FS#33244 - [polkit] cannot run gui apps with pkexec

Attached to Project: Arch Linux
Opened by Mihai Coman (z0id) - Sunday, 30 December 2012, 13:36 GMT
Last edited by Evangelos Foutras (foutrelis) - Thursday, 31 January 2013, 14:17 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Jan de Groot (JGC)
Andrea Scarpino (BaSh)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 4
Private No

Details

Description:

Running a X application with pkexec fails with a "cannot open display" error, even though the appropriate policy file with allow_gui is in place.

Additional info:
https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/997506
The above launchpad bug mentions it's KDM only, but I can't verify that since I use KDE.

* package version(s)

polkit 0.107-4

Steps to reproduce:

ex: gparted, unetbootin use pkexec

Fix:

Add the following line in /etc/pam.d/polkit-1:
session optional pam_xauth.so
This task depends upon

Closed by  Evangelos Foutras (foutrelis)
Thursday, 31 January 2013, 14:17 GMT
Reason for closing:  Fixed
Additional comments about closing:  polkit 0.109-1
Comment by Gerardo Exequiel Pozzi (djgera) - Sunday, 30 December 2012, 16:43 GMT
I can not reproduce this.
Comment by Mihai Coman (z0id) - Sunday, 30 December 2012, 16:54 GMT
I'm using kde 4.10 from kde-unstable; perhaps this is of consequence. I'll post on the kde-unstable topic to see if anyone can reproduce this.
Also, mind that unetbootin (maybe others, too) has fallbacks on just about every graphical sudo/su program.
Comment by Andrea Scarpino (BaSh) - Sunday, 30 December 2012, 17:15 GMT
Confirmed.

% pkexec kwrite
kwrite: cannot connect to X server
Comment by Alexander F. Rødseth (xyproto) - Thursday, 03 January 2013, 12:37 GMT
Confirmed. See also  FS#33243  for an example of how unetbootin fails with polkit/pkexec, after introducing a policy file.
Comment by Alexander F. Rødseth (xyproto) - Sunday, 06 January 2013, 23:41 GMT
djgera, are you able to reproduce if you use ie. pekwm instead of gnome/kde (if that's what you used)?
Comment by Jan de Groot (JGC) - Monday, 07 January 2013, 11:47 GMT
Is this fixed with polkit 109?
Comment by Andrea Scarpino (BaSh) - Monday, 07 January 2013, 12:23 GMT
no Jan.
Comment by Mihai Coman (z0id) - Monday, 07 January 2013, 14:16 GMT
Works here with polkit 109. Andrea, is your ~/.Xauthority file in order?
Comment by Andrea Scarpino (BaSh) - Monday, 07 January 2013, 14:36 GMT
uhm...I thought that a logout/login was fine, but I didn't reboot.

Free to close this then. I'll investigate later.
Comment by Gerardo Exequiel Pozzi (djgera) - Monday, 07 January 2013, 15:02 GMT
@Alexander: No, using KDE, also tested under the most basic TWM, both started from startx.
Attached to policy file to test. No issues here. (polkit 0.107-4)
   org.xorg.xev.policy (0.6 KiB)
Comment by Alexander F. Rødseth (xyproto) - Thursday, 24 January 2013, 13:03 GMT
Debian seems to just have worked around this issue in packages using xterm+pkexec: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678847

This is still an issue here with the latest version of polkit and pekwm. It works in a terminal, but not with alt-f2 or from xfce4-menu.
As I gather, there are other lightweight windowmanagers that pkexec also doesn't work with.
Comment by Alexander F. Rødseth (xyproto) - Thursday, 24 January 2013, 13:11 GMT
Running /usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1 first solved the issue here. (Thanks foutrelis)
Comment by Evangelos Foutras (foutrelis) - Thursday, 24 January 2013, 13:21 GMT
pkexec from polkit 0.109-1 should work fine as long as there's an authentication agent running (e.g. polkit-gnome), or it's run in a terminal where it will use a text prompt as a fallback.
Comment by Martín Cigorraga (msx) - Wednesday, 30 January 2013, 12:44 GMT
x86_64 / KDE SC 4.10 / kernel 3.7.4-1-ARCH

pkexec still not working here:
$ pkexec kate
kate: cannot connect to X server

Polkit packages installed:
polkit 0.109-1
polkit-gnome 0.105-1
polkit-kde 0.99.0-2
polkit-qt 0.103.0-1
kcm-polkit-kde-git

Afer trying Mihai's fix (adding the rule to polkit-1) I had systemd asking for a user to authenticate and proceed in the console but just once - which by the way, failed to launch the application with the same error.
Comment by Mihai Coman (z0id) - Wednesday, 30 January 2013, 21:28 GMT
@Martín With the latest polkit, it works fine without modifying polkit-1. What I think you're missing is the .policy file. See  FS#33243  for an example.
Comment by Martín Cigorraga (msx) - Thursday, 31 January 2013, 03:16 GMT
"With the latest polkit, it works fine without modifying polkit-1. What I think you're missing is the .policy file. See  FS#33243  for an example."
Hmm, seems I'm a bit rusty with polkit and pkexec ¬¬

That did it. Now I know how pkexec authenticate applications I can start creating .policy files for the AUR packages I use and don't provide them and send them to 'upstream' packagers.
Thanks!

Loading...