[opensuse-factory] LightDM not authorized to shut down/restart/suspend/hibernate any more

Guido Berhoerster

21 Nov 2012 21 Nov '12

12:48

After some recent Factory changes LightDM cannot shut down/restart/suspend/hibernate any more, more specifically calling SuspendAllowed, HibernateAllowed on org.freedesktop.UPower and CanRestart, CanStop on org.freedesktop.ConsoleKit.Manager from the greeter session always returns false. I also see the following message in the logs: dbus-daemon[424]: dbus[424]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.12" (uid=107 pid=2203 comm="/usr/sbin/lightdm-gtk-greeter ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.3 " (uid=0 pid=439 comm="/usr/sbin/console-kit-daemon --no-daemon ") I've checked that ConsoleKit has the greeter session marked as local and active, so according to our default polkit privileges these actions should be allowed. Also from within an Xfce session the above actions work fine and use the same upower/ConsoleKit DBus interfaces. Fedora seems to have the same problem and their LightDM maintainers have added new PolicyKit rules (see http://pkgs.fedoraproject.org/cgit/lightdm.git/tree/lightdm.rules) _unconditionally_ authorizing the lightdm user to use the above interfaces. However, in the accompanying discussion (https://bugzilla.redhat.com/show_bug.cgi?id=872797 https://bugzilla.redhat.com/show_bug.cgi?id=857254) they seem rather confused and the only given rationale is that this makes things work. Currently adding these workaround rules also does not have any effect on openSUSE since our PolicyKit daemon for some reason does not load this crazy javascript plugin despite libmozjs185-1_0 being installed (I see the following error in the logs: polkitd[504]: Error opening libmozjs185.so. This is not a fatal error but polkit .rules files will not be evaluated. To enable rules evaluation, install the library ) Any idea what's going on here? -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Show replies by date

Dominique Leuenberger a.k.a DimStar

21 Nov 21 Nov

12:53

Quoting Guido Berhoerster :

...

After some recent Factory changes LightDM cannot shut down/restart/suspend/hibernate any more, more specifically calling SuspendAllowed, HibernateAllowed on org.freedesktop.UPower and CanRestart, CanStop on org.freedesktop.ConsoleKit.Manager from the greeter session always returns false. I also see the following message in the logs:

dbus-daemon[424]: dbus[424]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.12" (uid=107 pid=2203 comm="/usr/sbin/lightdm-gtk-greeter ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.3 " (uid=0 pid=439 comm="/usr/sbin/console-kit-daemon --no-daemon ")

I've checked that ConsoleKit has the greeter session marked as local and active, so according to our default polkit privileges these actions should be allowed. Also from within an Xfce session the above actions work fine and use the same upower/ConsoleKit DBus interfaces.

I very much presume this is due to the switch of polkit to track systemd-login... Seems polkit is not able (at this moment) to be built for one and take care of the other transparently... Is there an option to migrate lightdm to use systemd-login as session tracker? Dominique -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Guido Berhoerster

13:12

* Dominique Leuenberger a.k.a DimStar [2012-11-21 13:53]:

...

Quoting Guido Berhoerster :

...
After some recent Factory changes LightDM cannot shut down/restart/suspend/hibernate any more, more specifically calling SuspendAllowed, HibernateAllowed on org.freedesktop.UPower and CanRestart, CanStop on org.freedesktop.ConsoleKit.Manager from the greeter session always returns false. I also see the following message in the logs:

dbus-daemon[424]: dbus[424]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.12" (uid=107 pid=2203 comm="/usr/sbin/lightdm-gtk-greeter ") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.3 " (uid=0 pid=439 comm="/usr/sbin/console-kit-daemon --no-daemon ")

I've checked that ConsoleKit has the greeter session marked as local and active, so according to our default polkit privileges these actions should be allowed. Also from within an Xfce session the above actions work fine and use the same upower/ConsoleKit DBus interfaces.

I very much presume this is due to the switch of polkit to track systemd-login...

Seems polkit is not able (at this moment) to be built for one and take care of the other transparently...

That doesn't explain why it works from an Xfce session which isn't systemd-aware either, though.

...

Is there an option to migrate lightdm to use systemd-login as session tracker?

Well, it's on the radar (https://bugs.launchpad.net/lightdm/+bug/930488) but I think upstream is pretty busy and this does not have high priority since Debian/Ubuntu don't use systemd. It's probably a bit of work to abstract out the session tracking code since it needs to support both CK and systemd in the forseeable future. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Raymond Wooninck

14:03

On Wednesday 21 November 2012 14:12:35 Guido Berhoerster wrote:

...

...
I very much presume this is due to the switch of polkit to track systemd-login...

Seems polkit is not able (at this moment) to be built for one and take care of the other transparently...

That doesn't explain why it works from an Xfce session which isn't systemd-aware either, though.

Maybe Xfce talks differently to upower ? What I do know is that Fedora initially started out with adding the patch for the rules, but after that they also created a patch in which lightdm is looking in a proper way toward upower and therefore becomes more systemd aware. It is not an full ideal situation, but the patch was also offered upstream to the lightdm maintainer as a starting point. I had this patch in my repo and cna confirm that lightdm became then aware of the upower capabilities. There were still some smaller issues with it, but in general the patch worked. Regards Raymond -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Dominique Leuenberger a.k.a DimStar

14:10

Quoting Raymond Wooninck :

...

On Wednesday 21 November 2012 14:12:35 Guido Berhoerster wrote:

...
...
I very much presume this is due to the switch of polkit to track systemd-login...

Seems polkit is not able (at this moment) to be built for one and take care of the other transparently...

That doesn't explain why it works from an Xfce session which isn't systemd-aware either, though.

Maybe Xfce talks differently to upower ? What I do know is that Fedora initially started out with adding the patch for the rules, but after that they also created a patch in which lightdm is looking in a proper way toward upower and therefore becomes more systemd aware. It is not an full ideal situation, but the patch was also offered upstream to the lightdm maintainer as a starting point.

I had this patch in my repo and cna confirm that lightdm became then aware of the upower capabilities. There were still some smaller issues with it, but in general the patch worked.

Probably this one [0] Dominique [0] http://pkgs.fedoraproject.org/cgit/lightdm.git/tree/lightdm-1.4.0-systemd_lo... -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Guido Berhoerster

14:37

* Raymond Wooninck [2012-11-21 15:07]:

...

On Wednesday 21 November 2012 14:12:35 Guido Berhoerster wrote:

...
...
I very much presume this is due to the switch of polkit to track systemd-login...

Seems polkit is not able (at this moment) to be built for one and take care of the other transparently...

That doesn't explain why it works from an Xfce session which isn't systemd-aware either, though.

Maybe Xfce talks differently to upower ? What I do know is that Fedora

No, I just checked the xfce4-session code, it calls the the same Suspend/Hibernate methods on org.freedesktop.UPower and Restart/Stop methods on org.freedesktop.ConsoleKit.Manager via DBus just like LightDM.

...

initially started out with adding the patch for the rules, but after that they also created a patch in which lightdm is looking in a proper way toward upower and therefore becomes more systemd aware. It is not an full ideal situation, but the patch was also offered upstream to the lightdm maintainer as a starting point.

I had this patch in my repo and cna confirm that lightdm became then aware of the upower capabilities. There were still some smaller issues with it, but in general the patch worked.

I don't object adding the workaround rules and the patch if needed but I would like to have an understanding of what's going on first. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Vincent Untz

14:11

Le mercredi 21 novembre 2012, à 13:48 +0100, Guido Berhoerster a écrit :

...

Currently adding these workaround rules also does not have any effect on openSUSE since our PolicyKit daemon for some reason does not load this crazy javascript plugin despite libmozjs185-1_0 being installed (I see the following error in the logs: polkitd[504]: Error opening libmozjs185.so. This is not a fatal error but polkit .rules files will not be evaluated. To enable rules evaluation, install the library )

Is this the only error line, or do you also have some "Error looking up symbol..." lines? Cheers, Vincent -- Les gens heureux ne sont pas pressés. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

Vincent Untz

14:12

Le mercredi 21 novembre 2012, à 15:11 +0100, Vincent Untz a écrit :

...

Le mercredi 21 novembre 2012, à 13:48 +0100, Guido Berhoerster a écrit :

...
Currently adding these workaround rules also does not have any effect on openSUSE since our PolicyKit daemon for some reason does not load this crazy javascript plugin despite libmozjs185-1_0 being installed (I see the following error in the logs: polkitd[504]: Error opening libmozjs185.so. This is not a fatal error but polkit .rules files will not be evaluated. To enable rules evaluation, install the library )

Is this the only error line, or do you also have some "Error looking up symbol..." lines?

Ah, we need this patch, I guess: http://cgit.freedesktop.org/polkit/commit/?id=a6747362693a91f8cfa3bd5e619cf9... Vincent -- Les gens heureux ne sont pas pressés. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org

4182

Age (days ago)

4182

Last active (days ago)

List overview

Download

7 comments

4 participants

participants (4)

Dominique Leuenberger a.k.a DimStar
Guido Berhoerster
Raymond Wooninck
Vincent Untz

[opensuse-factory] LightDM not authorized to shut down/restart/suspend/hibernate any more

tags

participants (4)