polkit-gnome-authentication-agent-1 not started at login

[Per Ångström]

Binary package hint: gnome-system-tools

When I click the Add button in User Settings, nothing happens, I'm not even presented with an authorization dialog. The only error indication I can find is that on starting, the application outputs the following string to stderr:

(users-admin:2641): Liboobs-WARNING **: There was an unknown error communicating asynchronously with the backends: Malformed message was sent

I can't perform any other actions either, such as deleting users or administer groups.

ProblemType: Bug
Architecture: amd64
CheckboxSubmission: c2d78d7690d0fab80ba77c674de4d6a9
CheckboxSystem: 90b928d283473e9c089e730778bbd3da
Date: Wed Mar 17 14:20:44 2010
DistroRelease: Ubuntu 10.04
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release amd64 (20091027)
NonfreeKernelModules: nvidia
Package: gnome-system-tools 2.29.91-0ubuntu2
ProcVersionSignature: Ubuntu 2.6.32-16.25-generic
SourcePackage: gnome-system-tools
Uname: Linux 2.6.32-16-generic x86_64

[Per Ångström (autark)]

On the same system, privilege escalation works fine in Update Manager.

[Per Ångström (autark)]

While users-admin doesn't work under Gnome, it actually works as expected when running under KDE.

[Per Ångström (autark)]

When running under KDE, I get the same warning, but the line number is different:

(users-admin:3262): Liboobs-WARNING **: There was an unknown error communicating asynchronously with the backends: Malformed message was sent

[Milan Bouchet-Valat (nalimilan)]

Thanks for the report. The warning you see on start is likely to come from a bug on 64 bit machines, but it shouldn't be related with your problem.

Are you able to change a user account type, or its name? Please check this for a user different than the current one, as it won't work because of the bug quoted above. Are you able to authenticate when e.g. trying to set time with time-admin?

Please also follow instructions "For Users" at https://wiki.ubuntu.com/DebuggingGnomeSystemTools. Thanks!

[Per Ångström (autark)]

time-admin privilege escalation not working either.

[Per Ångström (autark)]

Logs from an unsuccessful users-admin session added.

[Per Ångström (autark)]

For my own account I can only change the name and the password; I cannot change the account type. I cannot change anything on other accounts.

[Milan Bouchet-Valat (nalimilan)]

If you can't authenticate from time-admin either, there must be a problem with PolicyKit. Please run
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.self.set
and
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.set

Replace PID with the PID of a process run by your user, e.g. start users-admin and get its PID using 'pidof users-admin'.

Are you sure changing your own name really works, i.e. changes are still there when you restart users-admin? There's a bug in current Lucid version where we pretend we change the name. Are you able to authenticate e.g. in System->Administration->Network Connections, trying to make a connection "For All Users"?

[Per Ångström (autark)]

pang@barbaren:~$ users-admin &
[1] 3254
pang@barbaren:~$ pkcheck --allow-user-interaction --process 3254 --action-id org.freedesktop.systemtoolsbackends.self.set
pang@barbaren:~$ echo $?
0
pang@barbaren:~$ pkcheck --allow-user-interaction --process 3254 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.
pang@barbaren:~$ echo $?
2

No, changing my own name doesn't really work, it just doesn't say it failed.

[Milan Bouchet-Valat (nalimilan)]

OK, you have a PolicyKit problem: you just need to have an authentication agent running. That's why it works in KDE and not in GNOME. Start /usr/lib/policykit-gnome/polkit-gnome-manager in the background, and everything will be fine.

Now we need to find out why this daemon is not running automatically. Do you have a file at /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service? Are there errors in /var/log/messages about DBus not being able to start that daemon?

[Per Ångström (autark)]

Even if I start /usr/lib/policykit-gnome/polkit-gnome-manager I don't get the authorization dialog.

pang@barbaren:~$ ls -l /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service
-rw-r--r-- 1 root root 118 2010-03-03 10:28 /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service

pang@barbaren:~$ cat /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service
[D-BUS Service]
Name=org.freedesktop.PolicyKit.AuthenticationAgent
Exec=/usr/lib/policykit-gnome/polkit-gnome-manager

I can't find anything in /var/log/messages related to polkit, policykit or dbus.

[Per Ångström (autark)]

Running strace on polkit-gnome-manager shows that users-admin does not communicate with the manager when I press the Add button.

[Per Ångström (autark)]

Running strace on the /usr/lib/policykit-1/polkitd process shows a lot of activity when I press the Add button.

[Milan Bouchet-Valat (nalimilan)]

Forget about users-admin. It doesn't communicate directly with the agent, but talks to system-tools-backends, which calls polkitd, which in turn triggers the agent to perform an authentication. Anyway, use the second pkcheck command, that's safer.

I'd suggest:
sudo killall /usr/lib/policykit-1/polkitd
sudo /usr/lib/policykit-1/polkitd
and in another terminal:
/usr/lib/policykit-gnome/polkit-gnome-manager
and in another one
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.set
(replacing PID with something meaningful)

And then please post the logs from these commads. Also have a look at /var/log/auth.log.

[Per Ångström (autark)]

pang@barbaren:~$ (/usr/lib/policykit-gnome/polkit-gnome-manager --no-exit | tee polkit.log )&
[2] 2082
pang@barbaren:~$
(polkit-gnome-manager:2083): PolicyKitGnome-WARNING **: Failed to acquire org.gnome.PolicyKit

(polkit-gnome-manager:2083): PolicyKitGnome-WARNING **: Could not acquire name; bailing out

-------
pang@barbaren:~$ pkcheck --allow-user-interaction --process 2083 --action-id org.freedesktop.systemtoolsbackends.set
Error checking for authorization org.freedesktop.systemtoolsbackends.set: Remote Exception invoking org.freedesktop.PolicyKit1.Authority.CheckAuthorization() on /org/freedesktop/PolicyKit1/Authority at name org.freedesktop.PolicyKit1: org.freedesktop.DBus.Error.NoReply: Message did not receive a reply (timeout by message bus)

-----

[Per Ångström (autark)]

Nothing relevant in /var/log/auth.d.

[Per Ångström (autark)]

/var/log/messages:
Mar 17 20:30:52 barbaren kernel: [ 533.984596] __ratelimit: 18 callbacks suppressed
Mar 17 20:30:52 barbaren kernel: [ 533.984607] polkitd[2080]: segfault at 0 ip 00007fb76001f054 sp 00007fffa6e11250 error 4 in libeggdbus-1.so.0.0.0[7fb75fff4000+43000]

[Per Ångström (autark)]

I let Apport report bug #540464 regarding the polkitd crash.

[Milan Bouchet-Valat (nalimilan)]

Well, we can't continue debugging using these logs if polkitd crashed during the process. I strongly suspect the whole issue comes from the fact that polkitd dies everytime you try to authenticate, which means that nothing happens. So I'm marking this

[Milan Bouchet-Valat (nalimilan)]

..as a duplicate of the other report.

[Per Ångström (autark)]

Actually, I think the crash was due to my passing an invalid pid to pkcheck. So I think that's a red herring.

[Per Ångström (autark)]

Mind you, this was the first occurrence of a polkitd crash in the logs.

[Milan Bouchet-Valat (nalimilan)]

Ah... So try to get the same logs with a correct PID, and if no crash occurs, we'll continue leaving the crash report alone.

[Per Ångström (autark)]

Sorry for the confusion. OK, a new try:

pang@barbaren:~$ sudo /usr/lib/policykit-gnome/polkit-gnome-manager --no-exit
(polkit-gnome-manager:3544): PolicyKitGnome-DEBUG: Starting PolicyKit GNOME session daemon version 0.9.2

-----

pang@barbaren:~$ pkcheck --allow-user-interaction --process 3544 --action-id org.freedesktop.systemtoolsbackends.set
Error checking for authorization org.freedesktop.systemtoolsbackends.set: Remote Exception invoking org.freedesktop.PolicyKit1.Authority.CheckAuthorization() on /org/freedesktop/PolicyKit1/Authority at name org.freedesktop.PolicyKit1: org.freedesktop.PolicyKit1.Error.NotAuthorized: Only trusted callers can use CheckAuthorization() for subjects belonging to other identities and/or pass details

[Per Ångström (autark)]

pang@barbaren:~$ cat polkitd.log
Registering null backend at priority -10
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/10-vendor.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/10-vendor.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/20-org.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/20-org.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/30-site.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/30-site.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/50-local.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/50-local.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/90-mandatory.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/90-mandatory.d' as a local authorization store
** (process:3542): DEBUG: Monitoring `/var/lib/polkit-1/localauthority' for changes
** (process:3542): DEBUG: Monitoring `/etc/polkit-1/localauthority' for changes
Using authority class PolkitBackendLocalAuthority
** (process:3542): DEBUG: system-bus-name::1.126 is inquiring whether unix-process:3544:828131 is authorized for org.freedesktop.systemtoolsbackends.set
** (process:3542): DEBUG: user of caller is unix-user:pang
** (process:3542): DEBUG: user of subject is unix-user:root

[Milan Bouchet-Valat (nalimilan)]

Still not... ;-)

PID 2544 seems to be that of a process owned by root. So PolicyKit is denying access. You should try with a process owned by your user account. Other logs seem fine.

[Per Ångström (autark)]

OK, a new day has begun. In my last attempt, I accidentally used sudo to start the polkit-gnome-manager.

pang@barbaren:~$ sudo /usr/lib/policykit-1/polkitd > polkitd.log

--------

pang@barbaren:~$ /usr/lib/policykit-gnome/polkit-gnome-manager --no-exit
(polkit-gnome-manager:1987): PolicyKitGnome-DEBUG: Starting PolicyKit GNOME session daemon version 0.9.2

---------

pang@barbaren:~$ pkcheck --allow-user-interaction --process 1987 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.
pang@barbaren:~$ pkcheck --allow-user-interaction --process 1987 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.

[Milan Bouchet-Valat (nalimilan)]

OK, thanks. There doesn't seem to be anything strange happening, but one of the two processes should have reported an error if it wasn't able to contact the other. I've reported the bug upstream so that they can suggest what's going wrong.

Just to be sure: after the last test, nothing related to D-Bus connections denied appeared in /var/log/auth.log?

[Milan Bouchet-Valat (nalimilan)]

Hmm, I was on crack yesterday: the program responsible for authentication in GNOME is /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1. Sorry, I'm confused because of the changes in name since PolicyKit < 1. Does that fix (temporarily) the problem?

[Per Ångström (autark)]

In /var/log/auth.d the only dbus-related is this, and I don't think it's
pertinent:

Mar 18 08:57:18 barbaren dbus-daemon: Rejected send message, 2 matched
rules; type="error", sender=":1.25" (uid=1000 pid=1567
comm="bluetooth-applet) interface="(unset)" member="(unset)" error
name="org.freedesktop.DBus.Error.UnknownMethod" requested_reply=0
destination=":1.0" (uid=0 pid=790 comm="/usr/sbin/bluetoothd))

[Per Ångström (autark)]

No problem!

It turns out /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 is not running. Starting it manually gives the following output, but now authentication works.

(polkit-gnome-authentication-agent-1:2461): GLib-GObject-WARNING **: cannot register existing type `_PolkitError'
(polkit-gnome-authentication-agent-1:2461): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed

So now the question is: why is the agent not running when I need it?

[Milan Bouchet-Valat (nalimilan)]

OK, that's what I expected before I confused programs.

Could you post here your /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop file? Please also check that you don't have a file ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop. If so, then please attach it here - removing it should solve the issue.

[Per Ångström (autark)]

pang@barbaren:~$ cat /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
NoDisplay=true
OnlyShowIn=GNOME;XFCE;
X-Ubuntu-Gettext-Domain=polkit-gnome-1

pang@barbaren:~$ ls -l ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop
-rw-r--r-- 1 pang pang 299 2010-02-08 14:58 /home/pang/.config/autostart/polkit-gnome-authentication-agent-1.desktop

pang@barbaren:~$ cat ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
;OnlyShowIn=GNOME;XFCE;
X-Ubuntu-Gettext-Domain=polkit-gnome-1
X-GNOME-Autostart-enabled=false

Will now rename ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop and restart Gnome.

[Per Ångström (autark)]

Yes, that fixed it! But how did that file get created?

[Jonathan Blackhall (johnny-one-eye)]

I'm unsure whether my bug is a duplicate of yours, since the underlying problem seems to be the same (polkit-gnome-authentication-agent-1) not running, but I don't have anything at ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop

https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/568748

Also did you ever figure out what caused this and was any kind of fix released? I wonder how many people have this bug, because it definitely doesn't seem like everyone...

[Milan Bouchet-Valat (nalimilan)]

Jonathan: if the file isn't present, the bug must be different.

BTW, I'm closing this bug because nobody else seems to have experienced it. It took us so much time to pin down, but there must have been something special on your system that nobody else has seen.

[Sebastian Morkisch (semox-deactivatedaccount)]

While searching why my Computer freezes since I suspect VBox causing it after installing it, I searched the syslog file. Here I found the line,

Dec 21 22:13:19 beteigeuze gnome-session[2524]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

Dec 21 18:06:51 beteigeuze gnome-session[2576]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

Dec 21 22:20:22 beteigeuze gnome-session[2132]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

I don't get what caused the error. Anyone? Can't see a specific pattern. How can I help?

uname -a
Linux computer 3.8.0-34-generic #49~precise1-Ubuntu SMP Wed Nov 13 18:05:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux