policykit not available over NX sessions

[James Westby]

Binary package hint: policykit

Policykit is not available over NX sessions. The unlock button
in the admin utilities is greyed out.

This bug was split out from bug 219473.

[James Westby (james-w)]

Hi,

Could someone who is experiencing this problem please
provide the output of

  ck-list-sessions

and

  polkit-auth --show-obtainable

when logged in over NX please?

Thanks,

James

[paulsdavies (paul-s-davies)]

Hi James,

See attached for output of ck-list-sessions from an NX session.

The polkit-auth --show-obtainable command ran, but didn't produce any output or error message, it just returned to the command prompt.

[TylerF (gtone23)]

Hi James,

Neither of those commands produced output for me over my NX session.

-Tyler

[James Westby (james-w)]

Hi,

Thanks for the information.

The fact that ck-list-sessions gives different behaviour means that there
are perhaps two different bugs here.

Paul, consolekit info seems to be valid for you, but the fact that you
can't obtain any policykit authorisations is the problem. Could you please
attach your /etc/PolicyKit/PolicyKit.conf to the bug report? Also, could
you please tell us what the output of "id" is when logged in as your user?

Tyler, it would probably be useful to see that information from you as well,
but I'm more concerned about why consolekit isn't giving you a session.
Could you please run "ck-launch-session" in a terminal, which will start
you a new shell. Is there then any output from "ck-list-sessions" in that new
shell? Are there any error messages?

Also, can you please confirm that you have a "console-kit-daemon" process
running. Do you have any related messages in /var/log/syslog? Are you
using gdm to log in? Do you have procfs mounted on /proc (see the output
of "mount")? Is there anything else strange in your session that may have
an impact here?

Thanks,

James

[TylerF (gtone23)]

My PolicyKit.conf and "id" output are attached, run as my normal logged in user before I ran the ck-launch-session command. After running the "ck-launch-session" command in the term, I ran "ck-list-sessions" again and produced the output in the attached file.

Indeed the following process shows up when I look at the running processes: "/usr/sbin/console-kit-daemon".

I don't see any related error messages in syslog or dmesg. I just recently tried kde by installing kubuntu from the terminal and selecting to use the KDE login manager (I forget what it's called). However, this permissions problem existed long before then. NX is configured to load a gnome session, and all of these are being run from inside my gnome desktop session.

My two "proc" related lines from the output of mount are:

proc on /proc type proc (rw,noexec,nosuid,nodev)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)

Anything else strange....this is an NX session that I have disconnected and reconnected to frequently over the past few days (rather than logging out and starting a new one each time). Like I said, I tried out KDE via a kubuntu install the other day, which I suppose could have affected the ck-list-sessions output, but did not have an effect on whether or not I can unlock admin functions of control panels. The command I ran to try kde was: sudo aptitude update && sudo aptitude install kubuntu-desktop

Shortly after getting this box running, I accidentally fried the motherboard and had to replace it but didn't reinstall any software. I haven't installed any special or non-standard kernels. I have lots of disks and mount points, although not an excessive amount (a few of them use FUSE). I'll post if I can think of anything else note worthy.

[paulsdavies (paul-s-davies)]

Hi James,

Here is my id output attached.

My install is a clean install onto a new disk in a two disk system. I have installed a few apps, but not done much else in the way of fiddling around.

[paulsdavies (paul-s-davies)]

and here is my /etc/PolicyKit/PolicyKit.conf

[James Westby (james-w)]

Hi,

Thanks for the information, it is useful.

Paul, is your Policykit.conf file really empty? That may well
cause this problem.

Tyler, unfortunately I am unfamiliar with NX, so I need some
help to understand how your session gets launched.

In order for consolekit to work correctly whatever starts
the session needs to start a consolekit session before
launching everything else. There is code in gdm and
sshd to do this.

How is an NX session set up? Is there something executed
for the session (e.g. gdm) that would set up consolekit, or
would NX need to do it itself?

Do you have any luck from within a second session?

Thanks,

James

[paulsdavies (paul-s-davies)]

Hi James,

My Policykit.conf file is not really empty - but I just attached it to the log without pasting into a text file first and (I think) as it is an XML file it confuses the LaunchPad site. If you download the file and open it with a text editor you can see it there. And in fact, it look's the same as Tyler's to me.

Let me know if it would be easier in a text file, and I will do that later today when I get to the machine.

Regards,

Paul.

[James Westby (james-w)]

On Thu, 2008-06-12 at 11:08 +0000, paulsdavies wrote:
> Let me know if it would be easier in a text file, and I will do that
> later today when I get to the machine.

Hi Paul,

Thanks, but I downloaded the file, and it is the same as Tyler's,
and I see no problem with it, so there is no need.

Thanks,

James

[TylerF (gtone23)]

James,

I honestly don't know the inner workings of NX or how it sets up a session. Basically, I open the NX client, and in my settings I tell it to log me in with a gnome session. Other options are kde, xdm, cde, or custom, where I can tell it to use the system default or run a custom command. So when I log in, it will do one of 2 things:

1) Detect that I still have a session open from earlier and reconnect me to it.
2) Open a brand new session, loading gnome as if I have just logged in.

VNC, as I understand it, operates more like path 1, where someone has already logged in and it just connects to that session. NX actually creates a new session with whatever window manager I want and I get a brand new everything (unless I reconnect to an existing NX session). However, if I log into the machine with its own kb and mouse, NX will NOT connect to that existing session like VNC will. (unless I am mistaken, but I'm pretty sure that's how it works.)

Does that help clear it up for you? If you want, you can download all of their linux installers for free to try it yourself.

-Tyler

[James Westby (james-w)]

On Fri, 2008-06-13 at 05:19 +0000, TylerF wrote:
> James,
>
> I honestly don't know the inner workings of NX or how it sets up a
> session. Basically, I open the NX client, and in my settings I tell it
> to log me in with a gnome session. Other options are kde, xdm, cde, or
> custom, where I can tell it to use the system default or run a custom
> command. So when I log in, it will do one of 2 things:
>
> 1) Detect that I still have a session open from earlier and reconnect me to it.
> 2) Open a brand new session, loading gnome as if I have just logged in.
>
> VNC, as I understand it, operates more like path 1, where someone has
> already logged in and it just connects to that session. NX actually
> creates a new session with whatever window manager I want and I get a
> brand new everything (unless I reconnect to an existing NX session).
> However, if I log into the machine with its own kb and mouse, NX will
> NOT connect to that existing session like VNC will. (unless I am
> mistaken, but I'm pretty sure that's how it works.)

Hi,

If it is loading gnome-session rather than gdm then it sounds like it
should be opening a consolekit session for you itself. If it is not
doing that then it may well lead to the behaviour that you are seeing.

Thanks,

James

[James Westby (james-w)]

On Fri, 2008-06-13 at 05:19 +0000, TylerF wrote:
> James,
>
> I honestly don't know the inner workings of NX or how it sets up a
> session. Basically, I open the NX client, and in my settings I tell it
> to log me in with a gnome session. Other options are kde, xdm, cde, or
> custom, where I can tell it to use the system default or run a custom
> command. So when I log in, it will do one of 2 things:

You could try getting NX to open a consolekit session prior to launching
gnome-session.

To help with this there is a "ck-launch-session" command, it will run
whatever command you give it in a new consolekit session, so you could
get NX to launch "ck-launch-session gnome-session".

Thanks,

James

[Zdeněk Dlauhý (zdlauhy)]

I can confirm this bug, over NX policykit doesnt work. NX is very important feautere for linux desktop, so this must be repaired.

ck-list-sessions
Session1:
 uid = '1000'
 realname = 'test,,,'
 seat = 'Seat1'
 session-type = ''
 active = TRUE
 x11-display = ':0'
 x11-display-device = '/dev/tty7'
 display-device = ''
 remote-host-name = ''
 is-local = TRUE
 on-since = '2008-06-18T06:35:38Z'

polkit doesnt show anything..

[Matthias Grüter (mgrueter)]

James,

I am experiencing the same behaviour and tried both of your suggestions: running a new session in a nested login window and telling the NX client to run "ck-launch-session gnome-session".

However both those options didn't help.

Thanks for your help,
Matthias

[Yeam Teik Wooi (yeam)]

It seem that Marcelo Boveto Shima had a temp fix for NX sessions
https://bugs.launchpad.net/ubuntu/+bug/221363
https://bugs.launchpad.net/ubuntu/+bug/221363/comments/23

At least it work in my environment.