[org.freedesktop.Accounts.Error.PermissionDenied: Not authorized] While trying to change a ringtone

[Omer Akram]

On my Ubuntu phone, I am trying to write an integration test which involves backing up the old ringtone value and then restoring it. The backup works fine but when I try to write the value it gives:

phablet@ubuntu-phablet:~$ ./accounts_service_issue.py
Current ringtone: Ubuntu.ogg
Trying to set to: Supreme.ogg
Traceback (most recent call last):
  File "./accounts_service_issue.py", line 47, in <module>
    set_ringtone()
  File "./accounts_service_issue.py", line 23, in set_ringtone
    new_ringtone)
  File "/usr/lib/python3/dist-packages/dbus/proxies.py", line 70, in __call__
    return self._proxy_method(*args, **keywords)
  File "/usr/lib/python3/dist-packages/dbus/proxies.py", line 145, in __call__
    **keywords)
  File "/usr/lib/python3/dist-packages/dbus/connection.py", line 651, in call_blocking
    message, timeout)
dbus.exceptions.DBusException: org.freedesktop.Accounts.Error.PermissionDenied: Not authorized

Not really sure whats happening there, any help is appreciated.

ProblemType: Bug
DistroRelease: Ubuntu 14.10
Package: ubuntu-system-settings 0.3+14.10.20140714-0ubuntu2
ProcVersionSignature: Ubuntu 3.15.0-6.11-generic 3.15.0
Uname: Linux 3.15.0-6-generic x86_64
ApportVersion: 2.14.4-0ubuntu2
Architecture: amd64
CurrentDesktop: Unity
Date: Tue Jul 29 17:19:22 2014
InstallationDate: Installed on 2014-06-14 (44 days ago)
InstallationMedia: Ubuntu 14.10 "Utopic Unicorn" - Alpha amd64 (20140610.1)
SourcePackage: ubuntu-system-settings
UpgradeStatus: No upgrade log present (probably fresh install)

[Omer Akram (om26er)]

Also attached accounts_service_issue.py as a test case to reproduce the issue on the phone.

[Iain Lane (laney)]

On Tue, Jul 29, 2014 at 12:22:39PM -0000, Omer Akram wrote:
> Public bug reported:
>
> On my Ubuntu phone, I am trying to write an integration test which
> involves backing up the old ringtone value and then restoring it. The
> backup works fine but when I try to write the value it gives:
>
> phablet@ubuntu-phablet:~$ ./accounts_service_issue.py

Try running it from the terminal app on the phone.

--
Iain Lane [ <email address hidden> ]
Debian Developer [ <email address hidden> ]
Ubuntu Developer [ <email address hidden> ]

[Omer Akram (om26er)]

As discussed over IRC it works fine if ran from phone's terminal.

Since these tests need to run over adb we need to find a way around that, do you have any clues on how I might be able to work/hack around that ? Even some hints will be welcome.

[Martin Pitt (pitti)]

Supposedly this needs the "org.freedesktop.accounts.change-own-user-data" privilege from /usr/share/polkit-1/actions/org.freedesktop.accounts.policy . The problem with calling this in phablet-shell is that this isn't a local active session:

phablet@ubuntu-phablet:~$ pkcheck --action-id org.freedesktop.accounts.change-own-user-data --process $$
Not authorized.

So you need to run this as part of an autopilot test which will be run in the actual unity session, not a remote ssh session.

For testing this quickly, you can of course also change this temporarily (set <allow_any>yes</allow_any> in the .policy file above)

[Martin Pitt (pitti)]

By the way, this is not a bug, but an intended security policy.

[Omer Akram (om26er)]

Backported a fix from upstream which allows us to write to accountsservice over ssh. previously it was desktop-centric.

[Dimitri John Ledkov (xnox)]

Pitti, looks like upstream has relaxed policy a bit in the current trunk. Would you review this proposed backport?

Regards,
Dimitri.

[Martin Pitt (pitti)]

LGTM, thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 0.6.37-1ubuntu7

---------------
accountsservice (0.6.37-1ubuntu7) utopic; urgency=medium

  * debian/patches/0022-fix-desktop-centric-polkit-policy.patch:
    - Change the polkit policy so accountsservice allows use of the
      DBus API by admin users that are not logged in via a monitor+keyboard.
      This includes users logged in via ssh. (LP: #1349813)
 -- Omer Akram <email address hidden> Wed, 30 Jul 2014 10:24:09 -0500