[Bug 1154139] New: KDE:Frameworks5/polkit-kde-agent-5 (5.17.0): Bug polkit-kde-authentication-agent-1 fails to launch/exec
http://bugzilla.opensuse.org/show_bug.cgi?id=1154139 Bug ID: 1154139 Summary: KDE:Frameworks5/polkit-kde-agent-5 (5.17.0): Bug polkit-kde-authentication-agent-1 fails to launch/exec Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: 3rd party software Assignee: fabian@ritter-vogt.de Reporter: pgnet.dev@gmail.com QA Contact: bnc-team-screening@forge.provo.novell.com Found By: --- Blocker: --- I run lsb_release -rd Description: openSUSE Leap 15.1 Release: 15.1 uname -rm 5.3.6-24.g519ea7b-default x86_64 DE is KDE, with Plasma 5.17.0 latest update from KDE:Frameworks5. On boot, I expect 'polkit-kde-authentication-agent-1' to be running. It it not, ps ax | grep polkit 2660 ? Ssl 0:00 /usr/lib/polkit-1/polkitd --no-debug This results in problems, e.g -- unable to mount USB/eSATA-attached from KDE/QT apps, "No permission" errors and more critically, -- unable to install VirtualBox extension pack, Failed to install the Extension Pack /tmp/mozilla_pgnd0/Oracle_VM_VirtualBox_Extension_Pack-6.0.14.vbox-extpack. The installer failed with exit code 127: Error checking for authorization org.freedesktop.policykit.exec: GDBus.Error:org.gtk.GDBus.UnmappedGError.Quark._g_2dfile_2derror_2dquark.Code4: Failed to open file ?/proc/7317/status?: No such file or directory. Result Code: NS_ERROR_FAILURE (0x80004005) Component: ExtPackManagerWrap Interface: IExtPackManager {70401eef-c8e9-466b-9660-45cb3e9979e4} generally, however, desktop environment and apps are functional. polkit service is up/healthy systemctl list-unit-files | grep polkit polkit.service static systemctl status -l polkit ● polkit.service - Authorization Manager Loaded: loaded (/usr/lib/systemd/system/polkit.service; static; vendor preset: disabled) Active: active (running) since Tue 2019-10-15 18:18:58 PDT; 18min ago Docs: man:polkit(8) Main PID: 2660 (polkitd) Tasks: 12 (limit: 9830) CGroup: /system.slice/polkit.service └─2660 /usr/lib/polkit-1/polkitd --no-debug Boot logs, journalctl -xb | egrep -i "polkit" Oct 15 18:18:57 pgnd.loc dbus-daemon[1733]: [system] Activating via systemd: service name='org.freedesktop.PolicyKit1' unit='polkit.service' requested by ':1.25' (uid=0 pid=2656 comm="") Oct 15 18:18:58 pgnd.loc polkitd[2660]: Started polkitd version 0.114 Oct 15 18:18:58 pgnd.loc polkitd[2660]: Loading rules from directory /etc/polkit-1/rules.d Oct 15 18:18:58 pgnd.loc polkitd[2660]: Loading rules from directory /usr/share/polkit-1/rules.d Oct 15 18:18:58 pgnd.loc polkitd[2660]: Finished loading, compiling and executing 3 rules Oct 15 18:18:58 pgnd.loc polkitd[2660]: Acquired the name org.freedesktop.PolicyKit1 on the system bus and, at shell, manual launch fails as well, whoami pgnd loginctl SESSION UID USER SEAT TTY 2 1000 pgnd seat0 rpm -q --whatprovides /usr/lib64/libexec/polkit-kde-authentication-agent-1 polkit-kde-agent-5-5.17.0-lp151.201.1.x86_64 QT_LOGGING_RULES=*.debug=true /usr/lib64/libexec/polkit-kde-authentication-agent-1 qt.qpa.xcb: Has MIT-SHM : true qt.qpa.xcb: Has MIT-SHM FD : true qt.qpa.xcb: Using XInput version 2.2 qt.qpa.screen: Output DP-0 is not connected qt.qpa.screen: Output DP-1 is not connected qt.qpa.screen: EDID data for output "HDMI-0": identifier '', manufacturer 'ViewSonic Corporation',model 'VP2771-', physical size: 600.00x340.00 qt.qpa.screen: adding QXcbScreen(0x559574891980, name="HDMI-0", geometry=2560x1440+0+0, availableGeometry=2560x1332+0+52, devicePixelRatio=1.0, logicalDpi=QPair(96.0,96.0), physicalSize=597.0x336.0mm, screenNumber=0, virtualSize=2560x1440 (2560.0x1440.0mm), orientation=Qt::LandscapeOrientation, depth=24, refreshRate=59.0, root=1e8, windowManagerName="KWin") (Primary: true ) qt.qpa.screen: primary output is "HDMI-0" qt.qpa.input.devices: input device Virtual core XTEST pointer ID 4 qt.qpa.input.devices: has 10 buttons qt.qpa.input.devices: has valuator "Rel X" recognized? true qt.qpa.input.devices: has valuator "Rel Y" recognized? true qt.qpa.input.devices: it's a scrolling device qt.qpa.input.devices: input device Kensington Kensington Expert Mouse ID 9 qt.qpa.input.devices: has 8 buttons qt.qpa.input.devices: has valuator "Rel X" recognized? true qt.qpa.input.devices: has valuator "Rel Y" recognized? true qt.qpa.input.devices: has valuator "Rel Horiz Scroll" recognized? true qt.qpa.input.devices: has valuator "Rel Vert Scroll" recognized? true qt.qpa.input.devices: it's a scrolling device qt.qpa.input.devices: input device HID 0c45:7403 ID 14 qt.qpa.input.devices: has 7 buttons qt.qpa.input.devices: has valuator "Rel X" recognized? true qt.qpa.input.devices: has valuator "Rel Y" recognized? true qt.qpa.input.devices: has valuator "Rel Horiz Scroll" recognized? true qt.qpa.input.devices: has valuator "Rel Vert Scroll" recognized? true qt.qpa.input.devices: it's a scrolling device qt5ct: using qt5ct plugin qt.qpa.xcb: using glib dispatcher qt.qpa.input.methods: socketWatcher.addPath "/home/pgnd/.config/ibus/bus/bce8d279423663d4735b9a3c000003e1-unix-0" qt.xkb.compose: using xkb compose input context org.kde.kcrash: KCrash disabled through environment. New PolkitAgentListener 0x5595749ed0c0 Adding new listener PolkitQt1::Agent::Listener(0x7f5b6800c920) for 0x5595749ed0c0 Listener online "Cannot register authentication agent: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: Cannot determine session the caller is in" Authentication agent result: false Couldn't register listener! raised issue in #kde, was suggested: "ubuntu reverted a recent ibus security fix due to qt incompatibilities -- https://usn.ubuntu.com/4134-2/ -- we saw suse release this fix a few days later, it's possible that they never noticed that it caused problems. try to revert the patch that fixed CVE-2019-14822" -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1154139 http://bugzilla.opensuse.org/show_bug.cgi?id=1154139#c1 pgnd _ <pgnet.dev@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fabian@ritter-vogt.de Flags| |needinfo?(fabian@ritter-vog | |t.de) --- Comment #1 from pgnd _ <pgnet.dev@gmail.com> --- found the cause of the fail @ Bug 1512064 - User not authorized for network , power etc https://bugzilla.redhat.com/show_bug.cgi?id=1512064#c3 " It was affected by a lite hardening I'm setup /proc as different fs with hidepid parameter. After removed one entry from fstab and restart problem solved . #proc /proc proc nosuid,nodev,noexec,hidepid=2 0 0 " on my systems, I've had /etc/fstab proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0 for as long as I can remember; and has been working without issue until "sometime recently" ... per, http://man7.org/linux/man-pages/man5/proc.5.html https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/ https://www.phoronix.com/forums/forum/phoronix/latest-phoronix-articles/1093... 'hidepid=2' is supported hardening for /proc here, changing - proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0 + proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0 fixes the issue. after reboot, ps ax | grep polkit 2669 ? Ssl 0:00 /usr/lib/polkit-1/polkitd --no-debug 3002 ? Sl 0:00 /usr/lib64/libexec/polkit-kde-authentication-agent-1 and I can, again, -- mount USB/eSATA attached removable drives -- install VirtualBox extension packs -- etc So to get this working, atm requires UN-hardening the /proc mount, by removal of the "hidepid=2" option. It's not clear that this is a new/recent requirement for linux FSs, or a bug that's arisen in distro &/or KDE ... Something's changed -- the question is what/why? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1154139 http://bugzilla.opensuse.org/show_bug.cgi?id=1154139#c2 Fabian Vogt <fvogt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt@suse.com Assignee|fabian@ritter-vogt.de |meissner@suse.com Flags|needinfo?(fabian@ritter-vog | |t.de) | --- Comment #2 from Fabian Vogt <fvogt@suse.com> --- hidepid is not set for /proc by default, apparently for good reason. Reassigning to the polkit bugowner. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1154139 Fabian Vogt <fvogt@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|3rd party software |Basesystem Version|unspecified |Current Product|openSUSE.org |openSUSE Tumbleweed QA Contact|bnc-team-screening@forge.pr |qa-bugs@suse.de |ovo.novell.com | Severity|Major |Normal -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1154139 http://bugzilla.opensuse.org/show_bug.cgi?id=1154139#c7 pgnd _ <pgnet.dev@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #7 from pgnd _ <pgnet.dev@gmail.com> --- old -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com