Repository: freedomofpress/securedrop

Issue:
NetworkManager hook notifications broken on Tails 2.x
The invocation of `notify-send` in `securedrop_init.py` does not show a notification in Tails 2.x like it did in Tails 1.x. This is due to dbus-related changes in Debian Jessie, and is a known issue as a quick [search](https://labs.riseup.net/code/projects/tails/search?utf8=%E2%9C%93&changesets=1&q=notify-send) of the Tails issue tracker demonstrates.

Furthermore, it looks like Tails has a special wrapper script, `tails-notify-user`, specifically meant for the use case of displaying notifications to the user from background scripts running as different users, so we should just use that instead.



Discussion:

Resolving patch:
diff --git a/tails_files/securedrop_init.py b/tails_files/securedrop_init.py
--- a/tails_files/securedrop_init.py
+++ b/tails_files/securedrop_init.py
@@ -1,44 +1,47 @@
-#!/usr/bin/env python
+#!/usr/bin/python
 
 import os
 import sys
 import subprocess
 
 
-if __name__ == '__main__':
-    # check for root
-    if os.geteuid() != 0:
-        sys.exit('You need to run this as root')
+# check for root
+if os.geteuid() != 0:
+    sys.exit('You need to run this as root')
 
-    # paths
-    path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
-    path_torrc_backup = '/etc/tor/torrc.bak'
-    path_torrc = '/etc/tor/torrc'
+# paths
+path_torrc_additions = '/home/amnesia/Persistent/.securedrop/torrc_additions'
+path_torrc_backup = '/etc/tor/torrc.bak'
+path_torrc = '/etc/tor/torrc'
 
-    # load torrc_additions
-    if os.path.isfile(path_torrc_additions):
-        torrc_additions = open(path_torrc_additions).read()
-    else:
-        sys.exit('Error opening {0} for reading'.format(path_torrc_additions))
+# load torrc_additions
+if os.path.isfile(path_torrc_additions):
+    torrc_additions = open(path_torrc_additions).read()
+else:
+    sys.exit('Error opening {0} for reading'.format(path_torrc_additions))
 
-    # load torrc
-    if os.path.isfile(path_torrc_backup):
-        torrc = open(path_torrc_backup).read()
+# load torrc
+if os.path.isfile(path_torrc_backup):
+    torrc = open(path_torrc_backup).read()
+else:
+    if os.path.isfile(path_torrc):
+        torrc = open(path_torrc).read()
     else:
-        if os.path.isfile(path_torrc):
-            torrc = open(path_torrc).read()
-        else:
-            sys.exit('Error opening {0} for reading'.format(path_torrc))
+        sys.exit('Error opening {0} for reading'.format(path_torrc))
 
-        # save a backup
-        open(path_torrc_backup, 'w').write(torrc)
+    # save a backup
+    open(path_torrc_backup, 'w').write(torrc)
 
-    # append the additions
-    open(path_torrc, 'w').write(torrc + torrc_additions)
+# append the additions
+open(path_torrc, 'w').write(torrc + torrc_additions)
 
-    # reload tor
-    subprocess.call(['/usr/sbin/service', 'tor', 'reload'])
+# reload tor
+try:
+    subprocess.check_call(['systemctl', 'reload', 'tor@default.service'])
+except subprocess.CalledProcessError:
+    sys.exit('Error reloading Tor')
 
-    # success
-    subprocess.call(['/usr/bin/sudo', '-u', 'amnesia', '/usr/bin/notify-send', '-i', '/home/amnesia/Persistent/.securedrop/securedrop_icon.png',
-        'Updated torrc!', 'You can now connect to your SecureDrop\ndocument interface.'])
+# notify the user
+subprocess.call(['tails-notify-user',
+                 'SecureDrop successfully auto-configured!',
+                 'You can now access the Document Interface.\nIf you are an admin, you can now SSH to the servers.'])


Test patch:
diff --git a/docs/test_the_installation.rst b/docs/test_the_installation.rst
--- a/docs/test_the_installation.rst
+++ b/docs/test_the_installation.rst
@@ -10,15 +10,18 @@ SSH to both servers over Tor
 On the Admin Workstation, you should be able to SSH to the App
 Server and the Monitor Server. ::
 
+   $ ssh app
+   $ ssh mon
+
+The SSH aliases should have been configured automatically by running
+the ``install.sh`` script. If you're unable to connect via aliases,
+try using the verbose command format to troubleshoot: ::
+
    $ ssh <username>@<app .onion>
    $ ssh <username>@<mon .onion>
 
-If you set up :ref:`SSH Host Aliases` during the post-install
-setup for the Admin Workstation, you should be able to connect
-with the aliases: ::
-
-   $ ssh app
-   $ ssh mon
+.. tip:: You can find the Onion URLs for SSH in ``app-ssh-aths`` and
+         ``mon-ssh-aths`` inside the ``install_files/ansible-base`` directory.
 
 Log in to both servers via TTY
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~