Tips and tricks for ConsoleKit, PolicyKit, and udev helpers

[SamuliSuominen]

Here is a small checklist to get a working ConsoleKit and PolicyKit setup for your console and X11.

/etc/make.conf:

Code: Select all

USE="consolekit dbus pam policykit udev udisks upower"

/etc/portage/package.use speciality for stable users because their gnome-base/gvfs has USE="udisks" temporarily masked:

Code: Select all

gnome-base/gvfs gdu

Removing cruft and installing required packages and emerging world with --newuse:

Code: Select all

# emerge -C hal hal-info policykit devicekit devicekit-disks devicekit-power 
# emerge -av gvfs udisks upower
# emerge -avDNut world

You need authentication agent installed to replace plain "Not authorized." dialog with useful password dialog:

For GTK+ based desktops:

Code: Select all

# emerge -av polkit-gnome

Alternatively:

Code: Select all

# emerge -av lxpolkit

For KDE:

Code: Select all

# emerge -av polkit-kde-agent

If you don't want any agent installed, you should read following documentation after installing polkit:

Code: Select all

$ man 8 polkit

Required kernel options for sys-fs/udisks:

Code: Select all

CONFIG_USB_SUSPEND=y
CONFIG_IDE=n

Required kernel options for sys-auth/consolekit:

Code: Select all

CONFIG_AUDITSYSCALL=y

Stopping cruft and starting daemons:

Code: Select all

# /etc/init.d/hald stop
# rc-update del hald
# rc-update add dbus default
# rc-update add consolekit default
# /etc/init.d/consolekit start

Method to start Xfce from startx (This is without dbus-launch because startxfce4 command itself runs a dbus session and running two is a mistake):

Code: Select all

$ echo 'exec ck-launch-session startxfce4' > .xinitrc
$ startx

Method to start openbox and others which don't run dbus-session on their own from startx:

Code: Select all

$ echo 'exec ck-launch-session dbus-launch --sh-syntax --exit-with-session openbox-session' > .xinitrc
$ startx

You can reuse above openbox or xfce syntax for other desktops. First try without dbus-launch, then with dbus-launch.

Gentoo has following display managers in Portage with native ConsoleKit support:

xdm
slim
lightdm
old gdm-2 (note that gdm-3.8+ removed CK support and only works with systemd)
kdm
lxdm

Make sure to use latest version(s) since some of them gained support only recently.

In the end, you should see active session in or outside of X11:

Code: Select all

$ ck-list-sessions
Session1:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat1'
	session-type = ''
	active = FALSE
	x11-display = ''
	x11-display-device = ''
	display-device = '/dev/tty1'
	remote-host-name = ''
	is-local = TRUE
	on-since = '2010-12-25T09:44:12.519713Z'
	login-session-id = '1'
	idle-since-hint = '2011-01-02T16:04:09.020983Z'
Session3:
	unix-user = '1000'
	realname = '(null)'
	seat = 'Seat1'
	session-type = ''
	active = TRUE                                         <- The most important part. This is what we are aiming at.
	x11-display = ':0'
	x11-display-device = '/dev/tty7'
	display-device = '/dev/tty1'
	remote-host-name = ''
	is-local = TRUE
	on-since = '2011-01-02T16:03:40.847555Z'
	login-session-id = '1'                                <- If this is empty, you propably missed the CONFIG_AUDITSYSCALL=y option in kernel.

Known issues that would prevent this from working:

- You removed nox11 parameter from /etc/pam.d/system-login earlier, but forgot to restore it now that the native ConsoleKit support is available
in your display manager?

- When using the native ConsoleKit support (which is either enabled by USE="consolekit" or always enabled in the different display managers)
you should *not* write commands like dbus-launch or ck-launch-session yourself *anywhere* because the display manager does it for you.

- Entries in /etc/fstab *conflict* with sys-fs/udisks. For example, if you want your cdrom to be handled by udisks (and file manager supporting it, like nautilus, pcmanfm or Thunar) you should *remove entries* related to it from /etc/fstab.

- Need to recompile dev-libs/dbus-glib after deb-libs/glib upgrade. Yes, by hand:

Code: Select all

# emerge -av1 dbus-glib

- Mangled /etc configuration for consolekit, pambase or shadow:

Code: Select all

# emerge -av1 --noconfmem consolekit pambase shadow
# etc-update

I might write proper Gentoo documentation for this later on, but I can't promise anything.

[Kollin]

Tank you!
That was needed please make it sticky!

Hint: It's also good idea to mask sys-apps/hal in /etc/portage/package.mask to prevent it's installation and to detect remaining cruft when emerging world. To remove them.

Sadly k3b requires hal (not as use flag)

[discomfitor]

For those using e17, make sure you have USE="udev ukit" when you build e_dbus/enlightenment and it will be automagically enabled.

[Peach]

great guide, thanks a lot for the effort put into it.

As a side note, I didn't find the need to install polkit-gnome (or equivalent, but I'm using slim) and it seems like everything works as espected

brilliant

[obo68]

... just a small remark,

for me (using an amd64 system) it works even with the stable versions:

• sys-apps/dbus-1.4.1
• dev-libs/dbus-glib-0.88
• sys-auth/pambase-20101024
• sys-apps/shadow-4.1.4.2-r6
• sys-fs/udisks-1.0.1-r2
• sys-power/upower-0.9.5
• sys-auth/polkit-0.96-r1
• gnome-base/gvfs-1.6.4-r2
• gnome-extra/polkit-gnome-9.96-r1

kernel 2.6.36-r5
xorg-server-1.9.2

use flags form /etc/make.conf:

Code: Select all

USE="-hal -arts -kde -qt3 -qt4 -ati X nvidia xvmc a52 aac acpi aim alsa apache2 
audiofile bash-completition bzip2 cdr consolekit crypt cups dbus device-mapper 
dv dvd dvdr dri encode esd exif ffmpeg firefox flac ftp gd gdbm gif glut gnome gnutls 
gphoto2 gstreamer gtk gtkhtml guile hddtemp iconv icq imagemagick imlib innodb 
javascript joystick jbig jpeg jpeg2k latex lcms ldap libgda libwww lm_sensors 
lzo mad mime mmx mng motif mp3 mp4 mpeg mplayer mysql mysqli ncurses nls nptl 
nsplugin odbc ogg openexr opengl oscar pam pdf perl php plotutils png policykit 
posix ppds python quicktime raw readline sdl smp sndfile sockets sox spell sse sse2 
ssl startup-notification svg syslog sysvipc taglib tcpd theora threads tiff 
truetype udev unicode usb v4l2 videos vorbis wmf wxwindows x264 xcb xcomposite 
xface xine xml xmms xpm xscreensaver xv xvid yahoo zlib"

INPUT_DEVICES="evdev joystick"

VIDEO_CARDS="nvidia vesa"

jep, no keyboard and no mouse entry in INPUT_DEVICES!
So, no need to update the gnome branch to the (still unstable) 2.32 version.

In hope this is useful for anyone and encourages the installation of a hal-free env.

Oliver.

[d2_racing]

The guide is sticked now.

If it will be a must to have an official Gentoo documentation about that subject.

[just1602]

Thank you, it's working perfectly on my ~amd64 system with Openbox :- )

I'll try to do the same with my x86 system

@++

Justin

[hal2050]

is it allowed to post problems in this thread or is it rather recommended to start a new thread referring to the sticky?

[slackline]

Required kernel options:

Code: Select all

CONFIG_USB_SUSPEND=y    <- Required for properly shutting down and powering USB hubs, for like, external USB HDD.
CONFIG_IDE=n                    <- This breaks both udev, and udisks.
CONFIG_AUDITSYSCALL=y   <- This is really required, it might work out of fluke with gnome-base/gdm but that's pretty much it.

Just to help with these kernel options (under 2.6.37) you can find them under...

Code: Select all

-> Device Drivers
   -> USB support (USB_SUPPORT [=y])
      -> Support for Host-side USB (USB [=y])
             [*]    USB runtime power management (autosuspend) and wakeup   CONFIG_USB_SUSPEND=y    <- Required for properly shutting down and powering USB hubs, for like, external USB HDD.
-> Device Drivers 
  [ ] ATA/ATAPI/MFM/RLL support (DEPRECATED)   CONFIG_IDE=n                    <- This breaks both udev, and udisks.

-> General setup
  -> Auditing support (AUDIT [=y])
    [*] Enable system-call auditing support  CONFIG_AUDITSYSCALL=y   <- This is really required, it might work out of fluke with gnome-base/gdm but that's pretty much it.

Also CONFIG_USB_SUSPEND is dependent upon...

Code: Select all

 -> Power management and ACPI options
    [*] Run-time PM core functionality  PM_RUNTIME

..which I didn't have selected and had me scratching my head for a minute or two (until I actually read the information on dependencies from searching menuconfig with '/' and searching for USB_SUSPEND)

[slackline]

Quick question.

What if you're not using 'startx' or one of the 'small' login clients?

I'm using gdm, so do I still need to have a custom ~/.xinitrc or make any changes to /etc/pam.d/system-login ?

[SamuliSuominen]

Quick question.

What if you're not using 'startx' or one of the 'small' login clients?

I'm using gdm, so do I still need to have a custom ~/.xinitrc or make any changes to /etc/pam.d/system-login ?

- gdm doesn't use the pam_ck_connector.so
- gdm has internal consolekit support

Therefore:

No changes to system-login or .xinitrc should be required at this time for GDM users.

[slackline]

Thanks for the quick response and writing this guide ssuominen, very, very useful and much appreciated.

[wuzzerd]

Nice sticky. For once I had most of it right.

..which I didn't have selected and had me scratching my head for a minute or two...

My experience exactly, then a minute later I read your post. Heh.

[aramis_qc]

It works fine. But Xfce4 4.8 is not ready to move to stable. Too much problems to be fixed... for example hibernation does not work...

Thank's for the tip ... at least we can say goodbye to hal.

[zoolook]

Hi,

I found this sticky quite useful, even if I instinctively did almost 95% the same before finding it. I'd like to add that users not wanting to deal with gnome or kde or other bloated window managers, or even need automounting just at console level, may use

Code: Select all

sys-fs/udisks-glue-1.2.0

which in its current ebuild unfortunately comes without a config file or a gentoo service script. Well, I uploaded an updated ebuild with initial script and config file at [bug=351644]Bug # 351644[/bug], you may try that out.

One more comment, in recent kernels,

Code: Select all

CONFIG_USB_SUSPEND

may no longer be available, as the devs apparently changed the power management architecture of the USB subsystem.

Cheers,
Lucian

P.S. @ssuominen: gosh, now after sending the initial reply I realize that you're maintaining udisks-glue

[Anon-E-moose]

For those like me, who run a single user system, don't suspend/hibernate, and don't use automounting
they don't need to use "ck-launch-session" or the associated "dbus stuff" in their .xinitrc file.

This is my .xinitrc file and yes it works fine.

Code: Select all

#!/bin/sh
#
# ~/.xinitrc
#
exec > /home/don/.xsession-errors 2>&1
# Executed by startx (run your window manager from here)
#-------------
XDG_CONFIG_HOME="$HOME/.config"
XDG_MENU_PREFIX="lxde-"
XSESSION="LXDE"
export XDG_MENU_PREFIX XSESSION XDG_CONFIG_HOME
eval `cat $HOME/.fehbg` &
exec cairo-compmgr &
exec /usr/bin/lxsession -s DON -e LXDE
#-------------
#exec /usr/bin/openbox-session
#-------------
#XDG_MENU_PREFIX="xfce-"
#XSESSION="Xfce4"
#export XDG_MENU_PREFIX XSESSION
#exec /usr/bin/xfce4-session

I get logout and that's all I really need anyway.

Just an FYI

[mack1]

Thanks a lot for useful guide !!!

Cheers

[NeddySeagoon]

ssuominen,

Works for me ... thanks very much

[toralf]

Code: Select all

# rc-update add consolekit default

WRT please, could you take a look at this https://bugs.gentoo.org/show_bug.cgi?id=351537 ?

[Ant P.]

Is PAM really mandatory now?

[drinstant]

Openbox user here. Thanks for your instructions. I got everything working, but one problem with NetworkManager still persists. Not sure if it's a bug, as it's mentioned all over the place, but it could be related.

Problem is, even following your instructions, ck-list-sessions still gives a single instance, with active = FALSE, which is not supposed to be the case as you'll agree. nm-applet will refuse do do anything as non-root (enable/disable networking or connect to anything). My guess is, that the two are related (as it seems to be a permission-problem). If not, then forgive me for spamming this topic.

[SamuliSuominen]

Is PAM really mandatory now?

Yep. I don't know of other ways of hooking the login (shadow) to consolekit.

Unless you count gnome-base/gdm as an option, it's internal consolekit support should work without pam... but this might change at anytime, it's really supposed to be using the same method others are and maintainers might change it soon.

[SamuliSuominen]

Problem is, even following your instructions, ck-list-sessions still gives a single instance, with active = FALSE, which is not supposed to be the case as you'll agree. nm-applet will refuse do do anything as non-root (enable/disable networking or connect to anything). My guess is, that the two are related (as it seems to be a permission-problem). If not, then forgive me for spamming this topic.

The whole point of this thread was to get 'active = TRUE' so something's definately wrong in your end.

[drinstant]

The whole point of this thread was to get 'active = TRUE' so something's definately wrong in your end.

Finally got it working, by re-emerging consolekit mith --noconfmem. Phew, don't know why this was the thing that did it.

[IgorPashev]

xfce should startx with

Code: Select all

ck-launch-session dbus-launch xfce4-session

within /etc/xdg/xfce4/xinitrc

ck-launch-session startxfce4 does not work for me (no power managment, no mount)
and
ck-launch-session xfce4-session is not enough (I can't mount/umount media by desktop or Thunar,
but can do it in terminal emulator).