Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Hi Maxy, Am 2017-04-06 um 19:24 schrieb Maximiliano Curia: > El 2017-03-31 a las 21:25 +0200, Willi Mann escribió: >> Am 2017-03-31 um 18:25 schrieb Maximiliano Curia: > >>> Do you have another session started as root? Do you have another X >>> session started with your user? > >> There is no other session running as root, except for an SSH session. >> And I have no keyboard or mouse attached to this machine, I'm using >> synergy instead. > > I've seen synergy do some weird things, but somehow I don't think we can > blame synergy here. Just to make sure, I tried it with a keyboard connected and synergy not started. Does not change anything. Bye Willi
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Control: tag -1 + help ¡Hola Willi! El 2017-03-31 a las 21:25 +0200, Willi Mann escribió: Am 2017-03-31 um 18:25 schrieb Maximiliano Curia: Do you have another session started as root? Do you have another X session started with your user? There is no other session running as root, except for an SSH session. And I have no keyboard or mouse attached to this machine, I'm using synergy instead. I've seen synergy do some weird things, but somehow I don't think we can blame synergy here. I used the gnome one. pkexec bash then works. However, the problem with configuring sddm persists - it still says I'm not allowed to save the configuration. We have two different issues here, or something causing two effects, one is that the kde agent is not showing any dialogs to you, btw, you didn't mention if pkexec bash showed a gnome polkit agent dialog asking you for your password (or the one from root). The second issue is the sddm kcm not wanting to save the configuration even when it's authorized to do so. This is weird, and I'm not sure what could be causing this. Apart from that, I made another strange observation: If I recompile policykit-1=0.105-17 (directly on the system, without clean chroot) and install it and the KDE policykit agent is running, pkexec bash does ask for a password on the command line: % pkexec bash AUTHENTICATING FOR org.freedesktop.policykit.exec === Authentication is needed to run `/bin/bash' as the super user Authenticating as: root Password: polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie AUTHENTICATION FAILED === Error executing command as another user: Not authorized This incident has been reported. The password was correct, but it fails on some other issue. The dependencies of the two package versions are the same. ldd also reports no differences on the polkitd and pkexec binaries' dependencies. This is sort of expected, the agent needs to register to running polkit, if you restart policykit, you need to restart the agent. About the tty agent not taking your password, I see the same behavior here, that's a bug in policykit, but I don't think it to be related. Happy hacking, -- "The cheapest, fastest and most reliable components of a computer system are those that aren't there." -- Gordon Bell Saludos /\/\ /\ >< `/ signature.asc Description: PGP signature
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Hi Maxy, Am 2017-03-31 um 18:25 schrieb Maximiliano Curia: > >> in the SDDM settings window, it tells me the same as when I try it as >> ordinary user (I'm not allowed to save the configuration, transl. from >> German). > >>> The changes made as root weren't applied to the /etc/sddm.conf file? > >> Unfortunately not. > > As mentioned writting this change as root don't need an interaction with > the agent so this should work, otherwise it's policykit at fault, not > the agent. (also, you don't have an agent running as root). > > Mmh, are you using apparmor with a particular configuration? no, apparmor is not installed. > > Do you have another session started as root? > Do you have another X session started with your user? There is no other session running as root, except for an SSH session. And I have no keyboard or mouse attached to this machine, I'm using synergy instead. >>> (assuming that you tested this with the sddm kcm) > > Do you have the polkit-kde-authentication-agent-1 service running? > I have such a process running, under the desktop's user uid. > > Well, any agent should be replaceable, you can kill it and start a > different one, let's say lxqt-policykit's lxqt-policykit-agent. > > You can test this with pkexec bash to avoid mudding the test with the > kcm authhelper, if it works with lxqt-policykit-agent then the issue is > in the kde agent, otherwise, please reassign the issue to policykit-1 I used the gnome one. pkexec bash then works. However, the problem with configuring sddm persists - it still says I'm not allowed to save the configuration. Apart from that, I made another strange observation: If I recompile policykit-1=0.105-17 (directly on the system, without clean chroot) and install it and the KDE policykit agent is running, pkexec bash does ask for a password on the command line: % pkexec bash AUTHENTICATING FOR org.freedesktop.policykit.exec === Authentication is needed to run `/bin/bash' as the super user Authenticating as: root Password: polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie AUTHENTICATION FAILED === Error executing command as another user: Not authorized This incident has been reported. The password was correct, but it fails on some other issue. The dependencies of the two package versions are the same. ldd also reports no differences on the polkitd and pkexec binaries' dependencies. thanks Willi
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
¡Hola Willi! El 2017-03-23 a las 18:45 +0100, Willi Mann escribió: % su # export $(dbus-launch) # systemsettings5 in the SDDM settings window, it tells me the same as when I try it as ordinary user (I'm not allowed to save the configuration, transl. from German). The changes made as root weren't applied to the /etc/sddm.conf file? Unfortunately not. As mentioned writting this change as root don't need an interaction with the agent so this should work, otherwise it's policykit at fault, not the agent. (also, you don't have an agent running as root). Mmh, are you using apparmor with a particular configuration? Do you have another session started as root? Do you have another X session started with your user? (assuming that you tested this with the sddm kcm) Do you have the polkit-kde-authentication-agent-1 service running? I have such a process running, under the desktop's user uid. Well, any agent should be replaceable, you can kill it and start a different one, let's say lxqt-policykit's lxqt-policykit-agent. You can test this with pkexec bash to avoid mudding the test with the kcm authhelper, if it works with lxqt-policykit-agent then the issue is in the kde agent, otherwise, please reassign the issue to policykit-1 Happy hacking, -- "The first 90% of the code accounts for the first 90% of the development time. The remaining 10% of the code accounts for the other 90% of the development time." -- Tom Cargill Saludos /\/\ /\ >< `/ signature.asc Description: PGP signature
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Hi Maxy! > El 2017-03-22 a las 19:52 +0100, Willi Mann escribió: >> Am 2017-03-21 um 10:58 schrieb Maximiliano Curia: >>> El 2017-03-20 a las 19:22 +0100, Willi Mann escribió: the problem still exists. Let me know if you any idea how to track this down. > >>> Sorry, I can't reproduce the issue here, the message seems to be >>> related to a rule rejecting the request for your users, (even root?). >>> Do you have a specific policykit setup? > >> I don't have a specific setup. The system runs testing for some years, >> though. So it could be an upgrade bug. The problem also occurs with >> root and a clean account I just created for testing. > > There is something here, as root policykit doesn't need to talk with the > agent, so that rules out polkit-kde-agent-1. The issue should be on the > policykit side. > Just to be sure, how was the root plasma session started? did % su # export $(dbus-launch) # systemsettings5 in the SDDM settings window, it tells me the same as when I try it as ordinary user (I'm not allowed to save the configuration, transl. from German). > The changes made as root weren't applied to the /etc/sddm.conf file? Unfortunately not. > (assuming that you tested this with the sddm kcm) > >>> Do you have the polkit-kde-authentication-agent-1 service running? > >> I have such a process running, under the desktop's user uid. > >>> What's the result of running: pkexec bash in a terminal with your user? > >> This hangs, i.e. it does not return but also does not produce any >> output. However, it works fine when I run "pkexec bash" as root. >> System dbus log during the execution of this command attached. > > pkexec bash as root doesn't need to talk with the agent, so it should > always work. > >> method call time=1490208186.877616 sender=:1.73 -> destination=:1.7 >> serial=9 path=/org/freedesktop/PolicyKit1/Authority; >> interface=org.freedesktop.PolicyKit1.Authority; >> member=CheckAuthorization string "org.freedesktop.policykit.exec" >> array [ dict entry( string "program" string >> "/bin/bash" ) method call time=1490208186.878006 sender=:1.7 -> >> destination=org.freedesktop.DBus serial=139 >> path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; >> member=GetConnectionUnixUser string ":1.73" method return >> time=1490208186.878028 sender=org.freedesktop.DBus -> destination=:1.7 >> serial=78 reply_serial=139 uint32 0 method call >> time=1490208186.878052 sender=:1.7 -> destination=org.freedesktop.DBus >> serial=140 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; >> member=GetConnectionUnixProcessID string ":1.73" method return >> time=1490208186.878076 sender=org.freedesktop.DBus -> destination=:1.7 >> serial=79 reply_serial=140 uint32 2828 method call >> time=1490208186.878100 sender=:1.7 -> destination=:1.42 serial=141 >> path=/org/kde/PolicyKit1/AuthenticationAgent; >> interface=org.freedesktop.PolicyKit1.AuthenticationAgent; >> member=BeginAuthentication string "org.freedesktop.policykit.exec" >> string "Authentication is needed to run `/bin/bash' as the super user" >> string "" array [ dict entry( string >> "polkit.caller-pid" string "2828" ) signal >> time=1490208211.280956 sender=:1.28 -> destination=(null destination) >> serial=41 path=/org/freedesktop/ConsoleKit/Session4; >> interface=org.freedesktop.ConsoleKit.Session; member=IdleHintChanged >> boolean true > > After these the agent request an EnumerateActions and ends up showing > the window, in my test system. This may indicate that the agent is in a > non-responsive state, which somewhat contradicts what's indicated a > couple of paragraphs before. Was this the complete output? Yes, there is nothing more until I hit Ctrl+C to kill the hanging pkexec bash command. > It might be useful to attach an strace to the agent with: > sudo strace -vf -p $(pidof polkit-kde-authentication-agent-1) | tee > /tmp/polkit-agent.log > > or something like that. The generated file would be quite large, with a > lot of noise, so it might be better not to send it to a pastebin like > https://paste.debian.net. The file has 12 KB, so I'm attaching it to this mail. The command I ran was # strace -o /tmp/polkit-agent.log -vf -p $(pidof polkit-kde-authentication-agent-1) I started it before executing pkexec bash and stopped it with Ctrl+C after I Ctrl+Ced the pkexec command. Willi 2523 restart_syscall(<... resuming interrupted restart_syscall ...> 2522 restart_syscall(<... resuming interrupted restart_syscall ...> 2521 ppoll([{fd=13, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}], 3, NULL, NULL, 8 2516 restart_syscall(<... resuming interrupted poll ...> 2483 ppoll([{fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 2, NULL, NULL, 8 2516 <... restart_syscall resumed> ) = 1 2516 recvmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="U\2F\2\370+\24\0\3\0\0\0\0\1\0\0\0\0\1\200\0\0\0\200\0\1\0 \1\4\0\0"..., i
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
¡Hola Willi! El 2017-03-22 a las 19:52 +0100, Willi Mann escribió: Am 2017-03-21 um 10:58 schrieb Maximiliano Curia: El 2017-03-20 a las 19:22 +0100, Willi Mann escribió: the problem still exists. Let me know if you any idea how to track this down. Sorry, I can't reproduce the issue here, the message seems to be related to a rule rejecting the request for your users, (even root?). Do you have a specific policykit setup? I don't have a specific setup. The system runs testing for some years, though. So it could be an upgrade bug. The problem also occurs with root and a clean account I just created for testing. There is something here, as root policykit doesn't need to talk with the agent, so that rules out polkit-kde-agent-1. The issue should be on the policykit side. Just to be sure, how was the root plasma session started? The changes made as root weren't applied to the /etc/sddm.conf file? (assuming that you tested this with the sddm kcm) Do you have the polkit-kde-authentication-agent-1 service running? I have such a process running, under the desktop's user uid. What's the result of running: pkexec bash in a terminal with your user? This hangs, i.e. it does not return but also does not produce any output. However, it works fine when I run "pkexec bash" as root. System dbus log during the execution of this command attached. pkexec bash as root doesn't need to talk with the agent, so it should always work. method call time=1490208186.877616 sender=:1.73 -> destination=:1.7 serial=9 path=/org/freedesktop/PolicyKit1/Authority; interface=org.freedesktop.PolicyKit1.Authority; member=CheckAuthorization string "org.freedesktop.policykit.exec" array [ dict entry( string "program" string "/bin/bash" ) method call time=1490208186.878006 sender=:1.7 -> destination=org.freedesktop.DBus serial=139 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=GetConnectionUnixUser string ":1.73" method return time=1490208186.878028 sender=org.freedesktop.DBus -> destination=:1.7 serial=78 reply_serial=139 uint32 0 method call time=1490208186.878052 sender=:1.7 -> destination=org.freedesktop.DBus serial=140 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=GetConnectionUnixProcessID string ":1.73" method return time=1490208186.878076 sender=org.freedesktop.DBus -> destination=:1.7 serial=79 reply_serial=140 uint32 2828 method call time=1490208186.878100 sender=:1.7 -> destination=:1.42 serial=141 path=/org/kde/PolicyKit1/AuthenticationAgent; interface=org.freedesktop.PolicyKit1.AuthenticationAgent; member=BeginAuthentication string "org.freedesktop.policykit.exec" string "Authentication is needed to run `/bin/bash' as the super user" string "" array [ dict entry( string "polkit.caller-pid" string "2828" ) signal time=1490208211.280956 sender=:1.28 -> destination=(null destination) serial=41 path=/org/freedesktop/ConsoleKit/Session4; interface=org.freedesktop.ConsoleKit.Session; member=IdleHintChanged boolean true After these the agent request an EnumerateActions and ends up showing the window, in my test system. This may indicate that the agent is in a non-responsive state, which somewhat contradicts what's indicated a couple of paragraphs before. Was this the complete output? It might be useful to attach an strace to the agent with: sudo strace -vf -p $(pidof polkit-kde-authentication-agent-1) | tee /tmp/polkit-agent.log or something like that. The generated file would be quite large, with a lot of noise, so it might be better not to send it to a pastebin like https://paste.debian.net. Happy hacking, -- "If you have too many special cases, you are doing it wrong." -- Craig Zarouni Saludos /\/\ /\ >< `/ signature.asc Description: PGP signature
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Control: tag -1 - moreinfo Am 2017-03-21 um 10:58 schrieb Maximiliano Curia: > > ¡Hola Willi! > > El 2017-03-20 a las 19:22 +0100, Willi Mann escribió: >> the problem still exists. Let me know if you any idea how to track >> this down. > > Sorry, I can't reproduce the issue here, the message seems to be related > to a rule rejecting the request for your users, (even root?). Do you have a > specific policykit setup? I don't have a specific setup. The system runs testing for some years, though. So it could be an upgrade bug. The problem also occurs with root and a clean account I just created for testing. > Do you have the polkit-kde-authentication-agent-1 service running? I have such a process running, under the desktop's user uid. > What's the result of running: pkexec bash > in a terminal with your user? This hangs, i.e. it does not return but also does not produce any output. However, it works fine when I run "pkexec bash" as root. System dbus log during the execution of this command attached. Willi method call time=1490208186.836839 sender=:1.73 -> destination=org.freedesktop.DBus serial=1 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=Hello method return time=1490208186.836871 sender=org.freedesktop.DBus -> destination=:1.73 serial=1 reply_serial=1 string ":1.73" signal time=1490208186.836888 sender=org.freedesktop.DBus -> destination=(null destination) serial=29 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=NameOwnerChanged string ":1.73" string "" string ":1.73" signal time=1490208186.836915 sender=org.freedesktop.DBus -> destination=:1.73 serial=2 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=NameAcquired string ":1.73" method call time=1490208186.838139 sender=:1.73 -> destination=org.freedesktop.DBus serial=2 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=AddMatch string "type='signal',sender='org.freedesktop.PolicyKit1',interface='org.freedesktop.DBus.Properties',member='PropertiesChanged',path='/org/freedesktop/PolicyKit1/Authority',arg0='org.freedesktop.PolicyKit1.Authority'" method return time=1490208186.838172 sender=org.freedesktop.DBus -> destination=:1.73 serial=3 reply_serial=2 method call time=1490208186.838225 sender=:1.73 -> destination=org.freedesktop.DBus serial=3 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=AddMatch string "type='signal',sender='org.freedesktop.PolicyKit1',interface='org.freedesktop.PolicyKit1.Authority',path='/org/freedesktop/PolicyKit1/Authority'" method return time=1490208186.838240 sender=org.freedesktop.DBus -> destination=:1.73 serial=4 reply_serial=3 method call time=1490208186.838331 sender=:1.73 -> destination=org.freedesktop.DBus serial=4 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=AddMatch string "type='signal',sender='org.freedesktop.DBus',interface='org.freedesktop.DBus',member='NameOwnerChanged',path='/org/freedesktop/DBus',arg0='org.freedesktop.PolicyKit1'" method return time=1490208186.838345 sender=org.freedesktop.DBus -> destination=:1.73 serial=5 reply_serial=4 method call time=1490208186.838456 sender=:1.73 -> destination=org.freedesktop.DBus serial=5 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=StartServiceByName string "org.freedesktop.PolicyKit1" uint32 0 method return time=1490208186.838475 sender=org.freedesktop.DBus -> destination=:1.73 serial=6 reply_serial=5 uint32 2 method call time=1490208186.840024 sender=:1.73 -> destination=org.freedesktop.DBus serial=6 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=GetNameOwner string "org.freedesktop.PolicyKit1" method return time=1490208186.840063 sender=org.freedesktop.DBus -> destination=:1.73 serial=7 reply_serial=6 string ":1.7" method call time=1490208186.840910 sender=:1.73 -> destination=:1.7 serial=7 path=/org/freedesktop/PolicyKit1/Authority; interface=org.freedesktop.DBus.Properties; member=GetAll string "org.freedesktop.PolicyKit1.Authority" method return time=1490208186.841665 sender=:1.7 -> destination=:1.73 serial=137 reply_serial=7 array [ dict entry( string "BackendName" variant string "local" ) dict entry( string "BackendVersion" variant string "0.105" ) dict entry( string "BackendFeatures" variant uint32 1 ) ] method call time=1490208186.842487 sender=:1.73 -> destination=:1.7 serial=8 path=/org/freedesktop/PolicyKit1/Authority; interface=org.freedesktop.PolicyKit1.Authority; member=EnumerateActions string "" method return time=1490208186.847804 sender=:1.7 -> destination=:1.73 serial=138 reply_serial=8 array [ struct { string "org.freedesktop.timedate1.set-ntp" string "Turn network time synchronization on or off" string "Authentication is required to control whether network time synchronization
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Control: tag -1 + moreinfo ¡Hola Willi! El 2017-03-20 a las 19:22 +0100, Willi Mann escribió: the problem still exists. Let me know if you any idea how to track this down. Sorry, I can't reproduce the issue here, the message seems to be related to a rule rejecting the request for your users, (even root?). Do you have a specific policykit setup? Do you have the polkit-kde-authentication-agent-1 service running? What's the result of running: pkexec bash in a terminal with your user? Happy hacking, -- "If you are in a hole, stop digging." -- The First Rule of Excavation Saludos /\/\ /\ >< `/ signature.asc Description: PGP signature
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Control: reopen -1 Hi Maxy, the problem still exists. Let me know if you any idea how to track this down. Willi Am 2017-03-16 um 20:11 schrieb Maximiliano Curia: > ¡Hola Willi! > > El 2015-08-12 a las 20:11 +0200, Willi Mann escribió: >> Package: kde-config-sddm Version: 4:5.3.2-1 Severity: normal > >> I get the message in the subject when I go to the SDDM config unit. It >> happens both when I go there as ordinary user and as root. Let me know >> whether I can provide further information to resolve this bug. > > Sorry that it took so long to get back to you. > > 4:5.3.2-1 was the release of plasma-desktop that added the runtime > dependency against polkit-kde-agent-1 which in turn is needed for the > kde-config-sddm kcm module to be able to request the permissions. I'm > assuming that the issue was caused by either a partial upgrade or using > the recently installed kde-config-sddm in already running > plasma-desktop. I'll close the issue based on this assumption, please, > if you can still reproduce the issue, reopen this bug. > > Happy hacking,
Bug#795296: "You are not allowed to save the configuration" (both root and ordinary user)
Package: kde-config-sddm Version: 4:5.3.2-1 Severity: normal Hi, I get the message in the subject when I go to the SDDM config unit. It happens both when I go there as ordinary user and as root. Let me know whether I can provide further information to resolve this bug. thanks Willi -- System Information: Debian Release: stretch/sid APT prefers testing APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386, armhf Kernel: Linux 4.0.0-2-amd64 (SMP w/2 CPU cores) Locale: LANG=de_AT.UTF-8, LC_CTYPE=de_AT.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Init: systemd (via /run/systemd/system) Versions of packages kde-config-sddm depends on: ii libc6 2.19-19 ii libkf5auth5 5.12.0-1 ii libkf5configcore5 5.12.0-1 ii libkf5configwidgets5 5.12.0-1 ii libkf5coreaddons5 5.12.0-1 ii libkf5i18n5 5.12.0-1 ii libkf5kiowidgets5 5.12.0-1 ii libqt5core5a 5.4.2+dfsg-5 ii libqt5gui55.4.2+dfsg-5 ii libqt5quickwidgets5 5.4.2-4 ii libqt5widgets55.4.2+dfsg-5 ii libqt5x11extras5 5.4.2-2+b1 ii libstdc++65.1.1-14 ii libx11-6 2:1.6.3-1 ii libxcursor1 1:1.1.14-1+b1 kde-config-sddm recommends no packages. kde-config-sddm suggests no packages. -- no debconf information