[opensuse-xfce] root required for hotplug.....
Hi, Ran zypper up earlier this week on my daughters machine (13.1 x86_64) and now when she connects here phone a dialog appears requesting the root password. The message, although this is probably not very useful info ;) "An Application is attempting to perform an action that requires privileges. Authentication as the super user is required." Prior to zypper up this did not happen. I did not keep a log of the packages that were updated. I checked the settings for removable media and everything looks OK to me. This is probably not XFCE specific, but this is one of our more helpful and friendly lists. I also installed kdenlive, lombar, and some other video editor recently, but I have a hard time connecting these apps to this event. My first guess would be some ill advised change in policy kit, but I have not seen other people complain. Help is appreciated. Thanks, Robert -- Robert Schweikert MAY THE SOURCE BE WITH YOU SUSE-IBM Software Integration Center LINUX Tech Lead Public Cloud Architect rjschwei@suse.com rschweik@ca.ibm.com 781-464-8147 -- To unsubscribe, e-mail: opensuse-xfce+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-xfce+owner@opensuse.org
Dear Robert.
Ran zypper up earlier this week on my daughters machine (13.1 x86_64) and now when she connects here phone a dialog appears requesting the root password.
I have experienced similar issues on an upgrade to 12.3 and to 13.1. It is related to policykit in some form. On one of my boxes, I am also promoted for a root passwort on shutdown/suspend. I have not yet figured out if there is some magic in the way policykit has been implemented in openSUSE and am also not really sure which settings are made from within the YaST Security Center, but on a regular policykit setup one could create a rule like: polkit.addRule(function(action, subject) { if (subject.user == "INSERT_THE_USERNAME_HERE" && action.id.indexOf("org.freedesktop.udisks2.") == 0) { return polkit.Result.YES; } }); to e.g. /etc/polkit-1/rules.d/enable-mount.rules You can also leave the user subject and make the action.id a bit more specific: polkit.addRule(function(action) { if (action.id == "org.freedesktop.udisks2.filesystem-mount-system") { return polkit.Result.YES; } }); When udisk is used instead of udisks2 it might look like org.freedesktop.udisks.filesystem-mount-system. System defaults can be listed with: pkaction --action-id org.freedesktop.udisks2.filesystem-mount-system --verbose A check can be performed by executing: pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ --allow-user-interaction as the relevant user. When access is allowed nothing should be returned, otherwise you should be prompted for authorization. Hope that helps a bit. Greets Marcus
* Marcus Moeller <marcus.moeller@gmx.ch> [2014-01-23 08:37]:
I have experienced similar issues on an upgrade to 12.3 and to 13.1. It is related to policykit in some form. On one of my boxes, I am also promoted for a root passwort on shutdown/suspend.
This can happen when either your session is not considered active for some reason or when there are multiple sessions. Also check the polkit policy in /etc/polkit-default-privs.(standard|local).
I have not yet figured out if there is some magic in the way policykit has been implemented in openSUSE and am also not really sure which settings are made from within the YaST Security Center, but on a regular policykit setup one could create a rule like:
The magic is in /etc/polkit-default-privs.standard and /etc/polkit-default-privs.restrictive. The former contains the default policy, it can be overridden by placing entries in /etc/polkit-default-privs.local and running set_polkit_default_privs. The default preset is determined via /etc/sysconfig/security. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-xfce+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-xfce+owner@opensuse.org
Hi, * Robert Schweikert <rjschwei@suse.com> [2014-01-22 21:11]:
Ran zypper up earlier this week on my daughters machine (13.1 x86_64) and now when she connects here phone a dialog appears
how is it connected, via USB cable, does it appear as a mass storage device?
requesting the root password.
The message, although this is probably not very useful info ;)
"An Application is attempting to perform an action that requires privileges. Authentication as the super user is required."
That is the policykit agent, in the normal case (i.e. default policykit privileges and everyting working as intended) a local user whose session is considered active by systemd-logind should be authorized to mount any removable storage. Marcus already wrote some instructions for you to check against policykit whether you are authorized to mount filesystems. In order to determine whether the current session is marked active, find the session number of the current user session with: loginctl -al list-sessions and then check with: loginctl show-session <number> | grep ^Active whether it is active.
Prior to zypper up this did not happen. I did not keep a log of the packages that were updated.
But zypper did, have a look at /var/log/zypp/history. Note that upgrade actions are referred to as |install|. Would be interesting if there are any suspicious updates (udisks2, udev, systemd, policykit) which might have triggered that.
I checked the settings for removable media and everything looks OK to me. This is probably not XFCE specific, but this is one of our more helpful and friendly lists.
Yes, this is something lower in the stack, policykit privileges or your session not being marked as active
I also installed kdenlive, lombar, and some other video editor recently, but I have a hard time connecting these apps to this event. My first guess would be some ill advised change in policy kit, but I have not seen other people complain.
Yep, I'm not seeing anything like that, at least with flash drives and SD cards. -- Guido Berhoerster -- To unsubscribe, e-mail: opensuse-xfce+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-xfce+owner@opensuse.org
Dear Robert.
* Robert Schweikert <rjschwei@suse.com> [2014-01-22 21:11]:
Ran zypper up earlier this week on my daughters machine (13.1 x86_64) and now when she connects here phone a dialog appears
how is it connected, via USB cable, does it appear as a mass storage device?
requesting the root password.
The message, although this is probably not very useful info ;)
"An Application is attempting to perform an action that requires privileges. Authentication as the super user is required."
That is the policykit agent, in the normal case (i.e. default policykit privileges and everyting working as intended) a local user whose session is considered active by systemd-logind should be authorized to mount any removable storage.
Marcus already wrote some instructions for you to check against policykit whether you are authorized to mount filesystems.
In order to determine whether the current session is marked active, find the session number of the current user session with:
loginctl -al list-sessions
and then check with:
loginctl show-session <number> | grep ^Active
whether it is active.
Prior to zypper up this did not happen. I did not keep a log of the packages that were updated.
But zypper did, have a look at /var/log/zypp/history. Note that upgrade actions are referred to as |install|. Would be interesting if there are any suspicious updates (udisks2, udev, systemd, policykit) which might have triggered that.
I checked the settings for removable media and everything looks OK to me. This is probably not XFCE specific, but this is one of our more helpful and friendly lists.
Yes, this is something lower in the stack, policykit privileges or your session not being marked as active
I also installed kdenlive, lombar, and some other video editor recently, but I have a hard time connecting these apps to this event. My first guess would be some ill advised change in policy kit, but I have not seen other people complain.
Yep, I'm not seeing anything like that, at least with flash drives and SD cards.
Just an side note: On the systems where I am facing this issue, the useraccount is not the one that has been created during installation. This initial user never had such problems, only an additionally created one. The additional user is member of the same groups of course. Is this also the case on your setup? Greets Marcus PS: flipping the userids did not help here either.
On 01/23/2014 04:14 AM, Guido Berhoerster wrote:
Hi,
* Robert Schweikert <rjschwei@suse.com> [2014-01-22 21:11]:
Ran zypper up earlier this week on my daughters machine (13.1 x86_64) and now when she connects here phone a dialog appears
how is it connected, via USB cable, does it appear as a mass storage device?
requesting the root password.
The message, although this is probably not very useful info ;)
"An Application is attempting to perform an action that requires privileges. Authentication as the super user is required."
That is the policykit agent, in the normal case (i.e. default policykit privileges and everyting working as intended) a local user whose session is considered active by systemd-logind should be authorized to mount any removable storage.
Marcus already wrote some instructions for you to check against policykit whether you are authorized to mount filesystems.
In order to determine whether the current session is marked active, find the session number of the current user session with:
loginctl -al list-sessions
and then check with:
loginctl show-session <number> | grep ^Active
whether it is active.
That was it, a logout login cycle fixed the issue. Thanks.
Prior to zypper up this did not happen. I did not keep a log of the packages that were updated.
But zypper did, have a look at /var/log/zypp/history. Note that upgrade actions are referred to as |install|. Would be interesting if there are any suspicious updates (udisks2, udev, systemd, policykit) which might have triggered that.
There was a systemd update on the 21st, but as we all know kids reporting is a bit spotty thus I cannot say whether this actually triggered the issue or if the problem existed prior to this update. Thanks Marcus and Guido for the info and help. Robert -- Robert Schweikert MAY THE SOURCE BE WITH YOU SUSE-IBM Software Integration Center LINUX Tech Lead Public Cloud Architect rjschwei@suse.com rschweik@ca.ibm.com 781-464-8147 -- To unsubscribe, e-mail: opensuse-xfce+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-xfce+owner@opensuse.org
participants (3)
-
Guido Berhoerster
-
Marcus Moeller
-
Robert Schweikert