After release upgrade, the user loses permissions for several basic actions in the system

Bug #1240336 reported by Rob Frohne
282
This bug affects 58 people
Affects Status Importance Assigned to Milestone
gdm3 (Ubuntu)
Won't Fix
Critical
Unassigned
Nominated for Trusty by Alberto Salvia Novella
Nominated for Utopic by Alberto Salvia Novella
lightdm (Ubuntu)
Expired
Critical
Unassigned
Nominated for Trusty by Alberto Salvia Novella
Nominated for Utopic by Alberto Salvia Novella
lxdm (Ubuntu)
Expired
Critical
Unassigned
Nominated for Trusty by Alberto Salvia Novella
Nominated for Utopic by Alberto Salvia Novella
policykit-desktop-privileges (Ubuntu)
Expired
Critical
Unassigned
Nominated for Trusty by Alberto Salvia Novella
Nominated for Utopic by Alberto Salvia Novella

Bug Description

HOW TO REPRODUCE:
- Upgrade Ubuntu to the next release.

RESULT:
- The user looses permissions for several basic actions in the system.

ProblemType: Bug
DistroRelease: Ubuntu 13.10
Package: policykit-desktop-privileges 0.16
ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
Uname: Linux 3.11.0-12-generic x86_64
ApportVersion: 2.12.5-0ubuntu2
Architecture: amd64
Date: Tue Oct 15 20:20:55 2013
InstallationDate: Installed on 2013-10-09 (7 days ago)
InstallationMedia: Ubuntu 13.10 "Saucy Salamander" - Beta amd64 (20131008)
MarkForUpload: True
PackageArchitecture: all
ProcEnviron:
 LANGUAGE=en_US
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: policykit-desktop-privileges
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Rob Frohne (frohro) wrote :
Revision history for this message
Rob Frohne (frohro) wrote :

I am in the sudo group and others:

~$ groups frohro
frohro : frohro adm dialout fax cdrom floppy tape sudo audio dip video plugdev fuse netdev lpadmin scanner vboxusers

I did find the policykit-1-doc package, but haven't found a configuration error (yet).

Revision history for this message
Rob Frohne (frohro) wrote :

I notice that I don't have any polkit-gnome-authentication-agent-1 process running, though there is a polkitd running.

Revision history for this message
Rob Frohne (frohro) wrote :

And trying to start the agent produces:

:~/.config/geany$ /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1

(polkit-gnome-authentication-agent-1:5688): polkit-gnome-1-WARNING **: Unable to determine the session we are in: No session for pid 5688

I don't see any polkit warning in my ~/.xsession-errors. It looks like this:

Script for ibus started at run_im.
Script for auto started at run_im.
Script for default started at run_im.
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd main process ended, respawning
init: at-spi2-registryd respawning too fast, stopped

There is a post that has been somewhat helpful in thinking of things to try at:

http://askubuntu.com/questions/303309/cant-mount-usb-devices-shut-down-etc-as-a-user

Revision history for this message
Rob Frohne (frohro) wrote :

I went looking for what starts the agent, and found it here:

test@frohro-e6410:/etc/xdg/autostart$ cat polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
NoDisplay=true
OnlyShowIn=GNOME;XFCE;Unity;
X-GNOME-AutoRestart=true
AutostartCondition=GNOME3 unless-session gnome
X-Ubuntu-Gettext-Domain=polkit-gnome-1

I also checked my local ~/.config/autostart directory and there is nothing to start it there.

Revision history for this message
Rob Frohne (frohro) wrote :

I should also add that when I start the agent manually, it does not continue to run after the warning.

Revision history for this message
Rob Frohne (frohro) wrote :

Policykit seems to be working, at least this:

frohro@frohro-e6410:/media/bbfa3b46-995f-4d3f-bf61-ccbe04cfc84f/home/frohro/.config/autostart$ pkexec echo "test"
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/echo' as the super user
Multiple identities can be used for authentication:
 1. Rob Frohne,,, (frohro)
 2. Rob Frohne,,, (frohro)
Choose identity to authenticate as (1-2): 2
Password:
==== AUTHENTICATION COMPLETE ===
test

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in policykit-desktop-privileges (Ubuntu):
status: New → Confirmed
Revision history for this message
Dimitri Bakalow (dimitri-bakalow) wrote :

Well... I am not sure, whether it will help or not, but I had two installations upgraded 13.04 -> 13.10.

One worked fine, other one got this very same problem. I am not completely sure, is this crude workaround or not, but I found help in this archlinux forum thread as all symptoms were the same.

https://bbs.archlinux.org/viewtopic.php?id=167947

To be exact - post #5 had the thing, that solved the problem - polkit-gnome-authentication-agent-1 is up and all related stuff is usable again.

Maybe this will provide some help...

Revision history for this message
Dimitri Bakalow (dimitri-bakalow) wrote :

Just a small addition - my problem was also present on login screen as it was not possible to issue shut down or restart command from there.

Revision history for this message
Rob Frohne (frohro) wrote :

HI Dimitri,

It is nice to have some company. I also note the same thing on the login screen. I have to shutdown by using the power key (not pushed a long time, though). Hopefully we can figure this out. I went so far as to look at the source code and found the warning message, and I probably need to go look at the source again. I couldn't find anything using Google, and I expect the folk that are experts on policykit-1-gnome are busy with bigger bugs to squash. And for that matter, this bug might be in policykit-1-gnome as well.

Rob

Revision history for this message
Rob Frohne (frohro) wrote :

Hi Dimitri,

How did you install Saucy? Did you do like I did, and install from DVD, then use dpkg to install the packages using dselect upgrade?

That might point to a problem with that method of installation.

Thanks,

Rob

Revision history for this message
edbond (edbond) wrote : Re: [Bug 1240336] Re: Not authorized to perform operation....

I did upgrade 13.04 -> 13.10 and have the same problem. I can't mount usb,
install package via software center. Sound doesn't works too (not sure if
it's related).

Hope they will fix this soon.

Best regards,
Eduard

Best regards,
Eduard

On Sat, Oct 19, 2013 at 6:38 AM, Rob Frohne <email address hidden> wrote:

> Hi Dimitri,
>
> How did you install Saucy? Did you do like I did, and install from DVD,
> then use dpkg to install the packages using dselect upgrade?
>
> That might point to a problem with that method of installation.
>
> Thanks,
>
> Rob
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1240336
>
> Title:
> Not authorized to perform operation....
>
> Status in “policykit-desktop-privileges” package in Ubuntu:
> Confirmed
>
> Bug description:
> After a new install of 64 bit Ubuntu 13.10 on my second partition, I
> used dpkg to reinstall all the same packages I had on my 32 bit 13.04
> partition. I copied all my home directory files over and updated all
> the packages. I now find that I don't have permissions to change the
> network settings; I can't mount my other hard drive or any USB stick
> using nautilus, or (udisks without using sudo)' I can't run synaptic
> by clicking on the GUI (I have to go to a terminal and sudo synaptic);
> etc. I can't find any documentation on the configuration of
> policykit-desktop-privileges, so I'm filing this bug. For me it
> appears to be totally broken. Maybe someone can help me out.
>
> Thanks,
>
> Rob
>
> ProblemType: Bug
> DistroRelease: Ubuntu 13.10
> Package: policykit-desktop-privileges 0.16
> ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
> Uname: Linux 3.11.0-12-generic x86_64
> ApportVersion: 2.12.5-0ubuntu2
> Architecture: amd64
> Date: Tue Oct 15 20:20:55 2013
> InstallationDate: Installed on 2013-10-09 (7 days ago)
> InstallationMedia: Ubuntu 13.10 "Saucy Salamander" - Beta amd64
> (20131008)
> MarkForUpload: True
> PackageArchitecture: all
> ProcEnviron:
> LANGUAGE=en_US
> TERM=xterm
> PATH=(custom, no user)
> LANG=en_US.UTF-8
> SHELL=/bin/bash
> SourcePackage: policykit-desktop-privileges
> UpgradeStatus: No upgrade log present (probably fresh install)
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1240336/+subscriptions
>

Revision history for this message
Tobias (tobias-j) wrote : Re: Not authorized to perform operation....

I have this problem after an update from 13.04 to 13.10 on an 32bit system.
It does not work:
- SD-cards
- Shutdown via the menu, but with the power button
- Sound
- 3D-assalaration (Intel card)

Revision history for this message
Dimitri Bakalow (dimitri-bakalow) wrote :

Both of my installations were upgraded by means of Update Manager in usual way, however one of them did not show this problem. Both are 64-bit.

About this reference to previously mentioned archlinux thread - it looks quite obvious, that problem poassaibly had some relation to lightdm, because it was present without logging in (inability to chutdown or restart). This maybe screwed up user session with "no session for..." messages and no visible sessions for loginctl. This workaround fixed both problems.

Revision history for this message
Rob Frohne (frohro) wrote :

Well, Dimitri's solution in #9 above didn't help my situation, so maybe there are several causes of the same symptom. The /etc/pam.d/lightdm file I had in Ubuntu 13.04 is the same as what I started with in 13.10.

Revision history for this message
Romano Giannetti (romano-giannetti) wrote :

I am the original reporter of the bug#1241811; I have forced an update now (from command line, apt-get update, apt-get upgrade to bypass the staged upgrade) and it solved my problem. I am not sure if it's related to this, but you can try...

Revision history for this message
Rob Frohne (frohro) wrote :

I tried replacing /etc/polkit-1/ with the one from my Ubuntu 13.04 partition that works, but it didn't work.

Revision history for this message
edbond (edbond) wrote : Re: [Bug 1240336] Re: Not authorized to perform operation....

I think this command helped me:
sudo pam-auth-update --force
I didn't change anything in dialog that appeared.

Best regards,
Eduard

On Sun, Oct 20, 2013 at 7:19 AM, Rob Frohne <email address hidden> wrote:

> I tried replacing /etc/polkit-1/ with the one from my Ubuntu 13.04
> partition that works, but it didn't work.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1240336
>
> Title:
> Not authorized to perform operation....
>
> Status in “policykit-desktop-privileges” package in Ubuntu:
> Confirmed
>
> Bug description:
> After a new install of 64 bit Ubuntu 13.10 on my second partition, I
> used dpkg to reinstall all the same packages I had on my 32 bit 13.04
> partition. I copied all my home directory files over and updated all
> the packages. I now find that I don't have permissions to change the
> network settings; I can't mount my other hard drive or any USB stick
> using nautilus, or (udisks without using sudo)' I can't run synaptic
> by clicking on the GUI (I have to go to a terminal and sudo synaptic);
> etc. I can't find any documentation on the configuration of
> policykit-desktop-privileges, so I'm filing this bug. For me it
> appears to be totally broken. Maybe someone can help me out.
>
> Thanks,
>
> Rob
>
> ProblemType: Bug
> DistroRelease: Ubuntu 13.10
> Package: policykit-desktop-privileges 0.16
> ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
> Uname: Linux 3.11.0-12-generic x86_64
> ApportVersion: 2.12.5-0ubuntu2
> Architecture: amd64
> Date: Tue Oct 15 20:20:55 2013
> InstallationDate: Installed on 2013-10-09 (7 days ago)
> InstallationMedia: Ubuntu 13.10 "Saucy Salamander" - Beta amd64
> (20131008)
> MarkForUpload: True
> PackageArchitecture: all
> ProcEnviron:
> LANGUAGE=en_US
> TERM=xterm
> PATH=(custom, no user)
> LANG=en_US.UTF-8
> SHELL=/bin/bash
> SourcePackage: policykit-desktop-privileges
> UpgradeStatus: No upgrade log present (probably fresh install)
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1240336/+subscriptions
>

Revision history for this message
edbond (edbond) wrote :

Well, it works for installing packages from software center (auth dialog
appears), still fails silently sometimes (for example when I try to remove
software source PPA).

I also created a new admin user, by running sudo gnome-control-center ->
Users & Groups.
For that user everything works fine.

Best regards,
Eduard

On Sun, Oct 20, 2013 at 9:06 AM, Eduard Bondarenko <email address hidden> wrote:

> I think this command helped me:
> sudo pam-auth-update --force
> I didn't change anything in dialog that appeared.
>
> Best regards,
> Eduard
>
>
> On Sun, Oct 20, 2013 at 7:19 AM, Rob Frohne <email address hidden> wrote:
>
>> I tried replacing /etc/polkit-1/ with the one from my Ubuntu 13.04
>> partition that works, but it didn't work.
>>
>> --
>> You received this bug notification because you are subscribed to the bug
>> report.
>> https://bugs.launchpad.net/bugs/1240336
>>
>> Title:
>> Not authorized to perform operation....
>>
>> Status in “policykit-desktop-privileges” package in Ubuntu:
>> Confirmed
>>
>> Bug description:
>> After a new install of 64 bit Ubuntu 13.10 on my second partition, I
>> used dpkg to reinstall all the same packages I had on my 32 bit 13.04
>> partition. I copied all my home directory files over and updated all
>> the packages. I now find that I don't have permissions to change the
>> network settings; I can't mount my other hard drive or any USB stick
>> using nautilus, or (udisks without using sudo)' I can't run synaptic
>> by clicking on the GUI (I have to go to a terminal and sudo synaptic);
>> etc. I can't find any documentation on the configuration of
>> policykit-desktop-privileges, so I'm filing this bug. For me it
>> appears to be totally broken. Maybe someone can help me out.
>>
>> Thanks,
>>
>> Rob
>>
>> ProblemType: Bug
>> DistroRelease: Ubuntu 13.10
>> Package: policykit-desktop-privileges 0.16
>> ProcVersionSignature: Ubuntu 3.11.0-12.19-generic 3.11.3
>> Uname: Linux 3.11.0-12-generic x86_64
>> ApportVersion: 2.12.5-0ubuntu2
>> Architecture: amd64
>> Date: Tue Oct 15 20:20:55 2013
>> InstallationDate: Installed on 2013-10-09 (7 days ago)
>> InstallationMedia: Ubuntu 13.10 "Saucy Salamander" - Beta amd64
>> (20131008)
>> MarkForUpload: True
>> PackageArchitecture: all
>> ProcEnviron:
>> LANGUAGE=en_US
>> TERM=xterm
>> PATH=(custom, no user)
>> LANG=en_US.UTF-8
>> SHELL=/bin/bash
>> SourcePackage: policykit-desktop-privileges
>> UpgradeStatus: No upgrade log present (probably fresh install)
>>
>> To manage notifications about this bug go to:
>>
>> https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1240336/+subscriptions
>>
>
>

Revision history for this message
Rob Frohne (frohro) wrote : Re: Not authorized to perform operation....

Thanks for the idea Eduard. It didn't work for me though.

Revision history for this message
subdir (subdir) wrote :

This worked for me
https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1240336/comments/19
Thanks Eduard!

This fixed all of my problems i got after updgrade:
- slow unity (gallium-llvmpipe instead of intel driver)
- no sound
- unable to mount drives
- unable to connect to some networks
- unable to use vpn
etc etc etc...

Revision history for this message
Geoff Hickey (ardri) wrote :

Another vote for comment #19 - solved it for me too. (Thanks!)

I ran into this after a normal update-manager upgrade from 13.04.

Revision history for this message
Mikael Rasmussen (mikael-rasmussen) wrote :

Thanks!!. Comment #19 and a reboot restored functionality after updating to 13.10 via the gui..

Revision history for this message
H.-Dirk Schmitt (dirk-computer42) wrote :

#9 doesn't help me

I could resolve the problem (below gnome3) with the addition of the following policy file:
/etc/polkit-1/localauthority/50-local.d/org.freedesktop.udisks2.filesystem-mount.pkla

[storage group mount override]
Identity=unix-group:plugdev
Action=org.freedesktop.udisks2.filesystem-mount
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Revision history for this message
Manuel Martinez (maherma) wrote :

Hi Dirk,

Thanks a lot, it's works for me.

Revision history for this message
Manuel Martinez (maherma) wrote :

Correction, only half works.

After create policy file, I'm able access from thunar to usb disk, create and delete files on it, but I can't umount it.

Manuel

NOTE: I have openbox as WM

Revision history for this message
Rob Frohne (frohro) wrote :

I needed to move on, so I gave up and re-installed the os without installing the same packages I had installed previously. The new install works fine, but I can't contribute to the bug report anymore. Sorry!

Revision history for this message
H.-Dirk Schmitt (dirk-computer42) wrote :

The following policy allows also the unmount and eject:

[Mounting, checking, etc. of internal drives]
Identity=unix-group:plugdev
Action=org.freedesktop.udisks2.filesystem-mount;org.freedesktop.udisks2.eject-media;org.freedesktop.udisks2.power-off-drive;org.freedesktop.udisks2.ata-check-power;org.freedesktop.udisks2.rescan:
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Revision history for this message
Manuel Martinez (maherma) wrote :

Hi Dirk,

+1 for your response #29.

USB disks are now fully functional and I can mount and unmount disks just before upgrade to 13.10.

Thanks. Regards

Manuel

Revision history for this message
Luca Saba (lucasaba) wrote :
Revision history for this message
Serhiy (xintx-ua) wrote :

In my case #19 didn't work but appending

 session required pam_loginuid.so
 session required pam_systemd.so

to /etc/pam.d/lxdm fixed everything.

Revision history for this message
BrainBug (brainbug0815) wrote :

my story:
I use gdm + gnome and upgraded via upgrade manager from 12.10 => 13.04 and also from 13.04 => 13.10.
It worked for some weeks until a week ago. (GDM screen started but no loginwindow)
Switching to terminal (CTRL+ALT+F1) worked.

After a long search I found out that switching from gdm to lightdm brought me back into GUI Mode (sudo dpkg-reconfigure gdm => change to lightdm and reboot)
But then I found out I have permission problems like you described (Softwarecenter install/uninstall, updates, network, USB)

I tried a lot so I can't be sure what the solution was, but the last things I tried were:
#19
* (sudo pam-auth-update --force
* reboot
=> did not work

#23
* add
    session required pam_loginuid.so
    session required pam_systemd.so
  to /etc/pam.d/gdm
* dpkg-reconfigure gdm (and select gdm)
* reboot
=> did not work (still no login window)

#23
* add
    session required pam_loginuid.so
    session required pam_systemd.so
  to /etc/pam.d/lightdm
* dpkg-reconfigure gdm (and select lightdm)
* reboot
=> works! I can change network settings, install/uninstall packages, connect usb devices

#23
* try again "dpkg-reconfigure gdm" (and select gdm)
* (new lines in /etc/pam.d/gdm are already there from previous try)
* reboot
=> works!

I don't know why/how but now also gdm is working again

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in lxdm (Ubuntu):
status: New → Confirmed
Revision history for this message
BrainBug (brainbug0815) wrote :

sorry, typo and I have no idea how to edit my comment: #32 was probably the solution, not #23

Revision history for this message
Dimitri Bakalow (dimitri-bakalow) wrote :

If this bug is marked as confirmed for lxdm, then it must also be marked as such for lightdm as same workaround is applicable for both of them in case of a problem as seen in #33 - which was my case BTW.

Of course it depends on which display manager is used as only one can be in use at a time - Ubuntu has lightdm and Lubuntu has lxdm...

Serhiy (xintx-ua)
summary: - Not authorized to perform operation....
+ Not authorized to perform operation / Unable to determine the session we
+ are in: No session for pid
Revision history for this message
A. Eibach (andi3) wrote : Re: Not authorized to perform operation / Unable to determine the session we are in: No session for pid

@Dimitri

Nope.
I'm on Lubuntu Saucy and there's indeed lightdm running here (and _not_ lxdm).
(Maybe it was lxdm on previous releases, which I didn't consider, though)

Revision history for this message
OzzyFrank (ubuntu-ozzyfrank) wrote :

Hi. I can confirm after upgrading to 13.10, there isn't much that my system says I'm authorised to do! Can't use Software Updater unless I invoke it with sudo from the terminal... I'm apparently not authorised to access any of my removable drives, or even the other partitions on my internal drive... I am not even allowed to play a DVD! (And not sure if it is related, but in case it is, it seems Shutdown no longer works, and I have to use the PC's power button). It's all the same mess in Unity, Gnome Shell, Gnome Classic (my preferred desktop), and KDE/Kubuntu.

Revision history for this message
OzzyFrank (ubuntu-ozzyfrank) wrote :

Hi again. Solution #23 in comment #33 worked for me, so many thanks! For those who want to try it, here are the steps:

gksu gedit /etc/pam.d/lightdm

Under the first line "#%PAM-1.0" paste the following:

session required pam_loginuid.so
session required pam_systemd.so

... then log out and back in again. If need be, run "dpkg-reconfigure gdm" and select "lightdm" (that was already selected in my case, so I don't know if OKing it actually made any difference). You shouldn't need to reboot, but do so if a simple logout doesn't do the trick.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gdm (Ubuntu):
status: New → Confirmed
Changed in lightdm (Ubuntu):
status: New → Confirmed
Revision history for this message
Magosányi Árpád (mag-magwas) wrote :

This was the solution for me as well:
sudo pam-auth-update --force
Beware that it does change files in pam.d, so if you have a heavily customized pam configuration,
prepare to be able to track the changes done, and fix things afterward.

Revision history for this message
locust (marineworks) wrote :

I have this problem after an update from 13.04 to 13.10 on an 32bit system.
It does not work:
- SD-cards
- USB disks
- 3D-acceleration (Intel card)

but if root login auto-mount does work
I login through mdm (mint petra)

Revision history for this message
locust (marineworks) wrote :

sorry ,
.... on an 64 bit system

Changed in lightdm (Ubuntu):
importance: Undecided → Critical
Changed in lxdm (Ubuntu):
importance: Undecided → Critical
Changed in policykit-desktop-privileges (Ubuntu):
importance: Undecided → Critical
Changed in gdm (Ubuntu):
importance: Undecided → Critical
Revision history for this message
AtesComp (atescomp) wrote :

I'm using Kubuntu and KDM.

Updated to 13.10 (64bit, Kubuntu) and encountered the same problem. Cannot mount USB devices. Cannnot change settings in System Settings->Login Screen (apply and leave screen asks to apply again resulting in "Unable to authenticate/execute the action: (code 4)".

Tried #19
* sudo pam-auth-update --force
* reboot
=> did not work

I haven't chacked the login screen shutdown problem.

I'm looking at the PAM configurations and I have:
  session optional pam_systemd.so
in the common-session file, but don;t know why "required" would need to be set to make this work. Prior version are also optional. Will try it though.

Revision history for this message
AtesComp (atescomp) wrote :

Checked the login screen shutdown problem using KDM: this works.

Reviewing the PAM files shows that the kdm file calls the common-session file.

Tried version of #32
* modified to
    session required pam_systemd.so
  in /etc/pam.d/common-session
* reboot
=> did not work

Tried version of #32
* modified (reverted) to
    session optional pam_systemd.so
  added
    session optional pam_loginuid.so
  in /etc/pam.d/common-session
* reboot
=> did not work

Tried version of #32
* modified to
    session required pam_systemd.so
    session required pam_loginuid.so
  in /etc/pam.d/common-session
* reboot
=> did not work

So nothing works so far.

Revision history for this message
AtesComp (atescomp) wrote :

My problem has something to do with KDE, udisk, and multiple authentication identities.
Disregard my prior comments.

Revision history for this message
AtesComp (atescomp) wrote :

OK, it is this issue. PolicyKit is choking udisk2. Here are the sample commands:

$ udisksctl mount -b /dev/sdm1 --no-user-interaction
Error mounting /dev/sdm1: GDBus.Error:org.freedesktop.UDisks2.Error.NotAuthorizedCanObtain: Not authorized to perform operation

$ udisksctl mount -b /dev/sdm1
==== AUTHENTICATING FOR org.freedesktop.udisks2.filesystem-mount ===
Authentication is required to mount 0c76 TS512MJFLASHA (/dev/sdm1)
Multiple identities can be used for authentication:
 1. Administrator (administrator)
 2. User1 (user1)
Choose identity to authenticate as (1-2): 2
Password:
==== AUTHENTICATION COMPLETE ===
Mounted /dev/sdm1 at /media/user1/USB512MB.

Since the " --no-user-interaction" command fails, users can't mount external devices without selecting a sudo user and password authenticatation.

Once it's mounted, I can unmount normally.

The file /var/lib/polkit-1/localauthority/10-vendor.d/com.ubuntu.desktop.pkla contains (partial):
[Mounting, checking, etc. of internal drives]
Identity=unix-group:admin;unix-group:sudo
Action=org.freedesktop.udisks.filesystem-*;org.freedesktop.udisks.drive-ata-smart*;org.freedesktop.udisks2.filesystem-mount-system;org.freedesktop.udisks2.encrypted-unlock-system;org.freedesktop.udisks2.filesystem-fstab;
ResultActive=yes

We need something for the little guy to mount the external devices. Maybe a rule in /usr/share/polkit-1/rules.d/ because System Settings->Removable Devices "ain't git'in 'er done."

Revision history for this message
Dimitri Bakalow (dimitri-bakalow) wrote :

I just tried a bit of "surgery" - I made a new installation (from the scratch) into Virtualbox and took all contents of /etc/pam.d and merged it into my main system - the one with this bug - thus overwriting files with new ones but keeping all additional files - not from the system itself - untouched.

And guess what? Everything seems to work WITHOUT these "workarounds" tried before. This implies to the difference in some other file in /etc/pam.d, which is "left over" from 13.04 and causing this problem - other file than /etc/pam.d/lightdm.

Revision history for this message
AtesComp (atescomp) wrote :

Cleaned up /etc/pam.d and used "sudo pam-auth-update" and "sudo pam-auth-update --force" to autofix thing. I found I had an extra likewise PAM profile in /usr/share/pam-configs/.

Nothing worked.

Finally, I retried a previous solution:
Tried version of #32
* Added
    session required pam_loginuid.so
    session required pam_systemd.so
  to top of /etc/pam.d/kdm
Logout, Restart X, Login

This worked. Mounting is fixed. System Settings->Login Screen reports "You will be asked to authenticate before saving" and it does indeed when I apply.

I know that the order of selection is important to PAM, but I haven't yet compared my PAM files to a working system to find out where these entries really need to be placed.
Why didn't I need them before the upgrade OR why where they removed on upgrade? The file dates seem to indicate that the PAM entries were not in the kdm file or @include chains before the update.

Previous entries of "pam_loginuid.so" and "pam_systemd.so" via grep:
  /etc/pam.d/common-session:session optional pam_systemd.so
  /etc/pam.d/sshd:session required pam_loginuid.so
Since "pam_loginuid.so" is relegated to SSHD, it was never in the chain of PAM for a local login.
The "pam_systemd.so" is third from the bottom in the common-session file. This is where I made my previous changes in #46.

I'll do a few more tests.

Revision history for this message
AtesComp (atescomp) wrote :

Further testing indicates that the above (#50) solution can be removed once you have a working system.

Steps:
1. Added
      session required pam_loginuid.so
      session required pam_systemd.so
    to top of /etc/pam.d/<whatever_DM_file_you _use>
2. Logout, Restart X, Login
3. Check that you can do it all.
4. Remove
      session required pam_loginuid.so
      session required pam_systemd.so
    from /etc/pam.d/<whatever_DM_file_you _use>
5. Logout, Restart X, Login
6. Check that you can STILL do it all.

After step 2, I ran through the usual group of crash reports for submission after login. However, on the next login these crash reports stopped occuring.

No reboot was performed until after step 6 to confirm the fix remained.

As a guess, the upgrade process needs to fufill some kind of rights process that need these PAM lines during login to finish upgrading the system. I tested that this also fixes usability for all other user logins--after performing all steps for one user login, other user logins work as well. So the fix seems to be a system wide correction that only needs to be temporarily applied for a single login (probably requires a user login who belongs to the admin/sudo group).

Revision history for this message
Scott Talbert (swt-techie) wrote :

Experienced this problem on a machine after upgrading from 12.04 to 14.04. I compared my /etc/pam.d contents to a freshly installed 14.04 system. "sudo pam-auth-update --force" corrected most of the differences. Also uninstalled the "libpam-ck-connector" package (which seems to be not needed?). After doing this my /etc/pam.d matched the fresh system, and after logging out and back in, the problems went away.

Revision history for this message
Qu Bit (qbit-v) wrote :

#29 finally worked for me on debian LXDE

had a tried a fix before that used 'udisks' instead of 'udisks2' as well as some probably old action names.

thanks!

Revision history for this message
Anders Hall (a.hall) wrote :

Comment 19 worked for me after reboot on 14.04. The error happened in relation to manual a password reset I did (replaced shadow and passwd with a backup).

https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1240336/comments/19

Revision history for this message
menner (menner) wrote :

Solution #32 , appending

 session required pam_loginuid.so
 session required pam_systemd.so

to /etc/pam.d/lxdm

made everything work.
Thanks

Revision history for this message
Alurian Nighthawk (howe20032003) wrote :

Can confirm Solution #32 working as well.

Revision history for this message
Paul BROWN (frozenzia) wrote :

Another happy Solution #32 user here. THANKS!!

Revision history for this message
GiaBao Phu Truong (2908bg) wrote :

Have this on Ubuntu 14.10 Utopic. Try everything mentioned above but nothing work.

When first start at the login screen, I can shutdown/ restart/ suspend by using the button at the top panel. After login to the account I have this bugs and can't shutdown/ restart/ suspend without 'sudo' command line. Logout to the login screen again, I lost the ability to shutdown/ restart/ suspend via the button at the top panel too. Reboot the system and everything happen again.

Revision history for this message
Elisa (elisa-algebra) wrote :

Solution #19 worked for me. Thanks!

Revision history for this message
Mandeep Singh (mandeeps708) wrote :

GiaBao Phu Truong, I had this error I think this was due to the "cairo-dock". When I un-installed it everything was fine.

Revision history for this message
GiaBao Phu Truong (2908bg) wrote :

I don't have cairo-dock install.

Revision history for this message
Станислав (jools333) wrote :

For me the solution to the problem was the move to systemd. Like here http://askubuntu.com/questions/420917/how-can-i-replace-upstart-with-systemd

Revision history for this message
Davim (davim) wrote :

I got the same problem on upgrading from 14.04 to 14.10.
On dmesg I see:

[ 43.323648] systemd-logind[2817]: Failed to start unit user@111.service: Unknown unit: user@111.service
[ 43.323654] systemd-logind[2817]: Failed to start user service: Unknown unit: user@111.service
[ 43.326729] systemd-logind[2817]: New session c1 of user lightdm.
[ 43.326748] systemd-logind[2817]: Linked /tmp/.X11-unix/X0 to /run/user/111/X11-display.
[ 44.387104] init: plymouth-stop pre-start process (4632) terminated with status 1
[ 57.998337] audit: type=1400 audit(1414195441.914:38): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/lib/cups/backend/cups-pdf" pid=4840 comm="apparmor_parser"
[ 57.998349] audit: type=1400 audit(1414195441.914:39): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/cupsd" pid=4840 comm="apparmor_parser"
[ 58.011666] audit: type=1400 audit(1414195441.930:40): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="third_party" pid=4840 comm="apparmor_parser"
[ 67.951030] systemd-logind[2817]: Failed to start unit user@1000.service: Unknown unit: user@1000.service
[ 67.951036] systemd-logind[2817]: Failed to start user service: Unknown unit: user@1000.service
[ 67.953605] systemd-logind[2817]: New session 1 of user ldavim.
[ 67.953621] systemd-logind[2817]: Linked /tmp/.X11-unix/X0 to /run/user/1000/X11-display.
[ 67.956202] systemd-logind[2817]: Existing logind session ID 1 used by new audit session, ignoring
[ 67.958750] systemd-logind[2817]: New session c2 of user ldavim.
[ 76.073380] init: anacron main process (3189) killed by TERM signal

Revision history for this message
Daniel Crawford (daniel-crawford) wrote :

Upgrading from 14.04 to 14.10. Only solution #62 worked.

Revision history for this message
Davim (davim) wrote :

On upgrading from 14.04 to 14.10 only solution #64 worked:

sudo aptitude install systemd-sysv

Revision history for this message
theghost (theghost) wrote :

Same here on 14.10 coming from 14.04. I also updated the tags to reflect the affected releases.

tags: added: trusty
tags: added: utopic
Revision history for this message
Christoph Erian (kontaktwackler) wrote :

Had same issues as described above (update manager - no privilege, shutdown/restart not working out of menu) after upgrade from 14.04 to 14.10.

Following fixed everything:
sudo apt-get install systemd-sysv

Revision history for this message
Serhiy (xintx-ua) wrote :

DO NOT INSTALL systemd-sysv unless you absolutely sure you know what you are doing. It breaks too much on 14.10 at the moment. There is a bunch of packages that need prerm/postinst script editing to not break dpkg state without upstart.

Revision history for this message
M4he (mahe) wrote :

Have had a similar issue.
When I tried to run "loginctl" I got "Failed to issue method call: Cannot launch daemon, file not found or permissions invalid" and trying to execute polkit-gnome-authentication-agent-1 resulted in "Unable to determine the session we are in: No session for pid ...".

None of the solutions above helped for me.

What helped for me was to remove all i386 parts of PAM (which got installed with Skype) similar to https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1295521/comments/15
I then rebooted and got all functionality back. After reinstalling Skype and the libs and rebooting everything is still working fine.

Revision history for this message
Rob Dean (rob-dean) wrote :

I'm having this problem on upgrade to Utopic (Kubuntu system) - ie unable to mount USB, clicking shutdown gets me to the login screen. I've tried appending

session required pam_loginuid.so
session required pam_systemd.so

to /etc/pam.d/lightdm and rebooting but didn't fix the problem. Anyone have any other suggestions?

Revision history for this message
Jacob Opstad (jeopstad) wrote :

I'm also having this problem. I have just recently upgraded from 14.04 to 14.10 Ubuntu.

I am wondering if this could in any way have to do with two administrator users on the same system. My system always has four users and two of them are administrators. I've never had anything like this happen before.

Revision history for this message
Ovidiu Manta (ovidiu-manta) wrote :

I have just recently upgraded from 14.04 to 14.10 Ubuntu. I had this problem too, for an entire week now. couldn't edit users, network, suspend, shutdown, etc. tried every single solution to no avail. In the end i've repeated apt-get update/apt-get upgrade and it's fixed. Also fixed the pulseaudio sound problem i had and never figured out a solution for it. Linux desktop is a nice project, unfortunately riddled with bugs, and missing direction.

Revision history for this message
rndmerle (rndmerle) wrote :

I tried every single solution, even #69, and nothing worked for me.
Not sure what I could try in order to help.

I think, but I'm really not sure at all, that the issue started when I disabled the autologin feature from lightdm ; but I was reinstalling everything so I was doing a lot of different things :/
(indeed putting autologin back doesnt solve anything)

Revision history for this message
arty (me-arty) wrote :

In my case the deinstallation of ulatencyd has solved the problem.

I had the problem in the old install, made a clean install and at some point started seeing the problem again. Somehow I guessed I should try deinstalling ulatencyd and it helped indeed. Installing it again and rebooting makes the problem appear again.

I have reported the issue to ulatencyd as https://bugs.launchpad.net/ubuntu/+source/ulatencyd/+bug/1404653

Revision history for this message
Bjoern Stuetz (bjoernstuetz) wrote :

Solution #74, i.e., removing ulatencyd worked for me. Thank you so much! I confirmed issue 1404653.

description: updated
summary: - Not authorized to perform operation / Unable to determine the session we
- are in: No session for pid
+ The user looses permissions for several basic actions in the system
+ after release upgrade
summary: - The user looses permissions for several basic actions in the system
- after release upgrade
+ After release upgrade, the user looses permissions for several basic
+ actions in the system
no longer affects: lightdm
Changed in gdm (Ubuntu):
status: Confirmed → Triaged
Changed in lightdm (Ubuntu):
status: Confirmed → Triaged
Changed in policykit-desktop-privileges (Ubuntu):
status: Confirmed → Triaged
Changed in lxdm (Ubuntu):
status: Confirmed → Triaged
Revision history for this message
RDNielsen (rdnielsen) wrote : Re: After release upgrade, the user looses permissions for several basic actions in the system

Removing ulatencyd also resolved the problem for me.

Revision history for this message
Isabelle Andrade (isabelle-cda) wrote :

Same problem with Ubuntu trusty after update. Tried the /etc/pam.d/lightdm solution, but did not work for me. I currently using network login with ldap, does it make a difference?

Revision history for this message
Simon Déziel (sdeziel) wrote :

I ran into this problem on Lubuntu 14.04. On that machine, the user created during the installation had no problem but every other regular users were affected.

The workaround was to join the regular users to the sudo group to please polkit. Since I really wanted those users to be "power less" I also added those sudoer rules:

jane ALL=(ALL) !ALL
jdoe ALL=(ALL) !ALL

chaya (chaya-d-14)
Changed in gdm (Ubuntu):
assignee: nobody → chaya (chaya-d-14)
Revision history for this message
Sourish Basu (sourish-basu) wrote :

Made an account to say that #52 worked for me. After upgrading to Ubuntu 14.04 from 12.04, I had lost sound, the ability to shut down/reboot as a normal user, and the ability to mount external SD cards/hard drives. Did "sudo pam-auth-update --force" and "sudo apt-get remove --purge libpam-ck-connector" as #52 suggested, and after a reboot, everything worked again!

I should say that at this point my pam.d is close, but not identical to, a fresh 14.04 install.

Revision history for this message
tweej (tweej) wrote :

Using solution from #32 requires the installation of libpam-systemd if you don't already have it. This package should be added as a dependency of lxdm if that ends up being the accepted fix.

Revision history for this message
Владимир (vladimir-invest) wrote :

I run into this problem after upgrade from Ubuntu 14.04 to Ubuntu 16.04
All suggested solutions didn't work well for me. But I found another very simple one.
I found the obsolete file in my home directory:
/home/current_user/.config/autostart/polkit-gnome-authentication-agent-1.desktop
After removing it everything runs well.

Revision history for this message
rabin shrestha (bhaktapur) (danieldangol-f) wrote :

i'm in 16.10 , i upgraded from 16.04 using dist-upgrade, well i'm facing same issue . can't access bunch of pendrive and android phone. :(

Revision history for this message
Christophe Gras (christophe-gras) wrote :

Got same issue after an upgrade from Ubuntu 14.04 to 16.04 and the following actions solved the problem :

sudo pam-auth-update --force
sudo vi/etc/pam.d/lightdm

=> add following lines at the end :
 session required pam_loginuid.so
 session required pam_systemd.so

sudo reboot

dino99 (9d9)
Changed in gdm (Ubuntu):
assignee: chaya (chaya-d-14) → nobody
tags: added: xenial
removed: saucy utopic
Sushma Jain (sushma8j)
Changed in policykit-desktop-privileges (Ubuntu):
assignee: nobody → Sushma Jain (sushma8j)
Changed in gdm (Ubuntu):
assignee: nobody → Shubham Lakshetti (laksh)
Revision history for this message
Shubham Lakshetti (laksh) wrote :

Actually, it works for installing packages from software center (auth dialog
appears), still fails silently sometimes (for example when I try to remove
software source PPA).

I also created a new admin user, by running sudo gnome-control-center ->
Users & Groups.
For that user everything works fine.

This appears to be a recurring bug which has been reported on Launchpad back in 2013. Every version of ubuntu since is affected by this but not everyone sees the error. On the moment I write this (march 2015) there's no permanent solution, however there are workarounds to solve the problem.

For Ubuntu 14.10 the problem appears to be related to the package ulatencyd. Removing this package causes the error to disappear in my situation. If I recall correctly I've installed this package manually on a certain moment in time so it does not belong to a standard install and therefore this might not affect everyone.

Revision history for this message
Jackson Gregg (popit101) wrote :

How do I gain the required privileges to edit the sudo document in /etc/pam.........

dino99 (9d9)
Changed in gdm (Ubuntu):
assignee: Shubham Lakshetti (laksh) → nobody
Changed in policykit-desktop-privileges (Ubuntu):
assignee: Sushma Jain (sushma8j) → nobody
summary: - After release upgrade, the user looses permissions for several basic
- actions in the system
+ Can you buy Tramadol without a script in Apex?
description: updated
Colin Watson (cjwatson)
summary: - Can you buy Tramadol without a script in Apex?
+ After release upgrade, the user loses permissions for several basic
+ actions in the system
description: updated
smithava (smithava23)
summary: - After release upgrade, the user loses permissions for several basic
- actions in the system
+ Buy Tramadol Online and Familiarize Yourself with Pain Medication
description: updated
Colin Watson (cjwatson)
summary: - Buy Tramadol Online and Familiarize Yourself with Pain Medication
+ After release upgrade, the user loses permissions for several basic
+ actions in the system
description: updated
Revision history for this message
omarly666 (omarly666) wrote :

I experienced this 10. april and made a bugreport about login, #1872104.

I lost my adm privileges and "was put" to a custom group, att screenshot

Revision history for this message
omarly666 (omarly666) wrote :

My privileges in custom group is in att screenshot

I think I got the same bug years ago, and checked about this on a MacBookPro 13" 2011, and the same appeared about the groups, but I had no login problems!? Same usb-stick with (maybe an newer zsynk? still within the same day 20.04) Now I know why my wifi was buggy on the Mac, after screen was black.

I'll check on my dell xps m1530 and check about groups/privileges. That one is more like clean install.

affects: gdm (Ubuntu) → gdm3 (Ubuntu)
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Thank you for reporting this bug to Ubuntu.
Ubuntu GNOME 16.04 (xenial) reached end-of-life in April 2019.
Ubuntu 13.10 (saucy) reached end-of-life on July 17, 2014.

https://ubuntugnome.org/ubuntu-gnome-16-04-lts-is-here/
https://wiki.ubuntu.com/XenialXerus/ReleaseNotes/UbuntuGNOME

We appreciate that this bug may be old and you might not be interested in discussing it any more. But if you are then please upgrade to the latest Ubuntu version and re-test. If you then find the bug is still present in the newer Ubuntu version, please add a comment here telling us which new version it is in.

Changed in gdm3 (Ubuntu):
status: Triaged → Won't Fix
Revision history for this message
Chris Guiver (guiverc) wrote :

Thank you for reporting this bug to Ubuntu.

Ubuntu 16.04 (xenial) reached end-of-standard-support on April 29, 2021.
Ubuntu 14.04 (trusty) reached end-of-standard-support on April 25, 2019.

See this document for currently supported Ubuntu releases:
https://wiki.ubuntu.com/Releases

We appreciate that this bug may be old and you might not be interested in discussing it any more. But if you are then please upgrade to the latest Ubuntu version and re-test. If you then find the bug is still present in the newer Ubuntu version, please add a comment here telling us which new version it is in.

Changed in lightdm (Ubuntu):
status: Triaged → Incomplete
Changed in lxdm (Ubuntu):
status: Triaged → Incomplete
Changed in policykit-desktop-privileges (Ubuntu):
status: Triaged → Incomplete
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for lxdm (Ubuntu) because there has been no activity for 60 days.]

Changed in lxdm (Ubuntu):
status: Incomplete → Expired
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for lightdm (Ubuntu) because there has been no activity for 60 days.]

Changed in lightdm (Ubuntu):
status: Incomplete → Expired
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for policykit-desktop-privileges (Ubuntu) because there has been no activity for 60 days.]

Changed in policykit-desktop-privileges (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.