http://bugzilla.novell.com/show_bug.cgi?id=541258 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c1 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |bphilips@novell.com --- Comment #1 from Ludwig Nussel 2009-09-23 01:13:42 MDT --- (In reply to comment #0)

These files seem to be generated by /sbin/chkstat-polkit in the polkit-default-privs. How did I get such a restrictive set of policies out of this tool by using a default Factory install?

I don't know. AFAIK yast/the product definition file is responsible for setting the default privilege setting. Check PERMISSION_SECURITY and POLKIT_DEFAULT_PRIVS in /etc/sysconfig/security. Default normally is 'easy' resp 'standard' which allows org.freedesktop.devicekit.power.suspend on the active console. If your setting isn't easy/standard attach yast logs and reassign to yast. If the setting is correct, check wheter you are on the active console (ck-list-session).

1) This policy of locking the screen and then asking for a password would never make sense and makes screen locking on suspend pointless

That's a separate bug that needs to be filed for whatever program is responsible for that behavior.

2) None of these files in /var/lib/polkit-1/localauthority/10-vendor.d are owned by a package so it was a bit unclear where they were coming from

They are created on the fly so adding the files to the spec file probably doesn't make too much sense. The directories should actually be provided by polkit itself but I could add it to polkit-default-privs as well. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User bphilips@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c3 --- Comment #3 from Brandon Philips 2009-09-23 07:07:08 MDT --- Created an attachment (id=319500) --> (http://bugzilla.novell.com/attachment.cgi?id=319500) Screenshot-Local Security Configuration - YaST Yast says "Custom Settings" after I set it to "Home Workstation" on a previous run. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c5 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |bphilips@novell.com --- Comment #5 from Ludwig Nussel 2009-09-23 07:17:18 MDT --- (In reply to comment #2)

I have never touched /etc/sysconfig/security before. But, here are the settings I have:

PERMISSION_SECURITY="secure" POLKIT_DEFAULT_PRIVS=""

So either the product definition is broken or some mechanism in yast. Please attach y2logs (http://en.opensuse.org/Bugs/YaST).

...

...

1) This policy of locking the screen and then asking for a password would never make sense and makes screen locking on suspend pointless

That's a separate bug that needs to be filed for whatever program is responsible for that behavior.

Aren't the policies in /var/lib/polkit-1/localauthority/10-vendor.d creating this behavior?

Sure a restrictive policy triggers this. It's not the fault of the restrictive policy if an application misbehaves though. An admin could set that manually as well.

Any clue who this bug should be filed against?

I'm not sure. I guess the authentication agent wants to show a window but since the screen is locked by a screensaver the window is not actually visible. No idea how that is supposed to work. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User bphilips@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c7 --- Comment #7 from Brandon Philips 2009-09-23 07:28:51 MDT --- (In reply to comment #5)

(In reply to comment #2)

...

I have never touched /etc/sysconfig/security before. But, here are the settings I have:

PERMISSION_SECURITY="secure" POLKIT_DEFAULT_PRIVS=""

After setting YaST local security to "Home Workstation" I have: PERMISSION_SECURITY="easy local" POLKIT_DEFAULT_PRIVS="" I reboooted after setting this up via YaST. When I press suspend I get the same behavior- screensaver locks, and polkit is asking for root behind it. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c9 --- Comment #9 from Ludwig Nussel 2009-09-23 07:30:53 MDT --- (In reply to comment #7)

After setting YaST local security to "Home Workstation" I have: PERMISSION_SECURITY="easy local" POLKIT_DEFAULT_PRIVS=""

I reboooted after setting this up via YaST. When I press suspend I get the same behavior- screensaver locks, and polkit is asking for root behind it.

you may need to run /sbin/set_polkit_default_privs manually -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User bphilips@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c11 --- Comment #11 from Brandon Philips 2009-09-23 07:37:01 MDT --- (In reply to comment #10)

See Bug 533605 Comment 10.

Doh, I mean See Bug 533605 Comment 9 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 Brandon Philips changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #319512|application/octet-stream |text/plain mime type| | -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=541258 User lnussel@novell.com added comment http://bugzilla.novell.com/show_bug.cgi?id=541258#c13 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #13 from Ludwig Nussel 2009-09-23 07:58:29 MDT --- ok, so the restrictive security setting was probably caused by an older milestone. I've filed a bug for yast2-security wrt running set_polkit_default_privs and I've included /var/lib/polkit-1/localauthority/10-vendor.d in the polkit-default-privs rpm. So fixed from my PoV. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.