PolicyKit / polkit in openSUSE : problem with configuration files

rrije · 04-14-2011, 11:11 AM

Hi,

after a recent update my policykit permissions stopped working, and I can't understand why.
An example: mounting a flash drive requires password, hinting on org.freedesktop.udisks.filesystem-mount. /usr/share/polkit-1/actions/org.freedesktop.udisks.policy has the following:

Code:

<action id="org.freedesktop.udisks.filesystem-mount">
    <description>Mount a device</description>
    <message>Authentication is required to mount the device</message>
    <defaults>
      <allow_any>yes</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

It is correct, right? So WTF prevents the policy from working? Is there some other config file which takes precedence?

Same thing happens when rebooting / shutting down, etc.

There is also this confusing thing about polkit-1 and "old" PolicyKit, but as far as I can tell, they manage different actions and shouldn't be the source of the problem.

What can be the source of the problem? Thanks in advance.

andrewthomas · 04-15-2011, 07:51 AM

You really shouldn't edit anything in /usr/share/polkit-1, since it will be overwritten on updates.

What you need to do is add a /etc/polkit-1/localauthority.conf.d/60-localauthority.conf file with

Code:

[Configuration]
AdminIdentities=unix-group:wheel

if you want to grant the rights to an entire group, wheel in this case or

Code:

[Configuration]
AdminIdentities=unix-user:username

to grant rights to a specific user
and then an /etc/polkit-1/localauthority/50-local.d/my-polkit-udisks.pkla file containing

Code:

[udisks full access]
Identity=unix-group:wheel[/B]
Action=org.freedesktop.udisks.*
ResultActive=yes

[Change CPU Frequency scaling]
Identity=unix-group:wheel
Action=org.gnome.cpufreqselector
ResultActive=yes

or for your user

Code:

[udisks full access]
Identity=unix-user:username
Action=org.freedesktop.udisks.*
ResultActive=yes

[Change CPU Frequency scaling]
Identity=unix-user:username
Action=org.gnome.cpufreqselector
ResultActive=yes

allowing any rules thay you want

rrije · 04-17-2011, 07:19 AM

Thanks for the reply,

I've created /etc/polkit-1/localauthority dir, copied /var/lib/polkit-1/localauthority/10-vendor.d there (to have a reference) and created /etc/polkit-1/localauthority/50-local.d, where I put two files: /etc/polkit-1/localauthority/50-local.d/org.freedesktop.hal.power-management.pkla and /etc/polkit-1/localauthority/50-local.d/org.freedesktop.udisks.pkla, containing the following:

Code:

[power management]
Identity=unix-group:*
Action=org.freedesktop.hal.power-management.*
ResultActive=yes

Code:

[org.freedesktop.udisks.filesystem-mount]
Identity=unix-group:*
Action=org.freedesktop.udisks.*
ResultActive=yes

It didn't help. Trying to reboot still gives this warning on the bottom of the menu: org.freedesktop.hal.power-management.reboot auth_admin_keep_always <-- (action, result). Trying to suspend or hibernate shows an authentication prompt for a second, then screensaver kicks in and locks the screen.
Same with removable media: no automount, mounting requires root, and now devices don't even show in thunar's sidebar (it used to draw them half-transparent, so you could click and mount them automatically).

I looked through the .pkla files and have not found any entries that have "auth_admin_keep_always" string. Neither is it present in /usr/share/polkit-1/action policies, which makes me wonder if there are still some other config files overriding customized policies… according to pklocalauthority manual this shouldn't be the case.

andrewthomas · 04-17-2011, 07:47 AM

Quote:

Originally Posted by andrewthomas

You really shouldn't edit anything in /usr/share/polkit-1, since it will be overwritten on updates.

What you need to do is add a /etc/polkit-1/localauthority.conf.d/60-localauthority.conf file with

Code:

[Configuration]
AdminIdentities=unix-group:wheel

if you want to grant the rights to an entire group, wheel in this case or

Code:

[Configuration]
AdminIdentities=unix-user:username

to grant rights to a specific user

Did you set AdminIdentities in /etc/polkit-1/localauthority.conf.d/60-localauthority.conf?

rrije · 04-17-2011, 03:53 PM

Yes, these are the lines inside /etc/polkit-1/localauthority.conf.d/60-localauthority.conf:

Code:

[Configuration]
AdminIdentities=unix-user:rrije

Doesn't help.

andrewthomas · 04-23-2011, 09:33 PM

Quote:

Originally Posted by rrije

I looked through the .pkla files and have not found any entries that have "auth_admin_keep_always" string. Neither is it present in /usr/share/polkit-1/action policies, which makes me wonder if there are still some other config files overriding customized policies… according to pklocalauthority manual this shouldn't be the case.

You could look for a overriding file in /etc/polkit-1/localauthority.
It would have to be >50 to override. For example any file in 90-mandatory.d ( if you have it.)

Otherwise I can't see why this is not working, although I do not have hal on my systems any more.
Try using an actual group name instead of *, maybe power.