Issue after wizard with policykit

[Dave Morley]

STEPS:
1. Bootstrap flash a fresh image to a device
2. Run through the wizard selecting pin for authentication
3. Tap on the get started button
4. Phone freezes for a while
5. At some point it unfreezes and you see the dash
6. Reboot and get password login instead of pin login

EXPECTED:
I expect no freeze (possibly due to apport) and pin dialogue on reboot

ACTUAL:
I get a long freeze and on reboot instead of getting the pin dialogue to unlock the phone I get the password dialogue and full osk.

[Michael Terry (mterry)]

From unity8.log:

Could not set password mode: "Did not receive a reply. Possible causes include:
the remote application did not send a reply, the message bus security policy blo
cked the reply, the reply timeout expired, or the network connection was broken."
qml: Error setting security method: Could not set security mode

I believe we make that "setPasswordMode" call synchronously for technical reasons, which explains the freeze. So the wizard tried to synchronously set the passcode to what the user asked and it times out. Which explains the freeze and why it isn't kept on a reboot.

Not sure why it times out yet.

[Michael Terry (mterry)]

Ah, OK. This seems to be due to the new addition of policykit-unity8.

ubuntu-system-settings registers its own policykit agent to handle changing password modes (because a system one didn't exist before, and because the UI design for the password change screen in System Settings involved asking for the password directly in the dialog, not via a separate policykit dialog.

So it spins up its own agent temporarily and feeds it the password to expect. And shuts down the agent when done.

However, in this case, there is already an agent registered. So USS bails on its attempt to change the password mode.

But AccountsService in the meantime IS trying to talk to policykit-unity8 to ask it if it's OK to let the user change the password mode. But it's trying to talk to unity8 to show a password snap decision. Which is synchronously in the middle of this password mode call. So it freezes instead.

Ugh. So I'm going to talk to the policykit-unity8 folks about this and see the best way forward.

If we *need* a quick fix, unseeding policykit-unity8 should do it.

[Michael Terry (mterry)]

Ted, did you folks test changing passwords in USS with your new policykit agent? I'm guessing it won't work.

[Michael Terry (mterry)]

(Which is not necessarily your fault, just saying not all the ducks are in a row yet.)

[Michał Sawicz (saviq)]

Related: bug #1580086

IMO we should un-seed policykit-unity8 from the touch images until we have a need for it (and we've tested its impact more).

[Jonas G. Drange (jonas-drange)]

So the fix for USS is to drop the implementation of the password dialog, instead using a polkit one?

[Ted Gould (ted)]

So I think what we're gonna do is use this bug for tracking the fixes and landings for the touch images. This will be for OTA12, OTA11 will not see the PK agent on it, we're just going to keep these bugs swept under the rug like they were in OTA10.

At the root of it all the issue seems to be bug 1512002 where accounts service was being too strict and we don't have a full session on the phone. By applying the patch in that bug we remove the need for USS to have a temporary PK agent and we remove the random prompts that are in bug 1580086.

For this bug:

policykit-unity8 task: Fix the crash that was happening on timeout.
ubuntu-system-settings: Remove the PK agent code.
accountservice: Backport the bug 1512002 patch to vivid overlay

[Sebastien Bacher (seb128)]

the accountsservice issue is already fixed in ubuntu

[Selene ToyKeeper (toykeeper)]

This is interesting. I've been having to override the auth type after the wizard for years, since it always gives me passphrase even if I select pin and enter a 4-digit code. Didn't realize there was a new issue with the same symptoms.

[Jean-Baptiste Lallement (jibel)]

removed the blocker tags and retarget to OTA12. The package has been unseeded which temporarily fixes the issue for OTA11

[Ted Gould (ted)]

Marking as low since we don't need the PK tools on the phone today, backporting them to vivid is of low priority. We'll get them by default when migrating to Xenial.

[Launchpad Janitor (janitor)]

This bug was fixed in the package policykit-unity8 - 0.1+16.10.20160822.1-0ubuntu1

---------------
policykit-unity8 (0.1+16.10.20160822.1-0ubuntu1) yakkety; urgency=medium

  [ Rodney Dawes ]
  * Add missing bzr-builddeb config for non-native version for CI train.

  [ Ted Gould ]
  * Replacing that U8 isn't responding with a recoverable error instead
    of crashing (LP: #1579837)
  * Setup Agent so that it is the fallback agent (LP: #1579837)
  * Setting the password echo mode on passwords (LP: #1580236)

 -- Ted Gould <email address hidden> Mon, 22 Aug 2016 19:45:35 +0000