4 files changed, 14 insertions, 5 deletions
diff --git a/src/leap/bitmask/cli/command.py b/src/leap/bitmask/cli/command.py
index 7bc2ce7b..77d2bdfc 100644
--- a/src/leap/bitmask/cli/command.py
+++ b/src/leap/bitmask/cli/command.py
@@ -154,7 +154,7 @@ class Command(object):
             else:
                 return printer(obj['result'])
         else:
-            print Fore.RED + 'ERROR:' + '%s' % obj['error'] + Fore.RESET
+            print Fore.RED + 'ERROR: ' + '%s' % obj['error'] + Fore.RESET
 
     def _timeout_handler(self, failure, errb):
         if failure.trap(ZmqRequestTimeoutError) == ZmqRequestTimeoutError:
diff --git a/src/leap/bitmask/core/dispatcher.py b/src/leap/bitmask/core/dispatcher.py
index 9d486009..52de62b6 100644
--- a/src/leap/bitmask/core/dispatcher.py
+++ b/src/leap/bitmask/core/dispatcher.py
@@ -537,10 +537,12 @@ def _format_error(failure):
     """
     Logs the failure backtrace, and returns a json containing the error
     message.
-    """
 
-    # If a exception declares the 'expected' attribute as True,
-    # we will not print a full traceback
+    If a exception declares the 'expected' attribute as True,
+    we will not print a full traceback. instead, we will dispatch
+    the ``exception`` message attribute as the ``error`` field in the response
+    json.
+    """
 
     expected = getattr(failure.value, 'expected', False)
     if not expected:
diff --git a/src/leap/bitmask/vpn/privilege.py b/src/leap/bitmask/vpn/privilege.py
index b49f165c..3c66c7a5 100644
--- a/src/leap/bitmask/vpn/privilege.py
+++ b/src/leap/bitmask/vpn/privilege.py
@@ -50,6 +50,7 @@ def uninstall_helpers():
 
 
 class NoPolkitAuthAgentAvailable(Exception):
+    message = 'No polkit authentication agent available. Please run one.'
     pass
 
 
diff --git a/src/leap/bitmask/vpn/service.py b/src/leap/bitmask/vpn/service.py
index 1ec1ed6d..eefccad1 100644
--- a/src/leap/bitmask/vpn/service.py
+++ b/src/leap/bitmask/vpn/service.py
@@ -29,6 +29,7 @@ from leap.bitmask.hooks import HookableService
 from leap.bitmask.vpn.vpn import VPNManager
 from leap.bitmask.vpn._checks import is_service_ready, get_vpn_cert_path
 from leap.bitmask.vpn import privilege, helpers
+from leap.bitmask.vpn.privilege import NoPolkitAuthAgentAvailable
 from leap.common.config import get_path_prefix
 from leap.common.files import check_and_fix_urw_only
 from leap.common.certs import get_cert_time_boundaries
@@ -68,7 +69,12 @@ class VPNService(HookableService):
     def start_vpn(self, domain):
         # TODO check if the VPN is started and return an error if it is.
         yield self._setup(domain)
-        self._vpn.start()
+        try:
+            self._vpn.start()
+        except NoPolkitAuthAgentAvailable as e:
+            e.expected = True
+            raise e
+
         self._started = True
         self._domain = domain
         self._write_last(domain)