localectl set-locale fails with access denied

[Nick Rosbrook]

On plucky, run:

root@plucky:~# localectl set-locale LANG=en_US.UTF-8
Failed to issue method call: Access denied

This is because of /usr/share/dbus-1/system.d/systemd-localed-read-only.conf shipped in Debian and Ubuntu. This extra policy exists because of incompatibilities between "Debianisms" like /etc/default/keyboard, and more widely-adopted configurations like /etc/vconsole.conf.

In the case of locale, though, it seems relatively safe to allow on Ubuntu systems. We have /etc/default/locale -> /etc/locale.conf, and systemd-localed uses locale-gen as needed, which is what locales.postinst does on install. Manual testing indicates that localectl set-locale and update-locale play well together.

Furthermore, this restriction changes behavior that the desktop relies on. Until a stronger reason can be demonstrated NOT to allow the SetLocale dbus API to be used, we should remove the restriction.

[Launchpad Janitor (janitor)]

This bug was fixed in the package systemd - 257.4-1ubuntu1

---------------
systemd (257.4-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/tests/boot-and-services: skip apparmor tests on armhf
    - debian/systemd.postinst:
      + manually call systemd-tmpfiles --create in postinst
      + Do not create /etc/tmpfiles.d/tmp.conf on upgrades
    - debian/control:
      + Add Recommends: networkd-dispatcher systemd-resolved to systemd package
      + Make systemd-cryptsetup Priority: important
      + Give systemd-resolved Priority: important
      + Add Recommends: systemd-hwe-hwdb to udev package
      + Drop Recommends: libnss-myhostname libnss-resolve from systemd-resolved
      + Build-Depends: linux-tools-generic
      + Do not build systemd-boot-efi-{amd64,arm64}-signed-template
    - switch-root: use MS_MOVE for /run when switchig from initrd
    - resolve,wait-online: backport wait-online DNS patches
    - d/rules: disable bpf support on riscv64 for now (LP #2099864)
    - Delta for i386:
      + debian/systemd.install: exclude files that are not built for i386
      + debian/systemd.manpages: do not ship un-built manpages on i386
      + debian/rules,debian/control,debian/tests/control:
        Do not build with tpm libraries on i386
      + debian/rules,debian/control,debian/tests/control:
        Do not build with libqrencode on i386
      + debian/rules: Remove unneeded efi artifacts on i386 to avoid debugedit errors
  * Dropped, included in Debian:
    - initramfs-tools: copy hwdb.bin to initramfs
    - d/rules: fix bpftool path discovery on ubuntu
  * New changes:
    - d/extra/dbus-1: remove SetLocale restriction from dbus policy (LP: #2102028)

systemd (257.4-1) unstable; urgency=medium

  [ Nick Rosbrook ]
  * d/rules: fix bpftool path discovery on ubuntu
  * initramfs-tools: copy hwdb.bin to initramfs. The contents of hwdb.bin
    may influence udev during early boot. E.g., this may change network
    interface naming decisions. Hence, make sure it is available in the
    initrd. This adds about 2MB to the size of the compressed initrd.
  * d/t/tests-in-lxd: skip test on any setup error. When this test fails
    becacuse of snap install, or lxd tools, we prefer to skip because we
    never reached the stage where we are actually testing systemd.

  [ Luca Boccassi ]
  * Set tty device node mode to 0600 (Closes: #1093870)
  * d/rules: ignore more blhc false positives
  * systemd-resolved: recommend libidn2-0. Without it in some cases
    hostname resolution fails (Closes: #1097699)
  * README: add note about out-of-tree patches being forbidden. Prompted
    by #1098221
  * systemd-sysv: add Protected: yes (Closes: #1098260)
  * Update upstream source from tag 'upstream/257.4' Update to upstream
    version '257.4' with Debian dir
    2121ac2e2a87e081b31f819aea969e38b6147ce3

 -- Nick Rosbrook <email address hidden> Tue, 11 Mar 2025 11:26:05 -0400