[solved] Kodi and sudo openvpn

[Latte]

Dear all,

I am trying to get the OpenVPN-Manager add-on Kodi to work.
The add-on calls sudo openvpn. So I needed to setup sudo accordingly.

the kodi log says:

Code: Select all

21:12:28 T:139979707557632    NONE: VPN Mgr Debug: (Linux) Starting VPN with /usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn" > /home/media/openvpn.log &

it ends with

Code: Select all

Mon Aug 15 20:53:52 2016 us=678147 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Aug 15 20:53:52 2016 us=678251 Exiting due to fatal error

which looks like a sudo error

using

Code: Select all

sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn

in the terminal an working VPN connection can be established (the different ovpn file doesn't matter)

I used kodi v14 from the repos as well as kodi v17 from kekePower in Mageia 5 - no differences. I run kodi as standalone with autologin of of my standard user.

Entry in visudo

Code: Select all

 Cmnd_Alias KODI = /usr/sbin/openvpn
 # User privilege specification
media ALL=(root) NOPASSWD: KODI

Does anyone have an idea or a hint what I can check?

Thanks

[doktor5000]

the kodi log says:

Code: Select all

21:12:28 T:139979707557632    NONE: VPN Mgr Debug: (Linux) Starting VPN with /usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn" > /home/media/openvpn.log &

it ends with

Code: Select all

Mon Aug 15 20:53:52 2016 us=678147 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Aug 15 20:53:52 2016 us=678251 Exiting due to fatal error

which looks like a sudo error

Major difference is that you start it with a different configuration compared to what kodi tried in the log

Apart from that I'd say the difference is that you run this from an interactive shell, and kodi runs this not from an interactive shell, so the environment may be different.
Could you please also add the output of

Code: Select all

sudo -l

run as the media user and as root of

Code: Select all

su - media -c sh 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'
su - media -c sh 'sudo /usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn"'

What is also pretty sad is that the kodi vpn manager way to run the command drops everything that goes to stderr and only redirects stdout into the log /home/media/openvpn.log.
It should start the VPN like this to also capture stderr into the log

Code: Select all

/usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn" > /home/media/openvpn.log  2>&1 &

[plspls]

did you check if sudo is installed? sometimes sudo is not installed and it doesn't work

also try changing your password and rebooting sometimes rebooting fix the problem

[Latte]

Major difference is that you start it with a different configuration compared to what kodi tried in the log

sorry, too many attempts and too many log files. The cited log entries was, when I temporarily disabled the sudo in the add-on settings. This is the log entry for the "standard" approach with enabled sudo setting (please note that I even manipulated the code to save the log file in the /home of media to get rid of any permission issues if the log is written to /run/openvpn.log)

Code: Select all

16:26:11 T:140517134538496    NONE: VPN Mgr Debug: (Linux) Starting VPN with sudo /usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn" > /home/media/openvpn.log &

I posted exactly this command in the terminal and it works.

... so the environment may be different.

I thought in the same direction, that a different evironment between ssh login as user, and the kodi -standalone login

Could you please also add the output of

Code: Select all

sudo -l

run as the media user and as root of

Code: Select all

su - media -c sh 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'
su - media -c sh 'sudo /usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn"'

Code: Select all

[media@MediaCenter ~]$ LC_ALL=C sudo -l
Matching Defaults entries for media on MediaCenter:
    requiretty, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS",
    env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE
    LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, env_keep+=QT_GRAPHICSSYSTEM

User media may run the following commands on MediaCenter:
    (root) NOPASSWD: /sbin/shutdown, /sbin/halt, /sbin/reboot, /sbin/poweroff
    (root) NOPASSWD: /usr/sbin/openvpn

as media and as root (both commands same output):

Code: Select all

media@MediaCenter ~]$ LC_ALL=C su - media -c sh 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'
Password:
sh: Kann die Prozessgruppe des Terminals nicht setzen (-1).: Unpassender IOCTL (I/O-Control) für das Gerät
sh: Keine Job Steuerung in dieser Shell.
sh-4.3$

I am connected via ssh. Or is there a difference when I logged in locally?

What is also pretty sad is that the kodi vpn manager way to run the command drops everything that goes to stderr and only redirects stdout into the log /home/media/openvpn.log.
It should start the VPN like this to also capture stderr into the log

Code: Select all

/usr/sbin/openvpn "/home/media/.kodi/addons/service.vpn.manager/ExpressVPN/Albania (UDP).ovpn" > /home/media/openvpn.log  2>&1 &

I can try to modify the code (I managed as well in adapting the log path, so I should get it even with my limited python skills

did you check if sudo is installed? sometimes sudo is not installed and it doesn't work

hmm? Did you read my in my first post:

using sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn in the terminal an working VPN connection can be established

[doktor5000]

Yep already assumed that you tried with different VPN configs and probably all of them are working if you call them yourself with sudo, but not when kodi vpn manager runs them.

as media and as root (both commands same output):

Code: Select all

media@MediaCenter ~]$ LC_ALL=C su - media -c sh 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'
Password:
sh: Kann die Prozessgruppe des Terminals nicht setzen (-1).: Unpassender IOCTL (I/O-Control) für das Gerät
sh: Keine Job Steuerung in dieser Shell.
sh-4.3$

I am connected via ssh. Or is there a difference when I logged in locally?

Hmmm, does

Code: Select all

su - media -c 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'

yield anything different ? FWIW the error message was still in german as LC_ALL=C was not exported, and also at the wrong place, it should have been directly in front of sh, or just run in your session once

Code: Select all

export LC_ALL=C

which is preserved by sudo.

FWIW, how do you regularly start that VPN connection for testing purposes? Login via ssh as user media, and then sudo openvpn someopenvpn.config and that works, right ?

[Latte]

Bingo

Hmmm, does

Code: Select all

su - media -c 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'

That directs me in the right direction:

Code: Select all

[root@MediaCenter media]# su - media -c 'sudo /usr/sbin/openvpn ~/.kodi/addons/service.vpn.manager/ExpressVPN/Germany\ -\ Frankfurt\ -\ 1\ \(UDP\).ovpn'
sudo: Sie müssen ein TTY haben, um sudo zu verwenden

http://unix.stackexchange.com/questions ... a-password

Commenting out "Defaults requiretty" in /etc/sudoers and I was one step further

Addtionally adding /sbin/pidof to /etc/sudoers and the vpn-connection can be established also in kodi

Thanks dokor for pointing me in the correct direction