Debian Bug report logs - #842184
policykit-1: synaptic-pkexec no more work

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Guy Rouger <grandtoubab@msn.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: policykit-1: synaptic-pkexec no more work

Date: Wed, 26 Oct 2016 20:09:03 +0200

Package: policykit-1
Version: 0.105-16
Severity: normal

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
launch Synaptic
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
using menu
   * What was the outcome of this action?
in command line
debian:~$ synaptic-pkexec
..........
polkit-agent-helper-1: error response to PolicyKit daemon:
GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

   * What outcome did you expect instead?
Display of authentification box
*** End of the template - remove these template lines ***



-- System Information:
Debian Release: stretch/sid
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages policykit-1 depends on:
ii  dbus                   1.10.12-1
ii  libc6                  2.24-5
ii  libglib2.0-0           2.50.1-1
ii  libpam-systemd         231-9
ii  libpam0g               1.1.8-3.3
ii  libpolkit-agent-1-0    0.105-16
ii  libpolkit-backend-1-0  0.105-16
ii  libpolkit-gobject-1-0  0.105-16

policykit-1 recommends no packages.

policykit-1 suggests no packages.

-- no debconf information

Message #10 received at 842184@bugs.debian.org (full text, mbox, reply):

From: Grand T <grandtoubab@msn.com>

To: "842184@bugs.debian.org" <842184@bugs.debian.org>

Subject: policykit-1: synaptic-pkexec no more work

Date: Wed, 26 Oct 2016 20:58:48 +0000

[Message part 1 (text/plain, inline)]

guy@debian:~$  synaptic-pkexec
==== AUTHENTICATING FOR com.ubuntu.pkexec.synaptic ===
Authentification is required to run the Synaptic Package Manager
Authenticating as: ,,, (guy)
Password:
polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.
guy@debian:~$

root@debian:/home/guy# tail -f /var/log/auth.log

Oct 26 22:50:27 debian polkitd(authority=local): Registered Authentication Agent for unix-process:5407:332521 (system bus name :1.62 [pkexec /usr/sbin/synaptic], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Oct 26 22:50:36 debian polkitd(authority=local): Operator of unix-process:5407:332521 FAILED to authenticate to gain authorization for action com.ubuntu.pkexec.synaptic for unix-process:5407:332521 [/bin/sh /usr/bin/synaptic-pkexec] (owned by unix-user:guy)
Oct 26 22:50:36 debian pkexec[5408]: guy: Error executing command as another user: Not authorized [USER=root] [TTY=/dev/pts/2] [CWD=/home/guy] [COMMAND=/usr/sbin/synaptic]
Oct 26 22:50:36 debian polkitd(authority=local): Unregistered Authentication Agent for unix-process:5407:332521 (system bus name :1.62, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)


root@debian:/home/guy# locale
LANG=fr_FR.UTF-8
LANGUAGE=
LC_CTYPE="fr_FR.UTF-8"
LC_NUMERIC="fr_FR.UTF-8"
LC_TIME="fr_FR.UTF-8"
LC_COLLATE="fr_FR.UTF-8"
LC_MONETARY="fr_FR.UTF-8"
LC_MESSAGES="fr_FR.UTF-8"
LC_PAPER="fr_FR.UTF-8"
LC_NAME="fr_FR.UTF-8"
LC_ADDRESS="fr_FR.UTF-8"
LC_TELEPHONE="fr_FR.UTF-8"
LC_MEASUREMENT="fr_FR.UTF-8"
LC_IDENTIFICATION="fr_FR.UTF-8"
LC_ALL=
root@debian:/home/guy#

[Message part 2 (text/html, inline)]

Message #15 received at 842184@bugs.debian.org (full text, mbox, reply):

From: Grand T <grandtoubab@msn.com>

To: "842184@bugs.debian.org" <842184@bugs.debian.org>

Subject: policykit-1: synaptic-pkexec no more work

Date: Thu, 27 Oct 2016 07:27:05 +0000

[Message part 1 (text/plain, inline)]

The error is in  policykit-1-gnome 0.105-4


 /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop refer to

Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1

but it don't exist so it is not started !

The exec is now at/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1

I modified

/etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop to set up
Exec=/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1

[Message part 2 (text/html, inline)]

Message #28 received at 842184@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Grand T <grandtoubab@msn.com>, 842184@bugs.debian.org

Cc: Brian Vaughan <bgvaughan@gmail.com>, 841878@bugs.debian.org, policykit-1-gnome@packages.debian.org

Subject: Re: Bug#842184: policykit-1: synaptic-pkexec no more work

Date: Thu, 27 Oct 2016 10:00:15 +0100

Control: reassign 842184 policykit-1-gnome 0.105-4
Control: severity 842184 serious

On Thu, 27 Oct 2016 at 07:27:05 +0000, Grand T wrote:
> The error is in  policykit-1-gnome 0.105-4
> 
>  /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop refer to 
> 
> Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
> 
> but it don't exist so it is not started !
> 
> The exec is now at/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
> 
> I modified 
> 
> /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop to set up
> Exec=/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1

Good catch! It looks as though this was caused by modernizing the
packaging of policykit-1-gnome from debhelper 8 to 10, which changed its
${libexecdir}, without also updating
debian/polkit-gnome-authentication-agent-1.desktop to use the new
value of ${libexecdir}.

So this is not actually a policykit-1 bug, but rather policykit-1-gnome,
which is a separate source package. Contrary to its name, pk-1-gnome
is not actually used in "full" GNOME any more (because GNOME Shell has
its own built-in polkit agent), but it does get used in XFCE, Unity and
GNOME Flashback.

Brian (and anyone else who is seeing #841878), are you using
policykit-1-gnome as your implementation of a polkit agent? If you
run /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
"by hand" from a terminal, does authentication work normally for you?

(If you have edited /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop
as a workaround, you will probably need to edit it again, or go back to
the version provided by the package maintainer, after this bug is fixed -
we will probably choose a different location for the authentication agent,
or go back to its old location, because the architecture-dependent path is
awkward to use in the packaging.)

Thanks,
    S

Message #33 received at 842184@bugs.debian.org (full text, mbox, reply):

From: KeyofBlueS <keyofblues@gmail.com>

To: 842184@bugs.debian.org

Subject: Re: Bug#842184: policykit-1: synaptic-pkexec no more work

Date: Thu, 27 Oct 2016 12:11:20 +0200

[Message part 1 (text/plain, inline)]

I am on Xfce so yes, using policykit-1-gnome here. And again yes, after
running /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1 from
a terminal, authentication works fine.

Good job!
Thanks

2016-10-27 11:00 GMT+02:00 Simon McVittie <smcv@debian.org>:

> Control: reassign 842184 policykit-1-gnome 0.105-4
> Control: severity 842184 serious
>
> On Thu, 27 Oct 2016 at 07:27:05 +0000, Grand T wrote:
> > The error is in  policykit-1-gnome 0.105-4
> >
> >  /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop refer to
> >
> > Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
> >
> > but it don't exist so it is not started !
> >
> > The exec is now at/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-
> agent-1
> >
> > I modified
> >
> > /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop to set up
> > Exec=/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
>
> Good catch! It looks as though this was caused by modernizing the
> packaging of policykit-1-gnome from debhelper 8 to 10, which changed its
> ${libexecdir}, without also updating
> debian/polkit-gnome-authentication-agent-1.desktop to use the new
> value of ${libexecdir}.
>
> So this is not actually a policykit-1 bug, but rather policykit-1-gnome,
> which is a separate source package. Contrary to its name, pk-1-gnome
> is not actually used in "full" GNOME any more (because GNOME Shell has
> its own built-in polkit agent), but it does get used in XFCE, Unity and
> GNOME Flashback.
>
> Brian (and anyone else who is seeing #841878), are you using
> policykit-1-gnome as your implementation of a polkit agent? If you
> run /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
> "by hand" from a terminal, does authentication work normally for you?
>
> (If you have edited /etc/xdg/autostart/polkit-
> gnome-authentication-agent-1.desktop
> as a workaround, you will probably need to edit it again, or go back to
> the version provided by the package maintainer, after this bug is fixed -
> we will probably choose a different location for the authentication agent,
> or go back to its old location, because the architecture-dependent path is
> awkward to use in the packaging.)
>
> Thanks,
>     S
>

[Message part 2 (text/html, inline)]

Message #38 received at 842184-close@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 842184-close@bugs.debian.org

Subject: Bug#842184: fixed in policykit-1-gnome 0.105-5

Date: Thu, 27 Oct 2016 11:22:31 +0000

Source: policykit-1-gnome
Source-Version: 0.105-5

We believe that the bug you reported is fixed in the latest version of
policykit-1-gnome, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 842184@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated policykit-1-gnome package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 27 Oct 2016 11:40:20 +0100
Source: policykit-1-gnome
Binary: policykit-1-gnome
Architecture: source
Version: 0.105-5
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 policykit-1-gnome - XFCE and Unity authentication agent for PolicyKit-1
Closes: 823948 842184
Changes:
 policykit-1-gnome (0.105-5) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Dmitry Shachnev ]
   * Remove GNOME from OnlyShowIn list. This authentication agent is not
     needed in GNOME Classic or GNOME Flashback sessions too.
     Closes: #823948.
 .
   [ Simon McVittie ]
   * Set ${libexecdir} to /usr/lib to avoid architecture-dependent
     installation paths which would require us to generate
     a different debian/polkit-gnome-authentication-agent-1.desktop per
     architecture.
     - Using a new ${libexecdir}, instead of reverting to the subdirectory
       used by debhelper 8, ensures that users who have worked around
       #842184 by editing the autostart desktop file will get a conffile
       prompt reminding them to return to the package maintainer's version.
   * Update debian/polkit-gnome-authentication-agent-1.desktop for the new
     ${libexecdir}, fixing a regression in 0.105-4 that caused the agent to
     not get launched in XFCE or Unity as intended. (Closes: #842184)
   * Mark policykit-1-gnome as Multi-arch: foreign. Its only API is via
     D-Bus and is cross-architecture.
   * Rewrite Description to say that despite its name, GNOME does not
     use this (but XFCE and Unity do).
Checksums-Sha1:
 e00d9572e2ffbd17a5db3753b4d54878f9dee297 2206 policykit-1-gnome_0.105-5.dsc
 7ec4bde1c9535fb1a718c14328a73bf261e68c54 8232 policykit-1-gnome_0.105-5.debian.tar.xz
Checksums-Sha256:
 4a06f9bbc2287bf1ffc7c93653579bef34ce8f3150ef37611ef0974b68d3e080 2206 policykit-1-gnome_0.105-5.dsc
 d781ea10cb9f252b4c3a742c94613daf2051c52d6a3af78beb15623eee12b965 8232 policykit-1-gnome_0.105-5.debian.tar.xz
Files:
 62a6ac3b2c85810a305961c2ca46169f 2206 gnome optional policykit-1-gnome_0.105-5.dsc
 ab87402c0ff4d38509e272a137fca9cc 8232 gnome optional policykit-1-gnome_0.105-5.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCAAGBQJYEdqqAAoJEE3o/ypjx8yQ7/QP/1bjx9SHI84f84900YqRQgcv
89/Z8YVVPac6K2xTILE4/BOU1Am0pZ680Btfa0E3CzIcZ3Dj/qrFmSLZJk2lBuXj
ITfY2X3evuRMEw66kJya9U5BtBybA5ujZRMOlYzpgN5oV5MJpqEqq2JzmLbLL6Kv
Q+4s4OdpEsl8U52yR7aJRc1Qb/OqBtIAOkq08fJFVQySQOvnL5jy6ZrovEF0h+ZD
v3VhIpfFrcO1yi9yG3m2TJqCU/qhJrbYG2J+VszykyN9m7R1Wn2uM/lb2WBiSx67
yahStMy99m+DOrexVIgtkmQpKNWRrbYER8a/wVT9nljZ8sFS8kW5pUKbMFs0V/jL
MZy57W0jTmbkKhRuZ+dIJUaKEYJMPtk1cJfubMgQhlNoEOvlX95uecjs+tggkgkN
DT7MaM2A+DVcITGxArp8u+060ZT5jO3GslHlayz28WYp+zESGP7LJjJHD7a5vjI7
mBD2/XsG7cfqZM6hkF0crKk2gDrlF0ikTPqvNYXsUA73514vNs2DlzLV7xpRpuU/
9kL/GVb003+JeKyLzLbw1AuU/jPpMsJRoI6uv78FjNsHQVW2CJBRHAivGuZEhkG3
5krIPXFlVa0K9eoO+wTlEtbapPmPe20ljIy161yos/tG31DncJUHHwZYjB23ror0
MhthZ1Rrt9LAUxkrtI8C
=xB7R
-----END PGP SIGNATURE-----

Message #43 received at 842184@bugs.debian.org (full text, mbox, reply):

From: Brian Vaughan <bgvaughan@gmail.com>

To: 842184@bugs.debian.org

Cc: policykit-1-gnome@packages.debian.org, 841878@bugs.debian.org, Grand T <grandtoubab@msn.com>

Subject: Re: Bug#842184: policykit-1: synaptic-pkexec no more work

Date: Thu, 27 Oct 2016 11:00:06 -0700

[Message part 1 (text/plain, inline)]

I can confirm that:

A) Executing
'/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1' on the
command line enabled the expected dialog for launching Synaptic from XFCE;

B) The issue has been resolved with policykit-1-gnome 0.105-5.

Thank you.

On Oct 27, 2016 2:00 AM, "Simon McVittie" <smcv@debian.org> wrote:

> Control: reassign 842184 policykit-1-gnome 0.105-4
> Control: severity 842184 serious
>
> On Thu, 27 Oct 2016 at 07:27:05 +0000, Grand T wrote:
> > The error is in  policykit-1-gnome 0.105-4
> >
> >  /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop refer to
> >
> > Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
> >
> > but it don't exist so it is not started !
> >
> > The exec is now at/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-
> agent-1
> >
> > I modified
> >
> > /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop to set up
> > Exec=/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
>
> Good catch! It looks as though this was caused by modernizing the
> packaging of policykit-1-gnome from debhelper 8 to 10, which changed its
> ${libexecdir}, without also updating
> debian/polkit-gnome-authentication-agent-1.desktop to use the new
> value of ${libexecdir}.
>
> So this is not actually a policykit-1 bug, but rather policykit-1-gnome,
> which is a separate source package. Contrary to its name, pk-1-gnome
> is not actually used in "full" GNOME any more (because GNOME Shell has
> its own built-in polkit agent), but it does get used in XFCE, Unity and
> GNOME Flashback.
>
> Brian (and anyone else who is seeing #841878), are you using
> policykit-1-gnome as your implementation of a polkit agent? If you
> run /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
> "by hand" from a terminal, does authentication work normally for you?
>
> (If you have edited /etc/xdg/autostart/polkit-
> gnome-authentication-agent-1.desktop
> as a workaround, you will probably need to edit it again, or go back to
> the version provided by the package maintainer, after this bug is fixed -
> we will probably choose a different location for the authentication agent,
> or go back to its old location, because the architecture-dependent path is
> awkward to use in the packaging.)
>
> Thanks,
>     S
>

[Message part 2 (text/html, inline)]

Message #48 received at 842184@bugs.debian.org (full text, mbox, reply):

From: "Sven C. Dack" <sven.c.dack@sky.com>

To: 842184@bugs.debian.org

Subject: Re: Bug#842184: policykit-1: synaptic-pkexec no more work

Date: Tue, 1 Nov 2016 10:11:19 +0000

On Thu, 27 Oct 2016 12:11:20 +0200 KeyofBlueS <keyofblues@gmail.com> wrote:
> I am on Xfce so yes, using policykit-1-gnome here. And again yes, after
> running /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1 from
> a terminal, authentication works fine.
>
> Good job!
> Thanks
>
> 2016-10-27 11:00 GMT+02:00 Simon McVittie <smcv@debian.org>:
>
> > Control: reassign 842184 policykit-1-gnome 0.105-4
> > Control: severity 842184 serious
> >
> > On Thu, 27 Oct 2016 at 07:27:05 +0000, Grand T wrote:
> > > The error is in policykit-1-gnome 0.105-4
> > >
> > > /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop refer to
> > >
> > > Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
> > >
> > > but it don't exist so it is not started !
> > >
> > > The exec is now at/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-
> > agent-1
> > >
> > > I modified
> > >
> > > /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop to set up
> > > Exec=/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
> >
> > Good catch! It looks as though this was caused by modernizing the
> > packaging of policykit-1-gnome from debhelper 8 to 10, which changed its
> > ${libexecdir}, without also updating
> > debian/polkit-gnome-authentication-agent-1.desktop to use the new
> > value of ${libexecdir}.
> >
> > So this is not actually a policykit-1 bug, but rather policykit-1-gnome,
> > which is a separate source package. Contrary to its name, pk-1-gnome
> > is not actually used in "full" GNOME any more (because GNOME Shell has
> > its own built-in polkit agent), but it does get used in XFCE, Unity and
> > GNOME Flashback.
> >
> > Brian (and anyone else who is seeing #841878), are you using
> > policykit-1-gnome as your implementation of a polkit agent? If you
> > run /usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1
> > "by hand" from a terminal, does authentication work normally for you?
> >
> > (If you have edited /etc/xdg/autostart/polkit-
> > gnome-authentication-agent-1.desktop
> > as a workaround, you will probably need to edit it again, or go back to
> > the version provided by the package maintainer, after this bug is fixed -
> > we will probably choose a different location for the authentication agent,
> > or go back to its old location, because the architecture-dependent path is
> > awkward to use in the packaging.)
> >
> > Thanks,
> > S
> >

Safest and easiest work-around is probably the following:

1. In Xfce4 open the menu "Settings" -> "Session and Startup" and select the tab 
"Application Autostart".
2. There scroll to "PolicyKit Authentication Agent" and disable it.
3. Add a new entry with the "+ Add" button with a name like "Polkit Work-Around" 
and the command "/usr/lib/x86_64-linux-gnu/polkit-gnome-authentication-agent-1"
4. Click "Ok" and "Close".

So basically does one disable the default auto-start of the currently broken 
service and replaces it with a private service to start it manually, which can 
later be removed easily once it's been properly fixed.

Also note that not only synaptic seems to be affected, but gparted as well and 
also the gvfs samba plugin for the file manager for browsing Windows shares on 
the LAN needs this, too, and currently fails as well. There will likely be a few 
more.

Sven

Send a report that this bug log contains spam.