1.0

- which also don't solve it.

One thing I think a lot of newbies and mid-rangers like me struggle to get a handle on, is how X windows really works and why these odd permssions-to-screens are managed.

More confusingly, the client I'm using is Lubuntu 18.04, which is Ubuntu but with LXDE in place of Gnome, and (I think) LXQt this time ? or is that not default ? Or is it Wayland ? forgive me but how are we non-experts to work out which of these esoteric screen drive structures is in use, with the choices so much in flux ?

I think some forums consider this 'worked around' - it's not for me, its a live issue and there's no fix I've found yet.

All constructive advice very much appreciated.

thanks
Mike
London