users-admin doesn't report error when PolicyKit authentication fails

[Eliah Kagan]

Binary package hint: gnome-system-tools

When I run users-admin (gnome-system-tools package version 2.32.0-0ubuntu1) in natty i386, clicking the "Add", "Delete", and "Advanced Settings" buttons has no effect. Clicking the "Manage Groups" button does bring up the "Groups settings" window.

In the "Groups settings" window, the "Add" and "Delete" buttons have no effect. Clicking the "Properties" button does bring up the Group Properties window for the selected group.

In the Group Properties window, changing the group ID to a number already in use by another group does issue an error, but changing the group ID number to a number not already in use or changing which users are members of the group fail silently (as though the operations had succeeded).

When I run users-admin from a console, it prints this output to the command-line upon launch:

GLib-GIO-Message: Using the 'memory' GSettings backend. Your settings will not be saved or shared with other applications.

(users-admin:1337): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed

Clicking the "Manage Groups" button results in another assertion message being printed (every time it is clicked). Clicking other buttons mentioned above does not result in messages being printed.

When I first experienced this bug, my system suffered from Bug 685349. I had thought that might have been the cause of this bug (though in hindsight I am not sure why I thought that). As a workaround for Bug 685349, I manually changed the value of the gconf2 key /apps/gksu/sudo-mode key from false to true. This fixed my problems elevating privileges to root in other applications, including other gnome-system-tools applications, but it did not appear to have any effect on the behavior of users-admin, including its output to the console. I bring this up to suggest that this bug in users-admin is occurring before any attempt is made to elevate privileges to root (or preventing such an attempt from being made).

(This bug is the "situation" I referred to in Bug 685215 that had led me to try running users-admin as root.)

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: gnome-system-tools 2.32.0-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.37-7.19-generic 2.6.37-rc3
Uname: Linux 2.6.37-7-generic i686
Architecture: i386
Date: Sun Dec 5 13:10:22 2010
ExecutablePath: /usr/bin/users-admin
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha i386 (20101202)
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_US.UTF-8
SourcePackage: gnome-system-tools

[Milan Bouchet-Valat (nalimilan)]

The gksu issue is not related at all, since users-admin doesn't use it (else, that would mean it's running as root).

I suspect no user is shown in the list, or the current user isn't. Is it the case? Can you test that by creating a test user using 'adduser' in a console and check if it's enough?

[Eliah Kagan (degeneracypressure)]

The current user, who happens to be the only user on that system, *is* shown in the list, and is selected. The Add, Delete, and Advanced Settings buttons don't work, and, as I neglected to mention, the "Change..." buttons for the user's full name and account type don't work either. But the "Change..." button for the user's password does work--it brings up the "Change User Password" window, and I am able to change the user's password. I apologize for having forgotten to mention that, as it is probably rather important.

I'm attaching two screenshots. Should I still create a second user?

[Milan Bouchet-Valat (nalimilan)]

So it sounds like a PolicyKit issue. Please run
sudo killall polkitd; sudo /usr/lib/policykit-1/polkitd
start users-admin, and click on a button that doesn't work. Then please attach the output here.

What happens if you run
export PID=`pidof gnome-settings-daemon`
pkcheck --action-id org.freedesktop.systemtoolsbackends.set --allow-user-interaction --process $PID

Also, do you get an error message if you wait for a few minutes without closing users-admin, after clicking on a button?

(No need to create a new user if the current one is shown.)

[Eliah Kagan (degeneracypressure)]

I ran users-admin from a console, clicked "Add", "Delete", and "Advanced Settings" and waited five minutes. During that time, no messages were printed to the command line. I checked that before restarting polkitd and inspecting its output -- did you want me to check and see if polkitd produces additional debug messages during that time, too?

I'm attaching the output of polkitd. For reference, the last message printed before I started users-admin was:

** (polkitd:1592): DEBUG: Added authentication agent for unix-session:/org/freedesktop/ConsoleKit/Session2 at name :1.14 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8

And the "Exiting with code 0" message did not occur during the execution of users-admin; that was from when I terminated polkitd with Ctrl+C after quitting users-admin.

As for running pkcheck on the running instance of gnome-settings-daemon...gnome-settings-daemon is not running (or even installed) on this system. Would that be the cause of the problem? This is a Lubuntu Natty system created by installing lubuntu-desktop on top of a command-line system installed from the Natty Alpha Alternate Install CD, which is probably why it doesn't have gnome-settings-daemon (it doesn't have most components of GNOME).

I didn't figure that was the problem, because I use a Lubuntu desktop on my Maverick amd64 system, and that runs users-admin without any problems. gnome-settings-daemon is installed on that system (because I also have ubuntu-desktop installed there), but it is not running.

[Eliah Kagan (degeneracypressure)]

For clarification: While capturing the output of polkitd, I clicked the "Add" button once, quit users-admin, and then quit polkitd (Ctrl+C).

[Eliah Kagan (degeneracypressure)]

So, I installed gnome-settings-daemon and ran it, and the problem persisted. Furthermore, I have another i386 Natty system that runs a full Ubuntu desktop. On that other system, users-admin works without problems, and gnome-settings-daemon is installed and runs all the time. So I tried killing gnome-settings-daemon on that other system, and users-admin continued to work without problems.

But installing and running gnome-settings-daemon did enable me to complete your instructions. I ran:

export PID=`pidof gnome-settings-daemon`
pkcheck --action-id org.freedesktop.systemtoolsbackends.set --allow-user-interaction --process $PID

The output was "Not authorized."

[Milan Bouchet-Valat (nalimilan)]

Ah, sorry, I didn't know you weren't using GNOME. The gnome-settings-daemon part is not essential at all: the idea was only to use the PID of a process that is known to be running - you can use any program name here.

The polkitd log contains the explanation to your problem:
** (polkitd:1592): DEBUG: subject is in session /org/freedesktop/ConsoleKit/Session2 (local=1 active=0)
Your session is not considered as active. Are you working over VNC or another remote desktop system? This is the usual cause of this issue, there's a bug 187585 about that.

So the current bug is that users-admin doesn't report correctly when authentication couldn't be obtained. The rest is a problem elsewhere. It shouldn't be hard to fix at all, would you try to write a patch? Else I'll try to do it myself, but I'm not making any promise.

[Eliah Kagan (degeneracypressure)]

I should be able to do the patch, but I'd like to take a look at the source and get back to you. You classified the importance as low...is it OK if I take another few days before posting again?

As for why my session is not considered active, I'm not sure. I am not connecting remotely. The system where I'm experiencing the problem is a VMware virtual machine (created by installing lubuntu-desktop onto a Natty Alpha 1 command-line system). But I have another natty virtual machine (where I installed ubuntu-desktop and then lubuntu-desktop onto a Natty Alpha 1 command-line system), and it does not have the problem. Both machines have the same version of the VMware drivers installed. I'll look through policykit's listed bugs to see if my situation is documented.

Speaking of Lubuntu: I noticed that, unlike ubuntu-desktop, the lubuntu-desktop metapackage has not removed gnome-system-tools as a dependency in natty (http://packages.ubuntu.com/natty/lubuntu-desktop). Lubuntu is not an one of Canonical's official Ubuntu derivatives, so arguably this is not a compelling reason to consider users-admin "not phased out" as of natty. But it has occurred to me that unless the Lubuntu project is planning to replace gnome-system-tools with something else, a number of users might continue relying on users-admin for some time.

[Milan Bouchet-Valat (nalimilan)]

Don't worry for the delays... some bugs are opened for years, often with a higher priority! As regards the active/inactive issue, that would likely be a bug in ConsoleKit.

users-admin is not going away today nor in the next year, else I wouldn't even reply to bug reports. It's just that I don't plan to work on relatively complex things, or in very minor improvements, since we'd better improve the new tool. But patches are accepted of course!

[Jay Goldberg (jaymgoldberg)]

This issue also affects the LTSP project. If you are logged into a thin client using LDM (LTSP Display Manager), the buttons Add, Delete, Advanced Settings do not work in users-admin.

[ԜаӀtеr Ⅼарсһуnѕkі (wxl)]

I cannot replicate this in Bionic, at least if I understand the steps to reproduce correctly. If this is still valid in Bionic, please re-write the description with clear steps to reproduce. Ideally, this should be something that could be recreated from a fresh install. Thanks!

[Launchpad Janitor (janitor)]

[Expired for gnome-system-tools (Ubuntu) because there has been no activity for 60 days.]