1.27.5.1: XFCE runs, session bus, libraries' RUNPATH (#67), memfd locks (#69)

.github/workflows/build-release.yml

@@ -45,7 +45,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up JDK 17
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+        uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -126,8 +126,7 @@ jobs:
         if: steps.cache-hook.outputs.cache-hit != 'true'
         run: |
           sudo rm -f /etc/apt/sources.list.d/*google* /etc/apt/sources.list.d/*chrome*
-          sudo apt-get update -o Acquire::Retries=3 -qq
-          sudo apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu gcc-arm-linux-gnueabihf libc6-dev-arm64-cross libc6-dev-armhf-cross dpkg-dev
+          scripts/ci-apt-install.sh gcc-aarch64-linux-gnu gcc-arm-linux-gnueabihf libc6-dev-arm64-cross libc6-dev-armhf-cross dpkg-dev
           mkdir -p hook-libs
           # The code that is added to static Go programs (gosys/gosys.c), which the 64-bit hook carries
           scripts/build-gosys.sh
@@ -349,8 +348,7 @@ jobs:
           CORTEX_REQUIRE_GO_TESTS: 1
           CORTEX_GO_TEST_VERSIONS: "1.19.13 1.23.12"
         run: |
-          sudo apt-get update -o Acquire::Retries=3 -qq
-          sudo apt-get install -y --no-install-recommends qemu-user gcc-aarch64-linux-gnu libc6-dev-arm64-cross binutils-aarch64-linux-gnu
+          scripts/ci-apt-install.sh qemu-user gcc-aarch64-linux-gnu libc6-dev-arm64-cross binutils-aarch64-linux-gnu
           bash tests/scripts/test_go_programs.sh
           CORTEX_REQUIRE_QEMU_TESTS=1 bash tests/scripts/test_hook_qemu.sh
 

CHANGELOG.md

@@ -4,6 +4,53 @@ What changed in each version of Cortex Terminal, newest first. The release workf
 of a GitHub release from the section of its version here. Older versions are described on the
 [GitHub releases](https://github.com/ssfuisu/cortex/releases) page.
 
+## 1.27.5.1 (2026-11-11)
+
+### Fixed
+
+- **XFCE: "Unable to contact settings server. The connection is closed".** Every program in Cortex
+  sees itself as root, but the kernel told a server the app's real user for the program at the other
+  end of a Unix socket. dbus-daemon compares the two and closed every connection to the session bus,
+  so XFCE's settings service could not be reached and the session stopped at that message. The other
+  end is now shown as the user programs see for themselves (SO_PEERCRED, received SCM_CREDENTIALS).
+  The session bus works for other programs too.
+- **XFCE's panel ended at once and the desktop stayed black.** Cortex does not build the database
+  of file types when packages are installed, and GTK cannot load an icon without it. `cortex-desktop`
+  now builds it, and the database of the programs that open files, when the desktop is installed or
+  started and a package has added to them.
+- **"Plugin PulseAudio Plugin unexpectedly left the panel".** A library loaded with dlopen() did
+  not find what one of its dependencies keeps in a directory of its own (libpulse.so.0 and its
+  libpulsecommon). The same kept programs that load libpulse by name from having sound.
+
+- **Every start of the desktop left a PulseAudio behind.** `pulseaudio --kill` looks for a process
+  named pulseaudio and found none (Cortex's programs run as ld.so), so the old one was never
+  stopped and the new one started without its socket: after the desktop was started again its sound
+  went to a daemon nobody listened to. The desktop now keeps track of its PulseAudio itself, and
+  ends the ones older versions left.
+
+- **Programs whose libraries name a directory of their own did not start (#67).** fio ended with
+  "libceph-common.so.2: cannot open shared object file": its librbd.so.1 finds that library through
+  its RUNPATH (/usr/lib/aarch64-linux-gnu/ceph), which ld.so looked for outside Ubuntu's files. The
+  directories that libraries name this way are now collected when ldconfig runs (after packages are
+  installed, as on Linux) into /etc/ld.so.conf.d/zz-cortex-runpath.conf. This also ends the
+  "libpxbackend-1.0.so: cannot open shared object file" lines of GTK programs.
+- **PHP's built-in server: "Cannot create lock - Permission denied (13)" (#69).** PHP keeps the lock
+  of its opcache in a memory file (memfd), and Android does not let an app lock one. A lock that
+  Android refuses on a memfd is now taken on a file of Cortex's own, which the program's children
+  share, so `php -S` and PHP-FPM start.
+- **PHP extensions looked for their files in Android's tree.** PHP loads every extension with
+  RTLD_DEEPBIND, which makes a library call libc directly, past Cortex's library: an extension's
+  absolute paths (a certificate bundle, a database file) were not Ubuntu's. Libraries are now loaded
+  without that flag.
+
+### Changed
+
+- lstat() of a link in /usr/lib (libssl.so.3 -> libssl.so.3.0.0 and the like) no longer reads the
+  link a second time: only a link that can lead into /etc/alternatives is read (#66).
+- XFCE starts with its compositor off (shadows and transparency are drawn by the CPU here); it can
+  be turned on in Settings > Window Manager Tweaks. The desktops install the SVG icon loader.
+- A bug report has the desktop's state and the last lines of its log (`~/.cortex/desktop.log`).
+
 ## 1.27.4 (2026-11-09)
 
 ### Fixed

app/build.gradle.kts

@@ -16,8 +16,8 @@ android {
         // from the app's writable data directory (filesDir). Android 10+ (targetSdk >= 29)
         // enforces SELinux W^X restrictions preventing execution from writable app data storage.
         targetSdk = 28
-        versionCode = 12704
-        versionName = "1.27.4"
+        versionCode = 12705
+        versionName = "1.27.5.1"
         // UbuntuOnDeviceTest (app/src/androidTest), on Firebase Test Lab
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

app/src/main/assets/scripts/cortex-desktop.sh

@@ -23,10 +23,10 @@ DEFAULT_SIZE="1280x720"
 
 LIGHT_PACKAGES="tigervnc-standalone-server tigervnc-tools dbus-x11 xauth x11-xserver-utils x11-utils
 xfonts-base fonts-dejavu-core openbox obconf python3-xdg tint2 pcmanfm lxterminal mousepad lxappearance
-adwaita-icon-theme-full pulseaudio pulseaudio-utils xdg-utils"
+adwaita-icon-theme-full librsvg2-common pulseaudio pulseaudio-utils xdg-utils"
 XFCE_PACKAGES="tigervnc-standalone-server tigervnc-tools dbus-x11 xauth x11-xserver-utils x11-utils
 xfonts-base fonts-dejavu-core xfce4 xfce4-terminal thunar mousepad
-adwaita-icon-theme-full pulseaudio pulseaudio-utils xdg-utils"
+adwaita-icon-theme-full librsvg2-common pulseaudio pulseaudio-utils xdg-utils"
 
 die() {
     echo "cortex-desktop: $*" >&2
@@ -98,6 +98,39 @@ free_display() {
     return 1
 }
 
+# The real program behind one that Cortex does not run when packages are installed (its stand-in
+# does nothing, and the hook answers for a program of that name itself)
+real_tool() {
+    if [ -x "$R/usr/bin/$1.distrib" ]; then
+        echo "$R/usr/bin/$1.distrib"
+    elif [ -x "$R/usr/bin/$1" ] && mkdir -p "$STATE" && ln -sf "$R/usr/bin/$1" "$STATE/$1.real" 2>/dev/null; then
+        echo "$STATE/$1.real"
+    else
+        return 1
+    fi
+}
+
+# The databases of file types (/usr/share/mime) and of the programs that open them. Cortex leaves
+# them out when packages are installed: they take time and a terminal has no use for them. But GTK
+# cannot load a single icon without the first (XFCE's panel ended at once, its desktop stayed
+# black), and a file manager does not know what opens a file without the second. They are built
+# here: the first (a few seconds) when it is missing or a package added to or took from it (the
+# directory of its sources changed: a file dpkg unpacks keeps the date it has in the package, so the
+# files' own dates say nothing), the second (a moment) every time.
+refresh_databases() {
+    local dir real
+    dir="$R/usr/share/mime"
+    if [ -d "$dir/packages" ] && { [ ! -f "$dir/mime.cache" ] || [ -n "$(find "$dir/packages" -newer "$dir/mime.cache" -print -quit 2>/dev/null)" ]; }; then
+        if real="$(real_tool update-mime-database)"; then
+            "$real" "$dir" >/dev/null 2>&1 || echo "cortex-desktop: update-mime-database failed" >&2
+        fi
+    fi
+    dir="$R/usr/share/applications"
+    if [ -d "$dir" ] && real="$(real_tool update-desktop-database)"; then
+        "$real" "$dir" >/dev/null 2>&1 || echo "cortex-desktop: update-desktop-database failed" >&2
+    fi
+}
+
 installed_kind() {
     local kind
     kind="$(conf_value DESKTOP)"
@@ -133,6 +166,7 @@ cmd_install() {
     as_root env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $packages ||
         die "the packages could not be installed"
     if [ "$firefox" = 1 ]; then install_firefox || echo "cortex-desktop: Firefox was not installed (see above)." >&2; fi
+    refresh_databases
     set_conf DESKTOP "$kind"
     echo "The desktop is installed. Open it from the app's menu (Desktop), or run: cortex-desktop start"
 }
@@ -254,19 +288,53 @@ show_mounts=0
 EOF
 }
 
+# Ends the desktop's PulseAudio. "pulseaudio --kill" does not find it here: it looks for a process
+# named pulseaudio, and Cortex's programs run as ld.so with their name as an argument. So it was
+# never stopped, and every start of the desktop left one more behind, the new one without its socket
+# (the old one still held it). Ours are known by the pid kept at their start and by their socket.
+stop_audio() {
+    local pid i theirs="module-native-protocol-unix socket=$STATE/pulse.sock"
+    pid="$(cat "$STATE/pulse.pid" 2>/dev/null)"
+    pid_is "$pid" pulseaudio && kill "$pid" 2>/dev/null
+    command -v pkill >/dev/null 2>&1 && pkill -f "$theirs" 2>/dev/null
+    # all of them gone before the socket is taken away: one that ends later removes it as it goes,
+    # which would be the next one's
+    for i in $(seq 1 30); do
+        if ! pid_is "$pid" pulseaudio && ! { command -v pgrep >/dev/null 2>&1 && pgrep -f "$theirs" >/dev/null 2>&1; }; then break; fi
+        sleep 0.1
+    done
+    if pid_is "$pid" pulseaudio; then kill -9 "$pid" 2>/dev/null; fi
+    command -v pkill >/dev/null 2>&1 && pkill -9 -f "$theirs" 2>/dev/null
+    rm -f "$STATE/pulse.pid" "$STATE/pulse.server" "$STATE/pulse.sock"
+}
+
 start_audio() {
     command -v pulseaudio >/dev/null 2>&1 || return 0
-    local fifo="$STATE/audio.fifo"
+    local fifo="$STATE/audio.fifo" pid i
     [ -p "$fifo" ] || { rm -f "$fifo"; mkfifo -m 600 "$fifo" 2>/dev/null; } || return 0
-    pulseaudio --kill >/dev/null 2>&1
+    stop_audio
     # No shared memory between PulseAudio and its programs (they talk over the socket), no realtime
-    # priority (Android does not give it), and one output: the pipe the app reads and plays
-    pulseaudio --daemonize=yes --exit-idle-time=-1 --disallow-exit --disable-shm=yes \
+    # priority (Android does not give it), and one output: the pipe the app reads and plays. Not as
+    # its own daemon and without its pid file (see stop_audio): in a session of its own, like the X server.
+    setsid pulseaudio --daemonize=no --use-pid-file=no --exit-idle-time=-1 --disallow-exit --disable-shm=yes \
         --realtime=no --high-priority=no --log-target=file:"$LOG_DIR/pulseaudio.log" -n \
         -L "module-native-protocol-unix socket=$STATE/pulse.sock auth-anonymous=1" \
         -L "module-pipe-sink file=$fifo format=s16le rate=44100 channels=2 sink_name=android" \
-        -L "module-always-sink" >/dev/null 2>&1 || return 0
-    echo "unix:$STATE/pulse.sock" >"$STATE/pulse.server"
+        -L "module-always-sink" </dev/null >/dev/null 2>&1 9>&- &
+    pid=$!
+    echo "$pid" >"$STATE/pulse.pid"
+    # its socket is there within a moment; a desktop without sound is still a desktop
+    for i in $(seq 1 50); do
+        [ -S "$STATE/pulse.sock" ] && break
+        pid_alive "$pid" || break
+        sleep 0.1
+    done
+    if [ -S "$STATE/pulse.sock" ]; then
+        echo "unix:$STATE/pulse.sock" >"$STATE/pulse.server"
+    else
+        # not one that runs on without anyone knowing its socket
+        stop_audio
+    fi
 }
 
 cmd_start() {
@@ -325,21 +393,43 @@ cmd_start() {
     start_audio
     if ! start_session "$display"; then
         stop_processes
+        stop_audio
         die "the desktop did not start (log: $LOG)"
     fi
     echo "The desktop is running: DISPLAY=:$display (programs started from the terminal open on it)."
 }
 
+# XFCE's window manager blends the windows together itself (shadows, transparency) unless told
+# otherwise, and without a GPU the CPU does that for every change on the screen. Off the first time;
+# the file is the user's from then on (Settings > Window Manager Tweaks > Compositor).
+ensure_xfce_defaults() {
+    local dir="${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml"
+    [ -e "$dir/xfwm4.xml" ] && return 0
+    mkdir -p "$dir" || return 0
+    cat >"$dir/xfwm4.xml" <<'EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xfwm4" version="1.0">
+  <property name="general" type="empty">
+    <property name="use_compositing" type="bool" value="false"/>
+  </property>
+</channel>
+EOF
+}
+
 # The desktop's session on the X server of display $1; fails when it ends at once
 start_session() {
     local display="$1" pulse="" current="openbox"
-    [ "$(conf_value DESKTOP)" = xfce ] || ensure_openbox_autostart
+    refresh_databases
+    if [ "$(conf_value DESKTOP)" = xfce ]; then ensure_xfce_defaults; else ensure_openbox_autostart; fi
     [ -f "$STATE/pulse.server" ] && pulse="$(cat "$STATE/pulse.server")"
     [ "$(conf_value DESKTOP)" = xfce ] && current="XFCE"
     (
         cd "$HOME" || exit 1
         unset SESSION_MANAGER DBUS_SESSION_BUS_ADDRESS
-        export DISPLAY=":$display" XDG_SESSION_TYPE=x11 XDG_CURRENT_DESKTOP="$current"
+        # NO_AT_BRIDGE: there is no accessibility bus here, and every GTK program waited for it and
+        # wrote a warning
+        export DISPLAY=":$display" XDG_SESSION_TYPE=x11 XDG_CURRENT_DESKTOP="$current" NO_AT_BRIDGE=1
         [ -n "$pulse" ] && export PULSE_SERVER="$pulse"
         # shellcheck disable=SC2046
         exec setsid dbus-launch --exit-with-session $(session_command)
@@ -375,8 +465,8 @@ cmd_stop() {
     take_lock
     local stopped=0
     stop_processes && stopped=1
-    command -v pulseaudio >/dev/null 2>&1 && pulseaudio --kill >/dev/null 2>&1
-    rm -f "$STATE/pulse.server" "$SOCKET"
+    stop_audio
+    rm -f "$SOCKET"
     if [ "$stopped" = 1 ]; then echo "The desktop was stopped."; else echo "The desktop was not running."; fi
 }
 

app/src/main/cpp/cortex-hook.c

@@ -80,3 +80,4 @@
 #include "hook/net.c"
 #include "hook/sockets.c"
 #include "hook/sysv_shm.c"
+#include "hook/memfd_locks.c"

app/src/main/cpp/hook/exec.c

@@ -139,11 +139,13 @@ static int run_execve(orig_execve_f_type f, const char *path, char *const argv[]
     return f(path, argv, envp);
 }
 
-// ldconfig does nothing in Cortex (its cache is for paths that ld.so opens without the hook), but the
+// ldconfig writes no cache in Cortex (its cache is for paths that ld.so opens without the hook), but the
 // exec code reads /etc/ld.so.conf(.d) again when /etc/ld.so.cache changes: "sudo ldconfig" after an
 // edit of a .conf file marks it changed, as the real ldconfig would by writing it.
 static void ldconfig_mark_cache(void) {
     if (g_cortex_root[0] == '\0') return;
+    // what the real one does for its cache: the libraries are read (their RUNPATH), see runpath_conf_refresh()
+    runpath_conf_refresh();
     char path[PATH_MAX];
     size_t n = cortex_append(path, sizeof(path), 0, g_cortex_root, g_cortex_root_len);
     cortex_append(path, sizeof(path), n, "/etc/ld.so.cache", 16);