Tips and tricks for ConsoleKit, PolicyKit, and udev helpers

[turtles]

This is a serious question:

Option 5
[your idea here]

Option 5
Read the portage output (and don't use obsolete display managers like SLIM)

When you emerge consolekit, it will print a warning if CONFIG_AUDITSYSCALL=y is missing
When you emerge udisks, it will print a warning if CONFIG_USB_SUSPEND=y is missing or CONFIG_IDE=y mistakenly set
When you emerge glib, it will print a warning that
might need a rebuild
... and there are more, to cover each case

Then you simply emerge gdm, kdm, or lightdm. Any modern display manager with built-in ConsoleKit support. Or use startx and read the Gentoo documentation for your desktop, such as http://www.gentoo.org/doc/en/xfce-config.xml#doc_chap3 clearly documenting ck-launch-session.

Everything will just work(tm)

If a user is not experiencing the:

just works(tm)

*kit system,
then the troubleshooting steps would be:

Code: Select all

 grep -e 'CONFIG_AUDITSYSCALL' -e 'CONFIG_USB_SUSPEND' -e 'CONFIG_IDE ' /usr/src/linux/.config

Output should be:

Code: Select all

CONFIG_AUDITSYSCALL=y
# CONFIG_IDE is not set
CONFIG_USB_SUSPEND=y

Then

Code: Select all

emerge -1 dev-libs/dbus-glib

Then if the system still just does not work post here describing there case?

[Ant P.]

??? What is the problem with SLIM ?
First of all, it still part of some white paper on this site (don't remember which one, but it's related to openbox or Lxde. And secondly, it's working fine as per my own installation.

Thanks for reading.

Works fine here too, though that may be because I'm using Openbox on one machine and Compiz on another, and *kit on neither.

[destroyedlolo]

Hum, I'm using LXDE on all machines with *kit and I haven't problem but [topic=903318]this one[/topic] that happens only on one machine.

[zzxop]

it works. thank you very much

[salmonix]

Dear ssuominen,

could you include a section on Troubleshooting at the end of your howto with the followings:

symptom: when logout in xfce4 the logout widget pops up after a delay, and only logout is allowed. Suspend key is not present - despite of having xfce4-power-manager. Automounting a device does not happen, despite of having the automount plugin.
In /var/log/messages ( or in some messages, anyway, ) the following is found:

Dec 13 10:49:46 [dbus] [system] Activated service 'org.freedesktop.UDisks' failed: Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success

upower -d may drop the same error.
USE flags: polkit consolekit -policykit

Also messages may report lxpolkit segfault. polkit-gnome does not seqfault and more verbose on messages.

Solution: check the permission of /usr/libexec/dbus-daemon-launch-helper. It should be o+x.

See my monologue:http://forums.gentoo.org/viewtopic-t-905298.html

If it already reported, pls, ignore this.
Bests.

[SamuliSuominen]

Dear ssuominen,

could you include a section on Troubleshooting at the end of your howto with the followings:

Solution: check the permission of /usr/libexec/dbus-daemon-launch-helper. It should be o+x.

That's wrong and propably exposes the system to various local root exploits. This has been covered multiple times in this same thread already. For some people, simply re-emerging dbus and dbus-glib made the problem go away...

[haarp]

Ok, I've had this running fine for months, until I rebooted just now. My suspend/shutdown rights have been stripped all of a sudden.

Yes, I'm starting Xfce with 'ck-launch-session startxfce4', and consolekit should be working. It's set as active:

Code: Select all

$ ck-list-sessions | head -n13
Session7:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat1'
	session-type = ''
	active = TRUE
	x11-display = ':0.0'
	x11-display-device = '/dev/tty7'
	display-device = ''
	remote-host-name = ''
	is-local = TRUE
	on-since = '2011-12-25T16:49:01.497216Z'
	login-session-id = '18'

$ xfce4-power-manager --dump
---------------------------------------------------
       Xfce power manager version 1.0.10
With policykit support
With network manager support
With DPMS support
---------------------------------------------------
Can suspend: True
Can hibernate: False
Can spin down hard disks: True
Authorized to suspend: False
Authorized to hibernate: False
Authorized to shutdown: False
Authorized to spin down hard disks: False
Has brightness panel: True
Has power button: True
Has hibernate button: True
Has sleep button: True
Has LID: True

EDIT: Never mind, it works now. I have re-emerged dbus and glib stuff and removed 'ck-launch-session' from my slim scripts, as per the postinst message of the slim ebuild. It's working now!

[drvik]

Hi guys,

Could someone help me please... I have successfully installed this on an XFCE/SLIM mythtv server, but now, I'm trying to do the same on a dedicated myth front end...

The fronted is configure to autostart as per http://dev.gentoo.org/~cardoe/mythtv/autostart.html

Just to be clear, there is no window manager, init automatically logs in the mythtv user, which triggers startsx via the .bash_profile script.... evilwm is then executed from .xinintrc

Code: Select all

$ cat .bash_profile 

# .bash_profile
case "`tty`" in
	*tty8) startx; logout ;;
esac

Code: Select all

$ cat .xinitrc 

# .xinitrc
[ -x /usr/bin/nvidia-settings ] && /usr/bin/nvidia-settings -l
/usr/bin/xset s noblank
/usr/bin/xset s off
/usr/bin/xset -dpms
exec ck-launch-session dbus-launch --exit-with-session /usr/bin/evilwm &
exec /usr/bin/mythfrontend --logpath /var/log/mythtv --verbose general --loglevel info

Code: Select all

cat /etc/X11/Sessions/evilwm 

#!/bin/sh
exec "/usr/bin/evilwm"

With this setup as it is I get the following output...

Code: Select all

$ ck-list-sessions

Session1:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat1'
	session-type = ''
	active = FALSE
	x11-display = ''
	x11-display-device = ''
	display-device = '/dev/tty8'
	remote-host-name = ''
	is-local = TRUE
	on-since = '2012-01-03T00:52:33.536891Z'
	login-session-id = '11'
Session2:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat1'
	session-type = ''
	active = TRUE
	x11-display = ':0'
	x11-display-device = '/dev/tty7'
	display-device = '/dev/tty8'
	remote-host-name = ''
	is-local = TRUE
	on-since = '2012-01-03T00:52:57.241880Z'
	login-session-id = '11'
Session3:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat2'
	session-type = ''
	active = FALSE
	x11-display = ''
	x11-display-device = ''
	display-device = '/dev/ssh'
	remote-host-name = 'viktors-laptop.lan'
	is-local = FALSE
	on-since = '2012-01-03T00:54:08.435788Z'
	login-session-id = '12'

Session 3 is obviously my SSHed user that I'm using right now to pull the info... I can see TRUE in Session 2 but FALSE in Session 1... so does this mean it's setup correctly??

The problem is, that USB drives are not being auto mounted, however "disks --mount /dev/sdc1" works....

Given that I am using a basic window manager on a dedicated mythfrontend box, I really only need auto mounting, and no "logout/reboot/shutdown" buttons enabled... I have configured sudo access to those via sudoers...

So my question is, how do I set this up to auto mount my USB drives, AND is this overkill for my application? Should I scrap all this and find some simpler, cleaner way of auto mounting????

drvik

[krovisser]

Then you simply emerge gdm, kdm, or lightdm. Any modern display manager with built-in ConsoleKit support. Or use startx and read the Gentoo documentation for your desktop, such as http://www.gentoo.org/doc/en/xfce-config.xml#doc_chap3 clearly documenting ck-launch-session.

That same documentation says to use Slim (section 4.3)...

[VinzC]

Hi all.

I need your wise help too.

I have never been able to make mounts work with Xfce ( 4.8 ) other than from GDM. I can run startx, startxfce, ck-launch-session startxfce4, ck-launch-session dbus-launch startxfce4, ck-launch-session dbus-launch xfce4-session (the latter in a modified /etc/xdg/xfce4/xinitrc) as many times as I can I never never never ever can mount disks nor reboot the machine from Xfce when run from outside of GDM. ck-list-sessions desperately and only lists inactive sessions...

The only way I could sort this out was to:

1. create an .xinitrc with exec ck-launch-session dbus-launch xfce4-session and
2. type startx on a TTY. (Just startx, not startxfce4!)

Any other attempt shows ACTIVE session is FALSE.

I use my machine in two distinct ways:

1. from GDM (which, as I said, allows mounts, shutdown, reboot, blah)
2. from Qingy, without GDM

Qingy is always active but I use a dedicated runlevel to run GDM. So how should I setup these stuff to have Xfce use policykit *at last* when not run from GDM?

I have recompiled dbus-glib and the three other packages as well, no way.

Thanks in advance for any hint or suggestion.

[disperato]

I don't really like to bore people without lurking before, but a problem arose with "new style" based on ck-launch-session.

Having followed every single step of the first post written byssuominen, everything works well if I just type startx. But...

I have gentoo with xfce4 on a laptop and sometimes I need dual monitor (no xinerama or other things, just two monitors with two desktops).
For this complicate matter I used two layouts in /etc/X11/xorg.conf, no .xinitrc set, ad a script I could invoke as a user as well, placed in /usr/sbin,
called startx.on that could be called with

Code: Select all

startx.on laptop (default to startx.on with no argument)
startx.on dual

Here my old startx.on:

Code: Select all

#!/bin/bash
#ver: 0.1 - date: 2010-03-10
case $1 in
#"") #echo "" ;;
"laptop"|"") #echo "laptop" ;;
xinit /etc/xdg/xfce4/xinitrc -- -layout laptop ;;
"dual") #echo "dual" ;;
xinit /etc/xdg/xfce4/xinitrc -- -layout dual ;;
esac

Correct me if I'm wrong, but seems to me that the new system does not allow the same flexibility. If suspend and other upower functions are needed, the only way to go is the ck-launch-session line in .xinitrc

Code: Select all

exec ck-launch-session startxfce4

Modified versions of my script like the following don't work.

Code: Select all

#!/bin/bash
#ver: 0.2 - date: 2012-02-10
case $1 in
#"") #echo "" ;;
"laptop"|"") #echo "laptop" ;;
#xinit /etc/xdg/xfce4/xinitrc -- -layout laptop ;;
startx -layout laptop ;;
#xinit /etc/xdg/xfce4/xinitrc -- -layout laptop ;;
"dual") #echo "dual" ;;
#xinit /etc/xdg/xfce4/xinitrc -- -layout dual ;;
startx -layout dual ;;
esac

How can I get back again the chance of starting different layouts under xfce4 ( -4.8 )?

Please help.

[disperato]

It's working now. What did the trick was editing the .xinitrc files for both user and root:

Code: Select all

#!/bin/bash
case $1 in
"laptop"|"") #echo "laptop" ;;
exec ck-launch-session startxfce4 -- -layout laptop ;;
"dual") #echo "dual" ;;
exec ck-launch-session startxfce4 -- -layout dual ;;
esac

and starting xfce with one of these three, as needed:
either xinit or xinit laptop to start xfce on my laptop monitor only
xinit dual for starting both monitors

I don't want to hijack this thread with other issues, just put my own answer in case some people had the same problem after upgrading to this new version of xfce4 with the consolekit stuff and related thingies.

[cybertronix]

*kit is all a big mess. For me, I had active sessions in ck-list-sessions and still I couldn't mount anything, and got the "Not authorized" message.

I had to go to /usr/share/polkit-1/actions/org.freedesktop.udisks.policy and change the following block to code to say "yes".

Code: Select all

  <action id="org.freedesktop.udisks.filesystem-mount">
    <description>Mount a device</description>
    <description xml:lang="da">Montér en enhed</description>
    <message>Authentication is required to mount the device</message>
    <message xml:lang="da">Autorisering er påkrævet for at montere et fil system</message>
    <defaults>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

Copying this file to /etc/polkit-1/actions and modifying these strings doesn't help. So, to prevent it from being overwritten the next time polkit is updated, add the directory /usr/share/polkit-1/actions to CONFIG_PROTECT in make.conf.

This is what I had to do as well. So not only do you have to get the kernel options, a number of different services, and session command right, and then hope that you caught the message about rebuilding dbus-glib the last time you upgraded glib, but even if you do all of that right the application doesn't properly obey its own configuration to allow active sessions to mount drives or properly read the local configuration directory when you try to override that, so you have to hack the system configuration files to actually get it working. This is progress?

But big thanks to everyone in this thread. Without it I would never have figured this out (especially since apparently I can't read - I thought I had disabled CONFIG_IDE, but it turns out I hadn't ).

[knob-creek]

OK, polkit/consolekit JustWorks ... on Ubuntu. They don't, here.

Here is:
xdm + xfce, nox11 re-inserted into pam.d/system-login, ck-launch-session removed from .xsession

They don't is: shutdown / reboot greyed out.

They actually did until xdm received the blessing of being consolekit aware . They still do if xdm is compiled with -consolekit (as i did inadvertently on another machine) and the manual changes are left as is.

I have an active local session:

Code: Select all

Session2:
        unix-user = '100'
        realname = 'Thomas'
        seat = 'Seat1'
        session-type = ''
        active = TRUE
        x11-display = ':0'
        x11-display-device = '/dev/tty7'
        display-device = ''
        remote-host-name = ''
        is-local = TRUE
        on-since = '2012-02-22T23:55:56.595675Z'
        login-session-id = '13'
Session1:
        unix-user = '100'
        realname = 'Thomas'
        seat = 'Seat2'
        session-type = ''
        active = FALSE
        x11-display = ':0'
        x11-display-device = ''
        display-device = ''
        remote-host-name = ''
        is-local = TRUE
        on-since = '2012-02-22T23:55:56.554671Z'
        login-session-id = '13'

There is also a nice message when i log in:

Code: Select all

Feb 22 23:39:43 greve xdm[3446]: pam_unix(xdm:account): password for user tom will expire in 3 days
Feb 22 23:39:53 greve xdm[3446]: pam_unix(xdm:session): session opened for user tom by (uid=0)
Feb 22 23:39:53 greve xdm[3446]: pam_mount(mount.c:65): Messages from underlying mount program:
Feb 22 23:39:53 greve xdm[3446]: pam_mount(mount.c:69): realpath /dev/sdb: No such file or directory
Feb 22 23:39:53 greve xdm[3446]: pam_mount(pam_mount.c:521): mount of /dev/sdb failed
Feb 22 23:39:54 greve polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session1 (system bus name :1.5 [/usr/libexec/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale de_DE.utf8)

What annoys me most is that i have absolutely no clue what happens or what i could do to analyse the problem. (Yes, i did recompile glib, dbus, and dbus-glib.)

[urcindalo]

Hi everyone!

I'm afraid I'm one more to add to the list of no-clues-whatsoever.

I manage an VMWare virtual i686 Gentoo box, running latest KDE es DE.
The box runs stable packages except for a few scientific ones (just 13 ~x86 including open-vm-tools).
I have followed the directions explained in post #1 to the letter, including of course every indicated re-emerge and a few more of my own. My system is completely up-to-date. I run this procedure:
1) sudo eix-sync && sudo eix-remote update
2) sudo emerge --update --newuse --deep --ask -vt --with-bdeps=y @world
3) sudo localepurge && sudo find /var/log/ -name "*.log" -mtime +1 -exec bzip2 -z '{}' \; && sudo find /var/log -name "*.bz2" -mtime +30 -exec rm '{}' \; && sudo emerge --ask -v --depclean && sudo eclean -d distfiles && sudo eclean -d packages && sudo portpeek -arf
4) sudo revdep-rebuild -v
5) I also read every elog and act accordingly.

Even my session seems to be active:

Code: Select all

$ ck-list-sessions
Session1:
        unix-user = '1000'
        realname = '(null)'
        seat = 'Seat1'
        session-type = ''
        active = TRUE
        x11-display = ':0'
        x11-display-device = '/dev/tty7'
        display-device = ''
        remote-host-name = ''
        is-local = TRUE
        on-since = '2012-02-27T11:20:30.024328Z'
        login-session-id = '12'

However, I see the infamous polkit error whenever I log into KDE. These lines appear on my /var/log/messages:

Code: Select all

Feb 27 12:20:15 localhost start-stop-daemon: pam_unix(start-stop-daemon:session): session opened for user nobody by (uid=0)
Feb 27 12:20:15 localhost dbus[1678]: [system] Activating service name='org.freedesktop.PolicyKit1' (using servicehelper)
Feb 27 12:20:15 localhost dbus[1678]: [system] Activated service 'org.freedesktop.PolicyKit1' failed: Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success
Feb 27 12:20:15 localhost console-kit-daemon[1706]: WARNING: polkit_authority_get: Error getting authority: Error initializing authority: Error calling StartServiceByName for org.freedesktop.PolicyKit1: GDBus.Error:org.freedesktop.DBus.Error.Spawn.ExecFailed: Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success
...
Feb 27 12:20:31 localhost dbus[1678]: [system] Activating service name='org.freedesktop.UPower' (using servicehelper)
Feb 27 12:20:31 localhost dbus[1678]: [system] Activated service 'org.freedesktop.UPower' failed: Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success
...Feb 27 12:20:31 localhost dbus[1678]: [system] Activating service name='org.freedesktop.UDisks' (using servicehelper)
Feb 27 12:20:31 localhost dbus[1678]: [system] Activated service 'org.freedesktop.UDisks' failed: Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success
...

I really don't know what to do. I run other two "real" boxes, which do not show these problems.

Any help will be really appreciated.

PS: I forgot to mention I also get an error when trying to change, for instance, the kdm config, even as root. I see this error when trying to save the changes

Code: Select all

Unable to authenticate/execute the action:  (code 3)

[SamuliSuominen]

Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success

This has been covered by this same thread 2-3 times if take the time to read all the conversation.

Tends to boil down to:

# emerge -1va dbus dbus-glib

And if that doesn't help:

# emerge -1vae dbus dbus-glib

[urcindalo]

Failed to execute program /usr/libexec/dbus-daemon-launch-helper: Success

This has been covered by this same thread 2-3 times if take the time to read all the conversation.

Tends to boil down to:

# emerge -1va dbus dbus-glib

I had already done that, to no avail, several times before I found this thread.

And if that doesn't help:

# emerge -1vae dbus dbus-glib

In fact, I'm being more aggressive and running an "emerge -vtae @world" since yesterday.
Will post the result when done.

[novazur]

The solution for me is/ was

chmod o+x /usr/libexec/dbus-daemon-launch-helper

after that all is well and i´m happy

With a fresh install, I had to do the same. I don't really understand why...

[urcindalo]

The solution for me is/ was

chmod o+x /usr/libexec/dbus-daemon-launch-helper

after that all is well and i´m happy

With a fresh install, I had to do the same. I don't really understand why...

Also for me.
Even after an "emerge -vtae @world", followed by an "emerge -1vae dbus dbus-glib", the failure was still there

[xenon]

I know it's kind of a noob question and I should know better, but a doubt just hit me: after a kernel upgrade, it's not necessary to rebuild packages like udev and consolekit (and others, of course) that relate with kernel sources, right?

[miket]

So not only do you have to get the kernel options, a number of different services, and session command right, and then hope that you caught the message about rebuilding dbus-glib the last time you upgraded glib, but even if you do all of that right the application doesn't properly obey its own configuration to allow active sessions to mount drives or properly read the local configuration directory when you try to override that, so you have to hack the system configuration files to actually get it working. This is progress?

No, it's not progress. They force us to go through all of this just so they can support a very specialized usage case. How many people do you know who run computers with multiple keyboards and monitors (therefore "multi-seat") and need to be sure that random people sitting at those seats around the computer don't get access they shouldn't?

Oh sure--doesn't everyone have a RAID array plugged into his laptop or a force-feedback game controller plus high-end audio and graphics on his web server? No? You mean that you don't every single option enabled at once?

That's right, no! Being able to plug in the things I need and omit what I don't is the biggest reason I like Gentoo. I have a login on my laptop and my desktop machines, I'm the only user. And if I did share the machines with other users, I'd be more concerned about the files they could access than I would with whatever devices they could plug in. As it stands, if someone came to one of those machines when it was not logged in (or the screen was locked), they couldn't get access anyway. (Except, of course, that they'd have physical access--and even Policykit wouldn't stop that kind of break-in.)

So, given that Unix logins restrict access to my computers, and since other people don't have accounts anyway, I'm not awfully concerned that I do this:

Code: Select all

# chmod o+x /usr/libexec/dbus-daemon-launch-helper

I hadn't done that before today, but after having just gone to just-now-stabilized Polkit 0.107-r1 in a world update in which I also upgraded dbus-glib, and had to struggle to get my KDE working right again, I really get to resent those Gnomes getting their grubby hands on my computer.

What would be wonderful would be a way to stub out the API's of Policykit and Consolekit to null versions so that they wouldn't be a bother to people who don't need them. Just today I had the pleasure of setting up a KVM instance that has Fluxbox and Slim and no *kits. I wish that KDE could also go kitless.

[VinzC]

Oh sure--doesn't everyone have a RAID array plugged into his laptop or a force-feedback game controller plus high-end audio and graphics on his web server? No? You mean that you don't every single option enabled at once?

When exception becomes the rule, right?

[cybertronix]

What would be wonderful would be a way to stub out the API's of Policykit and Consolekit to null versions so that they wouldn't be a bother to people who don't need them. Just today I had the pleasure of setting up a KVM instance that has Fluxbox and Slim and no *kits. I wish that KDE could also go kitless.

That's actually an interesting thought. I wonder how difficult it would be to write a dummy version of both that always returns "yes" when something asks for permission. If the public API isn't too complex that might be a good way to handle the usual single-user system that almost everyone is running.

Unfortunately, given the complexity of the *kits that would probably be more difficult than it seems.

[krigav]

I don't know if it has been already mentioned...

But to be able to mount/unmount all external and internal drives as a normal user and without any polkit agent (like polkit-gnome) I did this.

1. create a new rule for polkit: new file /etc/polkit-1/rules.d/10-udisks.rules with the following text

Code: Select all

 
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.udisks2.filesystem-mount-system" &&
            subject.isInGroup("wheel")) {
	            return polkit.Result.YES;
    }
});

2. add you user to the group wheel:

Code: Select all

gpasswd -a user wheel

3. eventually reboot your system

Now you should be able to do the mount/unmount operation without any password prompt.

HTH

[DaggyStyle]

hello,

as kde 4.10 must have udisks2, I had no choice and upgraded udev to 197.
the issue is that now when I cannot mount usb msd as normal user, for me it is a deal breaker, I cannot have it.

how can I fix this? I need the ability to automount usb msd via kde as it was in 4.9.5.