FS#26850 - Normal User: Thunar will not open partitions other than arch without a polkit-1 udisks.pkla file

Attached to Project: Arch Linux
Opened by David Batson (David_Batson) - Friday, 11 November 2011, 18:46 GMT
Last edited by Ionut Biru (wonder) - Monday, 14 November 2011, 20:49 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To No-one
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 4
Private No

Details

Description: When thunar was updated to the latest version, the update deleted the existing udisks /etc/polkit-1/localauthority/50-local.d/org.freedesktop.udisks.pkla file. This resulted in no normal user access to hard drive partitions, USB flashdrives, and optical disks (CD-ROM's, etc.).

Adding the file back with an edit restored partition access, flashdrive access, and optical disk access. I performed a couple of other steps which may have been needed as well, such as add my user to the disk group and creating a temporary udev rule (for udev 1.74) for optical disks.

The original udisks.pkla file had to be modified after replacing it as follows:
From: Action=org.freedesktop.udisks.*
To: Action=org.freedesktop.udisks.filesystem-mount-system-internal

Thunar maintainer stated the following regarding thunar 1.2.3-2: "Remove org.freedesktop.udisks.pkla; mounting/unmounting of removable media should continue to function through gvfs." I installed gvfs but did not gain additional disk access.

http://projects.archlinux.org/svntogit/packages.git/commit/trunk?h=packages/thunar&id=f87438cf80047f800e516defd2da42f365ff0c70

Additional info:
* package version(s)
thunar 1.2.3-2
gvfs 1.10.1-1
* config and/or log files etc.


Steps to reproduce: Try to access any hard drive partitions from thunar as normal user (on main hard drive) except the arch partition and you get a "Permission Denied" response. Same with USB flashdrives. Optical media does not even show up in thunar.
This task depends upon

Closed by  Ionut Biru (wonder)
Monday, 14 November 2011, 20:49 GMT
Reason for closing:  Not a bug
Additional comments about closing:  read wiki or ask help in forum to learn how to set up correctly your consolekit session
Comment by David Batson (David_Batson) - Friday, 11 November 2011, 18:52 GMT
I should add that I am using Xfce. Consolekit appears to be working correctly.

$ ls /dev/sr0 -l
brw-rw----+ 1 root disk 11, 0 Nov 7 20:35 /dev/sr0

$ getfacl /dev/sr0
getfacl: Removing leading '/' from absolute path names
# file: dev/sr0
# owner: root
# group: disk
user::rw-
user:david:rw-
group::rw-
mask::rw-
other::---
Comment by Ionut Biru (wonder) - Friday, 11 November 2011, 19:06 GMT
your way of starting your graphical environment is faulty
Comment by Ionut Biru (wonder) - Friday, 11 November 2011, 19:11 GMT
you should describe better your setup.

if you use a login manager, say which one or if you use startx, paste ~/.xinitrc.

also uname -a and ck-list-sessions output
Comment by Maksim Yakovlev (lampslave) - Friday, 11 November 2011, 19:37 GMT
Confirm. "Authorization required" for me.
All OK with org.freedesktop.udisks.pkla from /var/lib/polkit-1/localauthority/50-local.d/ (attached two, delete one please).
Comment by David Batson (David_Batson) - Friday, 11 November 2011, 23:36 GMT
$ ck-list-sessions
Session2:
unix-user = '1000'
realname = ''
seat = 'Seat1'
session-type = ''
active = TRUE
x11-display = ':0.0'
x11-display-device = '/dev/tty7'
display-device = ''
remote-host-name = ''
is-local = TRUE
on-since = '2011-11-08T03:32:02.337214Z'
login-session-id = '1'
Session1:
unix-user = '1000'
realname = ''
seat = 'Seat2'
session-type = ''
active = FALSE
x11-display = ':0.0'
x11-display-device = ''
display-device = ''
remote-host-name = ''
is-local = TRUE
on-since = '2011-11-08T03:32:02.214046Z'
login-session-id = '1'

Using polkit-1 file:
/etc/polkit-1/localauthority/50-local.d/org.freedesktop.udisks.pkla
[Local Users]
Identity=unix-user:david
Identity=unix-group:disk
Action=org.freedesktop.udisks.filesystem-mount-system-internal
ResultAny=no
ResultInactive=no
ResultActive=yes

$ groups david
disk lp kmem wheel games video audio optical storage scanner power users[/code]

/home/~/.xinitrc
#!/bin/sh
#
# ~/.xinitrc
#
# Executed by startx (run your window manager from here)

if [ -d /etc/X11/xinit/xinitrc.d ]; then
for f in /etc/X11/xinit/xinitrc.d/*; do
[ -x "$f" ] && . "$f"
done
unset f
fi

# exec gnome-session
# exec startkde
exec startxfce4
# ...or the Window Manager of your choice
# exec ck-launch-session dbus-launch startxfce4

/etc/slim.conf {line to start xfce from /home/~/.xinitrc}
login_cmd exec ck-launch-session /bin/bash -login ~/.xinitrc %session

/etc/inittab {line to start slim}
x:5:respawn:/usr/bin/slim >/dev/null 2>&1

/etc/rc.conf {daemons line}
DAEMONS=(hwclock syslog-ng network netfs crond dbus avahi-daemon cupsd acpid nvram)

EDIT: Edited out polkit-1 files no longer required on my system. Changed udisks.pkla above to reflect my current setup.
Comment by Maksim Yakovlev (lampslave) - Friday, 11 November 2011, 23:40 GMT
[ls@arch ~]$ ls -l /dev/sda3
brw-rw---- 1 root disk 8, 3 нояб. 12 03:02 /dev/sda3

[ls@arch ~]$ getfacl /dev/sda3
getfacl: Removing leading '/' from absolute path names
# file: dev/sda3
# owner: root
# group: disk
user::rw-
group::rw-
other::---
Comment by David Batson (David_Batson) - Saturday, 12 November 2011, 00:09 GMT
# uname -a
Linux myhost 3.1.0-4-ARCH #1 SMP PREEMPT Mon Nov 7 22:47:18 CET 2011 x86_64 Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz GenuineIntel GNU/Linux

I tried renaming udisks.pkla, and sure enough I could not access my hard drive partitions again as a normal user except for the arch partition. The actual message is: 'Failed to mount "52GB File System". Authentication is required.'. The optical drive and usb flashdrive are working now though. My optical disks and usb flashdrive were not showing up in thunar 3 days ago when I posted on the Arch Forums concerning this issue.
Comment by Jan de Groot (JGC) - Saturday, 12 November 2011, 11:17 GMT
I think this is caused by not having a polkit agent installed or started.

Ionut: GNOME decided to remove the autostart from polkit-gnome, and it isn't activated by dbus either, so other desktops either need to start it during session startup, or the .desktop file needs to be patched to autostart in desktops like Xfce.
Comment by Ionut Biru (wonder) - Saturday, 12 November 2011, 11:23 GMT
the autostart is there...
Comment by Jan de Groot (JGC) - Saturday, 12 November 2011, 13:21 GMT
Then I guess XFCE doesn't include it somewhere in the dependency list and the user didn't install it.
Comment by David Batson (David_Batson) - Saturday, 12 November 2011, 13:56 GMT
"GNOME decided to remove the autostart from polkit-gnome, and it isn't activated by dbus either, so other desktops either need to start it during session startup, or the .desktop file needs to be patched to autostart in desktops like Xfce."

Don't know about that, but how can the udisks.pkla file work on boot up if polkit autostart is not working? If I use the udisks.pkla file, thunar works for all partitions as regular user soon as I log into Xfce from SLiM.

Note: I edited the udisks.pkla file above to reflect the change I had made from 'storage' to 'disk'. I had copied the udisks.pkla file contents from a forum post I made a few days ago (I since changed a couple of lines in udisks.pkla after the udev update). I understand that udev no longer uses the storage group, but instead the disk group.
Comment by Ionut Biru (wonder) - Saturday, 12 November 2011, 13:58 GMT
everything you did is plain wrong.

do you have polkit-gnome installed?
Comment by Maksim Yakovlev (lampslave) - Saturday, 12 November 2011, 14:13 GMT
No. I installed polkit-gnome after your comment, and it fix my problem. But polkit need root password for mount, how can I configure it for use user password like gksudo?
Comment by Ionut Biru (wonder) - Saturday, 12 November 2011, 14:15 GMT Comment by David Batson (David_Batson) - Saturday, 12 November 2011, 14:17 GMT
"everything you did is plain wrong."
I am not sure if that is directed at me - I suppose so. Not a helpful comment IMO.

"do you have polkit-gnome installed?"
Just checked - No.

# pacman -Ss polkit
extra/polkit 0.102-1 [installed]
Application development toolkit for controlling system-wide privileges
extra/polkit-gnome 0.105-1
PolicyKit integration for the GNOME desktop
extra/polkit-kde 0.99.0-1
Daemon providing a polkit authentication UI for KDE
extra/polkit-qt 0.99.0-1
A library that allows developers to access PolicyKit API with a nice
Qt-style API
Comment by Maksim Yakovlev (lampslave) - Saturday, 12 November 2011, 14:32 GMT
@Ionut Biru (wonder), thanks. May be polkit-gnome must be added to Thunar's dependences or optional dependences with comment about this situation?
Comment by David Batson (David_Batson) - Saturday, 12 November 2011, 17:18 GMT
Comment by Dominik (cpcgm) - Monday, 14 November 2011, 17:40 GMT
I have polkit-gnome installed but I don't know how to start it. Is it this line in .xinitrc?

> exec ck-launch-session dbus-launch --exit-with-session xmonad

I can't mount my USB stick and my Kindle anymore. Neither in Thunar nor in Nautilus. They show up but once I click them I get a "Not authorized" error.
Comment by ozar (ozar) - Monday, 14 November 2011, 20:34 GMT
Just in case it helps any, or matters... I'm running Xfce4 and I too get "not authorized" errors when trying to mount an extra storage partition that's on my main drive after upgrading to thunar 1.2.3-2 from the previous version (1.2.3-1), whereas there are no problems to report if thunar is then downgraded to the previous version. Adding the ".pkla" file that the newer thunar removes also allows the partition to be mounted again. No display manager is used on my setup, and no other packages have been removed or added, or any other changes made by me.
Comment by Ionut Biru (wonder) - Monday, 14 November 2011, 20:43 GMT
ok guys, i'll close this report as works for me. the tracker is NOT a forum.

@ozar your setup is incorrectly configured, refer to wiki or ask for help in forums.

*.pkla files are just workarounds to your original problem.

Loading...