Dev1 Galaxy Forum / [SOLVED] pkexec authenticates without password

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Wed, 06 Feb 2019 18:50:16 +0000

Turns out there are some files created by live-config that get in the way. I will add them to the installer's exclude list.

- /etc/PolicyKit/PolicyKit.conf
- /var/lib/polkit-1/localauthority/10-vendor.d/10-live-cd.pkla
- /home/*/.su-to-rootrc
- /home/*/.*/share/config/kdesurc
- /home/*/.*/share/config/tdesurc

(Note: the last three also need to be added to home_boot_exlclude.list)

...and make sure policykit-1-gnome is installed.

Edit: added files specific to kde or tde.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (gnath) — Mon, 04 Sep 2017 17:57:18 +0000

Food for reading, man polkit & pkexec. Late in the party. Checked my ascii & ceres systems with DE's. Removed policykit-1-gnome & install lxpolkit ( ascii with lxde & xfce4). gparted & synaptic can't be launced from menu, but from terminal. In terminal it uses no graphical authentication. Same for mate-polkit (ceres with mate). In both system reinstalled policykit-1-gnome & reboot. Graphical authentication is back for both programs and also for mounting devices from file managers. 'pkexec' is provided by synaptic & gparted.'gksu' is maual install. Authentication via pkexec routed through 'polkit-agent-helper-1' which is provided by DE's. Without DM probably you need policykit-1. Different DE's have their own implementation. Should DM's & xorg run by users?

cheers,

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fungus) — Thu, 31 Aug 2017 17:11:05 +0000

I have a suspicion that systemd was providing some intermediary service to many desktop devs. They universalized some instruction so systemd would know what you want to do and it would feed it to the appropriate daemon/service to carry out the simple task. Desktop devs concentrating in serving the giant distros couldn't care less about the non-systemd systems. New systems haven't gotten around to it yet in translating non-sense to sensical instructions.
So you end up downloading a desktop whose functions are systemd oriented and just do a silent blip when things don't work out. When you try the actual instruction in terminal at least you know why the desktop is not doing anything. Sudo synaptic has always worked for me when all else failed.
Oblogout when you install it in ascii semi works, but for each subcommand you have to test it in terminal and edit the appropriate .conf file. For lxpanel there is a conf file that has all the systemd commands for shutdown/reboot etc, you have to transform them to oblogout instructions, and edit the oblogout.conf itself to get it to function correctly. Pain in the neck.

The more I try to make things work the more sense Steve Litt's article makes https://sysdfree.wordpress.com/112/

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (garyz.dev1) — Thu, 31 Aug 2017 16:16:00 +0000

Well, did a little reading on "so many policykits"
I learned that program starting is a 2 step process (at least) - very simplified
step 1 -PAM (/etc/pam.d) Authenticates who you are
step 2 -Polkit - Authorizes what you can do/run - based upon being 'Authenticated'
'
I didn't get an answer as to why so many "polkits" -- unless they are a wrapper for
the official Polkit --[ie creates the PAM files and policy files for their respective programs
mate menu items / lxde menu items / gnome base structure / etc.
'
just posted this as aFWIW - shed some possible light on the variations that @fsmithred encountered

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Sun, 27 Aug 2017 23:52:32 +0000

In the upgraded Refracta:
Tried replacing mate-polkit with lxpolkit. Didn't help. Tried adding policykit-1-gnome (with each of the other polkits) didn't help.

In the upgraded Devuan:
Tried adding policykit-1-gnome first, and now gparted and synaptic don't start. Tried from the menu and from the terminal with pkexec.

However, I can do 'pkexec /usr/sbin/adduser buford' and it works. Had to use the full path with adduser.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Sun, 27 Aug 2017 16:11:30 +0000

Using xfce here. This was an install from the desktop-live iso. It's actually a mixed ascii/ceres now. I tested it first in pure ascii, then added ceres and did a dist-upgrade without removing the ascii sources. I had no problems during the upgrade. And pkexec acts the same in both.

I did notice in another installation that lxqt did it right. I guess the lx teams know what they're doing.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fungus) — Sun, 27 Aug 2017 15:41:34 +0000

I found that lxpolikit fixes alot of issues back and forth, too many rights and too little rights. Polkit just doesn't work right on openbox/lxde. Now if you like me and a few others are running openbox without the complete lxde installation try it. You may have to put it manually into openbox/autostart

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Sun, 27 Aug 2017 15:15:05 +0000

Same behavior in a devuan jessie that got upgraded to ascii, and then again when upgraded to ceres.

pkexec allows primary user to install and remove software (didn't test gparted this time)
It does not allow primary user to create a new user, and it does not let the second user install software.

I will get around to filing a bug report.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (golinux) — Sat, 19 Aug 2017 01:36:34 +0000

Why don't you start with one desktop and then expand incrementally instead of throwing a smorgasbord at it.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Sat, 19 Aug 2017 01:19:47 +0000

For the record - this is on a refracta-jessie that was upgraded to ascii. So I started with xfce. It also has icewm and openbox, and I use lxpanel and lxterminal with ob. But I don't have the full lxde destkop. I've also had other weird stuff with this installation. Today I had to add net.ifnames=0 to the boot command a couple of times to have network connection. Normally I don't need to do that with this install, even though it's using 4.9 kernel.

Tested another install on the same machine. This one started as a minimal install, upgraded to ascii, then added apps. In xfce and openbox, gparted won't start from the menu, but if I start gparted-pkexec in terminal, it asks for password. This install also has lxqt, and there, I get a graphical window asking for the root password like it should. (lxqt-policykit-agent runs)

I seem to be the only one with this problem (the one in the subject line) so I won't file a bug report on it. At some point I'll do another refracta jessie to ascii upgrade and watch what happens. The current one has been through a lot to get where it is.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (sgage) — Fri, 18 Aug 2017 23:15:47 +0000

fungus wrote:

Take a look at the thread I just oppened up. http://dev1galaxy.org/viewtopic.php?id=1555
Both I and fsmithred are running LXDE (if I am not mistaken as mentioned in another thread).
I have also installed eudev in all my installations.
My ascii is an evolution from previous edition of miyo linux.
My ceres is from scratch installation from Devuan 1 Live.
All LXDE.
All LXDE for years if you include Debian as "somehow" related distro.
NOT ONCE, have I run gparted without a password, unless one would consider running from the terminal where sudo was used right before and the session didn't expire. But gparted-pkexec is different from sudo gparted-pkexec in when it will ask for the password.
So what can explain the difference between my and fsmithred's experience

It's a mystery wrapped in an enigma. Or is it the other way around? :-)

BTW, I am running eudev as well, and everything seems to be nominal.

I will check out your new thread...

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fungus) — Fri, 18 Aug 2017 23:04:59 +0000

Take a look at the thread I just oppened up. http://dev1galaxy.org/viewtopic.php?id=1555

Both I and fsmithred are running LXDE (if I am not mistaken as mentioned in another thread).
I have also installed eudev in all my installations.
My ascii is an evolution from previous edition of miyo linux.
My ceres is from scratch installation from Devuan 1 Live.
All LXDE.
All LXDE for years if you include Debian as "somehow" related distro.
NOT ONCE, have I run gparted without a password, unless one would consider running from the terminal where sudo was used right before and the session didn't expire. But gparted-pkexec is different from sudo gparted-pkexec in when it will ask for the password.

So what can explain the difference between my and fsmithred's experience

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (sgage) — Fri, 18 Aug 2017 21:48:34 +0000

Just for the record... I am running Ascii (ugpraded from stock Devuan Jessie months ago), and have no such issue with pkexec.

[Edited to mention that I'm running with MATE.]

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (greenjeans) — Fri, 18 Aug 2017 21:46:29 +0000

Not for nothin', but have you checked /etc/sudoers.d to make sure there's not an entry left from a livecd session that didn't get removed?

Because that will do exactly what you are describing.

Re: [SOLVED] pkexec authenticates without password

dummy@example.com (fsmithred) — Fri, 18 Aug 2017 12:51:33 +0000

nathg,

Thanks for the reminder. I tried replacing mate-polkit with policykit-1-gnome and I get the same behavior. (gparted runs without password).

I tried running without a display manager, and I'm getting inconsistent results. Sometimes I can break it so gparted doesn't run (in terminal it gives me an error message about trying to run it as another user and I don't have permission) and sometimes it does run. And sometimes I end up with no input in console and have to use sysrq keys to reboot.

So far, I have not found the right combination to cause pkexec to ask me for a password. At least not today. I have been asked for a password in terminal a couple days ago.