policykit-1, polkit, polkitd authentication problems

linijkarz · 2017-06-04 19:31:42

Hello!

I believe I encountered a bug with the policykit-1 package and software provided by it since it was one of the packages that Devuan Team modified to work without systemd. I'm reluctant to file a bug report yet because I want to make sure that it's actually a bug and not me missing a crucial detail.
Symptoms include:

inability to mount external storage like USB flash drive - results in "Not authorized to perform operatons"
inability to run pkexec or any software relying on it like gparted, synaptic, system-config-printer etc.

Running synaptic-pkexec from the commandline gives output:

$ ~ synaptic-pkexec 
==== AUTHENTICATING FOR com.ubuntu.pkexec.synaptic ===
Authentication is required to run the Synaptic Package Manager
Authenticating as: Firstname Lastname,,, (jakub)
polkit-agent-helper-1: wrong number of arguments. This incident has been logged.
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

I get same result when trying to run a command line "pkexec bash".

My /etc/polkit-1/localauthority.conf.d/51-debian-sudo.conf is standard (as shipped with the package) and says

[Configuration]
AdminIdentities=unix-group:sudo

And my user account (jakub) is part of the sudo group (sudo works)

When attempting to run synaptic-pkexec /var/log/auth.log gives:

Jun  4 21:19:26 pi2530 polkitd(authority=local): Registered Authentication Agent for unix-process:19530:2980417 (system bus name :1.85 [pkexec /usr/sbin/synaptic], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Jun  4 21:19:26 pi2530 polkit-agent-helper-1[19534]: inappropriate use of helper, wrong number of arguments [uid=1000]
Jun  4 21:19:26 pi2530 polkitd(authority=local): Operator of unix-process:19530:2980417 FAILED to authenticate to gain authorization for action com.ubuntu.pkexec.synaptic for unix-process:19530:2980417 [/bin/sh /usr/bin/synaptic-pkexec] (owned by unix-user:jakub)
Jun  4 21:19:26 pi2530 pkexec[19531]: jakub: Error executing command as another user: Not authorized [USER=root] [TTY=/dev/pts/5] [CWD=/home/jakub] [COMMAND=/usr/sbin/synaptic]
Jun  4 21:19:26 pi2530 polkitd(authority=local): Unregistered Authentication Agent for unix-process:19530:2980417 (system bus name :1.85, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)

And finally restarting polkitd without the --no-debug flag gives

$ ~ sudo /usr/lib/policykit-1/polkitd --replace
Entering main event loop
Connected to the system bus
Registering null backend at priority -10
Using authority class PolkitBackendLocalAuthority
Acquired the name org.freedesktop.PolicyKit1

There's no further input beyond that. From what i've read online when polkitd starts it's supposed to print debug information including every "local authority storage file" it loads. On my installation, nothing like this happens as if it completely ignored the contents of /etc/polkit-1/localauthority and localauthority.conf.d directories

Tried loading graphical authentication agents to no avail - every one (gnome, lxpolkit and mate-polkit) of them fails as it's unable to find "session PID"

I'm fully aware that this can be temporarily solved by making a custom .pkla file and allowing everyone do everything but I don't think it's a good or secure solution.

Please help.

golinux · 2017-06-04 19:43:01

Have you tried gksu?

linijkarz · 2017-06-04 20:41:24

I do not intend to be mean but how exactly does using gksu solve policykit problems?

golinux · 2017-06-04 20:43:01

It worked for me when policykit was being headstrong. I just hopped on a different horse. Just ignore if you want to solve within policykit. Sorry for the noise.

greenjeans · 2017-06-04 20:56:42

linijkarz wrote:

Hello!
I believe I encountered a bug with the policykit-1 package and software provided by it since it was one of the packages that Devuan Team modified to work without systemd. I'm reluctant to file a bug report yet because I want to make sure that it's actually a bug and not me missing a crucial detail.
Symptoms include:
inability to mount external storage like USB flash drive - results in "Not authorized to perform operatons"
Please help.

For this part at least, I think I would look in /usr/share/polkit-1/actions/*

Might be some settings there that need to change, I know in Openbox I had to mod the udisks2 policy because it didn't want to let me mount other partitions.

linijkarz · 2017-06-04 21:14:17

greenjeans wrote:

Might be some settings there that need to change, I know in Openbox I had to mod the udisks2 policy because it didn't want to let me mount other partitions.

Thank you for mentioning OpenBox, I managed to resolve one half of the problem.
My .xinitrc started openbox-session like this, I basically copypasted what gentoo wiki suggested to do

exec ck-launch-session dbus-launch --sh-syntax --exit-with-session openbox-session

I changed it to

exec dbus-launch --sh-syntax --exit-with-session openbox-session

This operation successfully allowed me to mount, unmount, eject external storage via PCmanFM, I can even format it using gnome-disks no problem.

The policykit-related problem still persists. I am unable to perform authentication as if I wasn't in the sudo group.

fsmithred · 2017-06-04 22:14:15

This works in the full desktop install. My user (named 'user') is not in the sudo group and does not have any sudo privs.
You're probably missing a package or two. I see some hints in the auth.log when I start synaptic. Make sure you have consolekit and libpam-ck-connector. It's possible that you also need libsystemd0 for this to work. I don't know.

Jun  4 22:02:31 user polkitd(authority=local): Operator of unix-session:/org/freedesktop/ConsoleKit/Session1 successfully authenticated as unix-user:root to gain ONE-SHOT authorization for action com.ubuntu.pkexec.synaptic for unix-process:3030:52170 [/bin/sh /usr/bin/synaptic-pkexec] (owned by unix-user:user)
Jun  4 22:02:31 user pkexec: pam_unix(polkit-1:session): session opened for user root by (uid=1000)
Jun  4 22:02:31 user pkexec: pam_ck_connector(polkit-1:session): cannot determine display-device
Jun  4 22:02:31 user pkexec[3031]: user: Executing command [USER=root] [TTY=unknown] [CWD=/home/user] [COMMAND=/usr/sbin/synaptic]

If that's not enough, check the package list for the desktop install. Her'e's the list for the desktop-live which is what you get if you take the default desktop installation from the dvd (plus a few packages to run it live and install it.)
https://files.devuan.org/devuan_jessie/ … e.list.txt

linijkarz · 2017-06-06 15:51:01

Thanks for your input @fsmithred
As You and I can both see, our outputs from auth.log are quite different.

I checked the list you've provided and made a list of packages which come with standard devuan-live system but aren't present on my installation. I'm attaching it because quite frankly I see nothing that could be the culprit but I would be extremely thankful for a second opinion.

alsa-base
b43-fwcutter
colord
cryptsetup
cryptsetup-bin
discover
evince-common
exfalso
exo-utils
firmware-b43-installer
firmware-b43legacy-installer
firmware-bnx2
firmware-bnx2x
firmware-brcm80211
firmware-intelwimax
firmware-libertas
firmware-myricom
firmware-netxen
firmware-qlogic
firmware-ralink
firmware-ti-connectivity
firmware-zd1211
gir1.2-gst-plugins-base-1.0
gir1.2-gstreamer-1.0
gir1.2-keybinder-3.0
gir1.2-wnck-3.0:amd64
gnome-orca
gstreamer0.10-alsa:amd64
gstreamer0.10-plugins-base:amd64
hplip
hyphen-en-us
isolinux
libbasicusageenvironment0
libbrlapi0.6:amd64
libburn4
libdiscid0:amd64
libdiscover2
libdotconf0:amd64
libdvbpsi9:amd64
libevdocument3-4
libevview3-3
libexo-1-0:amd64
libexo-common
libexo-helpers
libflite1:amd64
libfreerdp-cache1.1:amd64
libfreerdp-client1.1:amd64
libfreerdp-codec1.1:amd64
libfreerdp-common1.1.0:amd64
libfreerdp-core1.1:amd64
libfreerdp-crypto1.1:amd64
libfreerdp-gdi1.1:amd64
libfreerdp-locale1.1:amd64
libfreerdp-primitives1.1:amd64
libfreerdp-rail1.1:amd64
libfreerdp-utils1.1:amd64
libgarcon-1-0
libgles1-mesa:amd64
libgpod-common
libgpod4:amd64
libgroupsock1
libgstreamer-plugins-base0.10-0:amd64
libgstreamer0.10-0:amd64
libgusb2:amd64
libical1a
libisoburn1
libisofs6
libjack-jackd2-0:amd64
libjs-underscore
libjte1
libkeybinder-3.0-0:amd64
libkeybinder0
liblouis2:amd64
libpostproc52
libproxy-tools
libsane-hpaio
libsdl-image1.2:amd64
libsgutils2-2
libshine3:amd64
libsonic0:amd64
libthunarx-2-0
libtidy-0.99-0
libusageenvironment1
libvlc5
libvlccore8
libvncclient0:amd64
libvte-common
libvte9
libwinpr-crt0.1:amd64
libwinpr-crypto0.1:amd64
libwinpr-environment0.1:amd64
libwinpr-handle0.1:amd64
libwinpr-heap0.1:amd64
libwinpr-input0.1:amd64
libwinpr-pool0.1:amd64
libwinpr-registry0.1:amd64
libwinpr-rpc0.1:amd64
libwinpr-synch0.1:amd64
libwinpr-thread0.1:amd64
libwinpr-utils0.1:amd64
libwnck-3-0:amd64
libwnck-3-common
libxcb-composite0:amd64
libxcb-xv0:amd64
libxfce4ui-1-0
libxfce4ui-utils
libxfce4util-bin
libxfce4util-common
libxfce4util6
libxfcegui4-4
libxfconf-0-2
libxklavier16
libzvbi-common
libzvbi0:amd64
mousepad
mtools
orage
packagekit
packagekit-tools
popularity-contest
printer-driver-postscript-hp
qtchooser
quodlibet
refractainstaller-base
refractainstaller-gui
refractasnapshot-base
refractasnapshot-gui
ristretto
slim
squashfs-tools
syslinux
syslinux-common
task-desktop
task-xfce-desktop
thunar
thunar-archive-plugin
thunar-volman
va-driver-all:amd64
vdpau-va-driver:amd64
vim
vlc
vlc-nox
vlc-plugin-notify
wicd
wicd-daemon
x11-apps
x11-session-utils
xarchiver
xbrlapi
xfburn
xfce-keyboard-shortcuts
xfce4
xfce4-appfinder
xfce4-artwork
xfce4-clipman
xfce4-clipman-plugin
xfce4-cpufreq-plugin
xfce4-cpugraph-plugin
xfce4-dict
xfce4-diskperf-plugin
xfce4-fsguard-plugin
xfce4-genmon-plugin
xfce4-goodies
xfce4-mixer
xfce4-netload-plugin
xfce4-notes
xfce4-notes-plugin
xfce4-notifyd
xfce4-panel
xfce4-places-plugin
xfce4-power-manager
xfce4-power-manager-plugins
xfce4-quicklauncher-plugin
xfce4-sensors-plugin
xfce4-session
xfce4-settings
xfce4-smartbookmark-plugin
xfce4-systemload-plugin
xfce4-taskmanager
xfce4-terminal
xfce4-verve-plugin
xfce4-wavelan-plugin
xfce4-xkb-plugin
xfconf
xfdesktop4
xorriso
xsane
xsane-common
yad

I also should've mentioned that I tried numerous polkit authentication agents (I'm hoping that I won't be forced to use graphical ones, I would be glad to stick with the CLI-based one that opens in a terminal frankly) and none of them starts successfully.
They all throw an error similar to:

(polkit-mate-authentication-agent-1:4221): polkit-mate-1-WARNING **: Unable to determine the session we are in: No session for pid 4221

polkitd is of course running.

Last edited by linijkarz (2017-06-06 15:51:16)

GNUser · 2017-06-06 16:44:09

I had many problems with polkit (including the USB mount-unmount and "unable to determine the session" issues) when I tried running Devuan Jessie without a display manager. After many hours of troubleshooting and trial-and-error--over several days--I gave up and gave lightdm a shot.

Well, all the problems vanished once lightdm was installed. I feel mildly bad for not actually learning enough about polkit to manually fix the problems, but on the upside I got fully operational and put a stop to my headache and hair loss.

What DE and what (if any) display manager are you using? If you are not currently using a display manager, may I suggest you give lightdm a shot? If it solves your polkit-related problems, you can easily configure lightdm for autologin and it will stay completely out of your way.

Last edited by GNUser (2017-06-06 18:30:35)

linijkarz · 2017-06-06 20:41:21

Thanks for the advice. I followed it despite the fact that using a display manager is less-than-optimal solution.
Unfortunately - didn't work, the result is the same.

At this point I'm 100% sure it's something wrong with my installation.
I think I'll wait it out for the release of Devuan 2.0 and just do a clean installation.
The most important problem (mounting) was already resolved 2 days ago.

But If anyone has any ideas, I will be more than happy to listen.

GNUser · 2017-06-07 03:24:22

Bummer. Sorry to hear. I wish I knew more about polkit so that I could be of more help.

I hope your clean install of 2.0 goes smoother.

nathg · 2017-07-23 15:11:55

Hi all,

At initial stage of my upgraded ascii system I lost ability for mounting other volumes on HDD from thunar, launching synaptic from application menu and may be some CD issue. I have been using gksu and modified fstab ( like old days) for ascii without any hassle.

Recently I upgraded my devuan jessie to ascii and found those problems just after upgrade. Then I found two debian bugs #842184 & #842378. Installed package 'policykit-1-gnome' which was deleted from jessie during upgrade, Now my ascii is soid. Hope may help you.

Regards,

fsmithred · 2017-08-28 00:01:09

I just did an upgrade to ascii, and I was having the opposite problem. Synaptic and gparted would start without asking for a password. Only worked with the primary user. I noticed that policykit-1-gnome had been removed, so I reinstalled it, and now synaptic and gparted won't start for the user. User can still use pkexec to create another user but has to use the full path for the adduser command.

arjan · 2018-02-05 19:41:50

Thanks nathg for mentioning policykit-1-gnome.

I had the problem that I wasn't prompted for root privileges anymore from GUI applications, after upgrading from Devuan Jessie to Ascii. `dpkg -l | grep policykit` said I had policykit-1-gnome installed, but when I tried `apt-get install --reinstall policykit-1-gnome` it actualy fetched and installed the package, so it seems it wasn't installed after all. After a reboot, I am now again prompted for root privileges from GUI applications.

rfgmm · 2018-03-04 08:08:10

after updating today my system started to missbehave like this,

already installed policykit-1-gnome and things still not working.

arjan · 2018-03-07 10:43:29

After a recent update I got the same problem again.

I found this relevant link in the beta release discussion: https://lists.dyne.org/lurker/message/2 … f8.en.html

Geoff 42 · 2018-03-07 15:03:18

I worked around some problems with the little program that Didier Kryn posted on the DNG mailing list. It looks like pkexec, but just runs sudo or udevil. It can be installed into /usr/local/bin. Follow the links for details.

https://dev1galaxy.org/viewtopic.php?pid=7703#p7703

Geoff

GNUser · 2018-03-07 20:12:34

rfgmm, when I installed ascii then mate desktop, I was having similar problems. Polkit was installed but the system would not allow me (as regular user) to mount or unmount usb drives, nor shutdown/reboot using the power button on my taskbar.

For me, the solution was to install these two packages: libpolkit-backend-1-0-elogind libpolkit-gobject-1-0-elogind and reboot.

greenjeans · 2018-03-09 22:29:38

Re-posting what I just posted from another pertinent thread:

I've never had to do anything extensive the times i've had a permission issue with polkit, edit the files in /usr/share/polkit-1/actions/ directly, you can spot the relative entries, it may not be the correct way, but it's quick and it works perfectly. The bolded part on a couple of entries in the udisks2 policy is all it takes.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/Po … config.dtd">
<policyconfig>
<vendor>The udisks Project</vendor>
<vendor_url>http://udisks.freedesktop.org/</vendor_url>
<icon_name>drive-removable-media</icon_name>
<action id="org.freedesktop.udisks2.filesystem-mount">
<description>Mount a filesystem</description>
<message>Authentication is required to mount the filesystem</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>

arjan · 2018-03-10 01:16:07

For me everything's working after following these instructions https://lists.dyne.org/lurker/message/2 … f8.en.html.

I was missing the policykit backend libs, and chose to install the consolekit packages.

The officially official Devuan Forum!

#1 2017-06-04 19:31:42

policykit-1, polkit, polkitd authentication problems

#2 2017-06-04 19:43:01

Re: policykit-1, polkit, polkitd authentication problems

#3 2017-06-04 20:41:24

Re: policykit-1, polkit, polkitd authentication problems

#4 2017-06-04 20:43:01

Re: policykit-1, polkit, polkitd authentication problems

#5 2017-06-04 20:56:42

Re: policykit-1, polkit, polkitd authentication problems

#6 2017-06-04 21:14:17

Re: policykit-1, polkit, polkitd authentication problems

#7 2017-06-04 22:14:15

Re: policykit-1, polkit, polkitd authentication problems

#8 2017-06-06 15:51:01

Re: policykit-1, polkit, polkitd authentication problems

#9 2017-06-06 16:44:09

Re: policykit-1, polkit, polkitd authentication problems

#10 2017-06-06 20:41:21

Re: policykit-1, polkit, polkitd authentication problems

#11 2017-06-07 03:24:22

Re: policykit-1, polkit, polkitd authentication problems

#12 2017-07-23 15:11:55

Re: policykit-1, polkit, polkitd authentication problems

#13 2017-08-28 00:01:09

Re: policykit-1, polkit, polkitd authentication problems

#14 2018-02-05 19:41:50

Re: policykit-1, polkit, polkitd authentication problems

#15 2018-03-04 08:08:10

Re: policykit-1, polkit, polkitd authentication problems

#16 2018-03-07 10:43:29

Re: policykit-1, polkit, polkitd authentication problems

#17 2018-03-07 15:03:18

Re: policykit-1, polkit, polkitd authentication problems

#18 2018-03-07 20:12:34

Re: policykit-1, polkit, polkitd authentication problems

#19 2018-03-09 22:29:38

Re: policykit-1, polkit, polkitd authentication problems

#20 2018-03-10 01:16:07

Re: policykit-1, polkit, polkitd authentication problems

Board footer