polkit-gnome-authentication-agent-1 not started at login

Bug #540247 reported by Per Ångström on 2010-03-17
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
PolicyKit GNOME
Invalid
Medium
policykit-1-gnome (Ubuntu)
Medium
Unassigned

Bug Description

Binary package hint: gnome-system-tools

When I click the Add button in User Settings, nothing happens, I'm not even presented with an authorization dialog. The only error indication I can find is that on starting, the application outputs the following string to stderr:

(users-admin:2641): Liboobs-WARNING **: There was an unknown error communicating asynchronously with the backends: Malformed message was sent

I can't perform any other actions either, such as deleting users or administer groups.

ProblemType: Bug
Architecture: amd64
CheckboxSubmission: c2d78d7690d0fab80ba77c674de4d6a9
CheckboxSystem: 90b928d283473e9c089e730778bbd3da
Date: Wed Mar 17 14:20:44 2010
DistroRelease: Ubuntu 10.04
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release amd64 (20091027)
NonfreeKernelModules: nvidia
Package: gnome-system-tools 2.29.91-0ubuntu2
ProcVersionSignature: Ubuntu 2.6.32-16.25-generic
SourcePackage: gnome-system-tools
Uname: Linux 2.6.32-16-generic x86_64

Per Ångström (autark) wrote :
Per Ångström (autark) wrote :

On the same system, privilege escalation works fine in Update Manager.

description: updated
Per Ångström (autark) wrote :

While users-admin doesn't work under Gnome, it actually works as expected when running under KDE.

Per Ångström (autark) wrote :

When running under KDE, I get the same warning, but the line number is different:

(users-admin:3262): Liboobs-WARNING **: There was an unknown error communicating asynchronously with the backends: Malformed message was sent

Milan Bouchet-Valat (nalimilan) wrote :

Thanks for the report. The warning you see on start is likely to come from a bug on 64 bit machines, but it shouldn't be related with your problem.

Are you able to change a user account type, or its name? Please check this for a user different than the current one, as it won't work because of the bug quoted above. Are you able to authenticate when e.g. trying to set time with time-admin?

Please also follow instructions "For Users" at https://wiki.ubuntu.com/DebuggingGnomeSystemTools. Thanks!

Changed in gnome-system-tools (Ubuntu):
importance: Undecided → Medium
status: New → Incomplete
Per Ångström (autark) wrote :

time-admin privilege escalation not working either.

Per Ångström (autark) wrote :
Per Ångström (autark) wrote :

Logs from an unsuccessful users-admin session added.

Per Ångström (autark) wrote :

For my own account I can only change the name and the password; I cannot change the account type. I cannot change anything on other accounts.

Changed in gnome-system-tools (Ubuntu):
status: Incomplete → New

If you can't authenticate from time-admin either, there must be a problem with PolicyKit. Please run
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.self.set
and
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.set

Replace PID with the PID of a process run by your user, e.g. start users-admin and get its PID using 'pidof users-admin'.

Are you sure changing your own name really works, i.e. changes are still there when you restart users-admin? There's a bug in current Lucid version where we pretend we change the name. Are you able to authenticate e.g. in System->Administration->Network Connections, trying to make a connection "For All Users"?

Per Ångström (autark) wrote :

pang@barbaren:~$ users-admin &
[1] 3254
pang@barbaren:~$ pkcheck --allow-user-interaction --process 3254 --action-id org.freedesktop.systemtoolsbackends.self.set
pang@barbaren:~$ echo $?
0
pang@barbaren:~$ pkcheck --allow-user-interaction --process 3254 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.
pang@barbaren:~$ echo $?
2

No, changing my own name doesn't really work, it just doesn't say it failed.

OK, you have a PolicyKit problem: you just need to have an authentication agent running. That's why it works in KDE and not in GNOME. Start /usr/lib/policykit-gnome/polkit-gnome-manager in the background, and everything will be fine.

Now we need to find out why this daemon is not running automatically. Do you have a file at /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service? Are there errors in /var/log/messages about DBus not being able to start that daemon?

affects: gnome-system-tools (Ubuntu) → policykit-1-gnome (Ubuntu)
Changed in policykit-1-gnome (Ubuntu):
status: New → Incomplete
Per Ångström (autark) wrote :

Even if I start /usr/lib/policykit-gnome/polkit-gnome-manager I don't get the authorization dialog.

pang@barbaren:~$ ls -l /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service
-rw-r--r-- 1 root root 118 2010-03-03 10:28 /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service

pang@barbaren:~$ cat /usr/share/dbus-1/services/gnome-org.freedesktop.PolicyKit.AuthenticationAgent.service
[D-BUS Service]
Name=org.freedesktop.PolicyKit.AuthenticationAgent
Exec=/usr/lib/policykit-gnome/polkit-gnome-manager

I can't find anything in /var/log/messages related to polkit, policykit or dbus.

Per Ångström (autark) wrote :

Running strace on polkit-gnome-manager shows that users-admin does not communicate with the manager when I press the Add button.

Per Ångström (autark) on 2010-03-17
Changed in policykit-1-gnome (Ubuntu):
status: Incomplete → New
Per Ångström (autark) wrote :

Running strace on the /usr/lib/policykit-1/polkitd process shows a lot of activity when I press the Add button.

Forget about users-admin. It doesn't communicate directly with the agent, but talks to system-tools-backends, which calls polkitd, which in turn triggers the agent to perform an authentication. Anyway, use the second pkcheck command, that's safer.

I'd suggest:
sudo killall /usr/lib/policykit-1/polkitd
sudo /usr/lib/policykit-1/polkitd
and in another terminal:
/usr/lib/policykit-gnome/polkit-gnome-manager
and in another one
pkcheck --allow-user-interaction --process PID --action-id org.freedesktop.systemtoolsbackends.set
(replacing PID with something meaningful)

And then please post the logs from these commads. Also have a look at /var/log/auth.log.

Changed in policykit-1-gnome (Ubuntu):
status: New → Incomplete
Per Ångström (autark) wrote :

pang@barbaren:~$ (/usr/lib/policykit-gnome/polkit-gnome-manager --no-exit | tee polkit.log )&
[2] 2082
pang@barbaren:~$
(polkit-gnome-manager:2083): PolicyKitGnome-WARNING **: Failed to acquire org.gnome.PolicyKit

(polkit-gnome-manager:2083): PolicyKitGnome-WARNING **: Could not acquire name; bailing out

-------
pang@barbaren:~$ pkcheck --allow-user-interaction --process 2083 --action-id org.freedesktop.systemtoolsbackends.set
Error checking for authorization org.freedesktop.systemtoolsbackends.set: Remote Exception invoking org.freedesktop.PolicyKit1.Authority.CheckAuthorization() on /org/freedesktop/PolicyKit1/Authority at name org.freedesktop.PolicyKit1: org.freedesktop.DBus.Error.NoReply: Message did not receive a reply (timeout by message bus)

-----

Per Ångström (autark) wrote :

Nothing relevant in /var/log/auth.d.

Per Ångström (autark) wrote :

/var/log/messages:
Mar 17 20:30:52 barbaren kernel: [ 533.984596] __ratelimit: 18 callbacks suppressed
Mar 17 20:30:52 barbaren kernel: [ 533.984607] polkitd[2080]: segfault at 0 ip 00007fb76001f054 sp 00007fffa6e11250 error 4 in libeggdbus-1.so.0.0.0[7fb75fff4000+43000]

Per Ångström (autark) wrote :

I let Apport report bug #540464 regarding the polkitd crash.

Changed in policykit-1-gnome (Ubuntu):
status: Incomplete → New

Well, we can't continue debugging using these logs if polkitd crashed during the process. I strongly suspect the whole issue comes from the fact that polkitd dies everytime you try to authenticate, which means that nothing happens. So I'm marking this

..as a duplicate of the other report.

Per Ångström (autark) wrote :

Actually, I think the crash was due to my passing an invalid pid to pkcheck. So I think that's a red herring.

Per Ångström (autark) wrote :

Mind you, this was the first occurrence of a polkitd crash in the logs.

Ah... So try to get the same logs with a correct PID, and if no crash occurs, we'll continue leaving the crash report alone.

Per Ångström (autark) wrote :

Sorry for the confusion. OK, a new try:

pang@barbaren:~$ sudo /usr/lib/policykit-gnome/polkit-gnome-manager --no-exit
(polkit-gnome-manager:3544): PolicyKitGnome-DEBUG: Starting PolicyKit GNOME session daemon version 0.9.2

-----

pang@barbaren:~$ pkcheck --allow-user-interaction --process 3544 --action-id org.freedesktop.systemtoolsbackends.set
Error checking for authorization org.freedesktop.systemtoolsbackends.set: Remote Exception invoking org.freedesktop.PolicyKit1.Authority.CheckAuthorization() on /org/freedesktop/PolicyKit1/Authority at name org.freedesktop.PolicyKit1: org.freedesktop.PolicyKit1.Error.NotAuthorized: Only trusted callers can use CheckAuthorization() for subjects belonging to other identities and/or pass details

Per Ångström (autark) wrote :

pang@barbaren:~$ cat polkitd.log
Registering null backend at priority -10
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/10-vendor.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/10-vendor.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/20-org.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/20-org.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/30-site.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/30-site.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/50-local.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/50-local.d' as a local authorization store
** (process:3542): DEBUG: Added `/var/lib/polkit-1/localauthority/90-mandatory.d' as a local authorization store
** (process:3542): DEBUG: Added `/etc/polkit-1/localauthority/90-mandatory.d' as a local authorization store
** (process:3542): DEBUG: Monitoring `/var/lib/polkit-1/localauthority' for changes
** (process:3542): DEBUG: Monitoring `/etc/polkit-1/localauthority' for changes
Using authority class PolkitBackendLocalAuthority
** (process:3542): DEBUG: system-bus-name::1.126 is inquiring whether unix-process:3544:828131 is authorized for org.freedesktop.systemtoolsbackends.set
** (process:3542): DEBUG: user of caller is unix-user:pang
** (process:3542): DEBUG: user of subject is unix-user:root

Still not... ;-)

PID 2544 seems to be that of a process owned by root. So PolicyKit is denying access. You should try with a process owned by your user account. Other logs seem fine.

Per Ångström (autark) wrote :

OK, a new day has begun. In my last attempt, I accidentally used sudo to start the polkit-gnome-manager.

pang@barbaren:~$ sudo /usr/lib/policykit-1/polkitd > polkitd.log

--------

pang@barbaren:~$ /usr/lib/policykit-gnome/polkit-gnome-manager --no-exit
(polkit-gnome-manager:1987): PolicyKitGnome-DEBUG: Starting PolicyKit GNOME session daemon version 0.9.2

---------

pang@barbaren:~$ pkcheck --allow-user-interaction --process 1987 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.
pang@barbaren:~$ pkcheck --allow-user-interaction --process 1987 --action-id org.freedesktop.systemtoolsbackends.set
polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available.

Per Ångström (autark) wrote :

OK, thanks. There doesn't seem to be anything strange happening, but one of the two processes should have reported an error if it wasn't able to contact the other. I've reported the bug upstream so that they can suggest what's going wrong.

Just to be sure: after the last test, nothing related to D-Bus connections denied appeared in /var/log/auth.log?

Changed in policykit-1-gnome (Ubuntu):
status: New → Triaged
summary: - [users-admin] no authorization dialog, unable to add user
+ polkit-gnome-manager not registered to polkitd

Hmm, I was on crack yesterday: the program responsible for authentication in GNOME is /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1. Sorry, I'm confused because of the changes in name since PolicyKit < 1. Does that fix (temporarily) the problem?

In /var/log/auth.d the only dbus-related is this, and I don't think it's
pertinent:

Mar 18 08:57:18 barbaren dbus-daemon: Rejected send message, 2 matched
rules; type="error", sender=":1.25" (uid=1000 pid=1567
comm="bluetooth-applet) interface="(unset)" member="(unset)" error
name="org.freedesktop.DBus.Error.UnknownMethod" requested_reply=0
destination=":1.0" (uid=0 pid=790 comm="/usr/sbin/bluetoothd))

No problem!

It turns out /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 is not running. Starting it manually gives the following output, but now authentication works.

(polkit-gnome-authentication-agent-1:2461): GLib-GObject-WARNING **: cannot register existing type `_PolkitError'
(polkit-gnome-authentication-agent-1:2461): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed

So now the question is: why is the agent not running when I need it?

OK, that's what I expected before I confused programs.

Could you post here your /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop file? Please also check that you don't have a file ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop. If so, then please attach it here - removing it should solve the issue.

Per Ångström (autark) wrote :

pang@barbaren:~$ cat /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
NoDisplay=true
OnlyShowIn=GNOME;XFCE;
X-Ubuntu-Gettext-Domain=polkit-gnome-1

pang@barbaren:~$ ls -l ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop
-rw-r--r-- 1 pang pang 299 2010-02-08 14:58 /home/pang/.config/autostart/polkit-gnome-authentication-agent-1.desktop

pang@barbaren:~$ cat ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop
[Desktop Entry]
Name=PolicyKit Authentication Agent
Comment=PolicyKit Authentication Agent
Exec=/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Terminal=false
Type=Application
Categories=
;OnlyShowIn=GNOME;XFCE;
X-Ubuntu-Gettext-Domain=polkit-gnome-1
X-GNOME-Autostart-enabled=false

Will now rename ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop and restart Gnome.

Per Ångström (autark) wrote :

Yes, that fixed it! But how did that file get created?

summary: - polkit-gnome-manager not registered to polkitd
+ polkit-gnome-authentication-agent-1 not started at login

I'm unsure whether my bug is a duplicate of yours, since the underlying problem seems to be the same (polkit-gnome-authentication-agent-1) not running, but I don't have anything at ~/.config/autostart/polkit-gnome-authentication-agent-1.desktop

https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/568748

Also did you ever figure out what caused this and was any kind of fix released? I wonder how many people have this bug, because it definitely doesn't seem like everyone...

Jonathan: if the file isn't present, the bug must be different.

BTW, I'm closing this bug because nobody else seems to have experienced it. It took us so much time to pin down, but there must have been something special on your system that nobody else has seen.

Changed in policykit-1-gnome (Ubuntu):
status: Triaged → Invalid
Changed in policykit-1-gnome:
importance: Unknown → Medium
status: Unknown → Invalid

While searching why my Computer freezes since I suspect VBox causing it after installing it, I searched the syslog file. Here I found the line,

Dec 21 22:13:19 beteigeuze gnome-session[2524]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

Dec 21 18:06:51 beteigeuze gnome-session[2576]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

Dec 21 22:20:22 beteigeuze gnome-session[2132]: WARNING: Failed to start app: Unable to start application: Kindprozess »/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1« konnte nicht ausgeführt werden (Datei oder Verzeichnis nicht gefunden)

I don't get what caused the error. Anyone? Can't see a specific pattern. How can I help?

uname -a
Linux computer 3.8.0-34-generic #49~precise1-Ubuntu SMP Wed Nov 13 18:05:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.