[Pkg-lxde-maintainers] Bug#1008313: lxpolkit: no authentication dialog can't use it

[Simon McVittie]

Control: severity -1 normal
Control: tags -1 + moreinfo unreproducible

On Fri, 30 Dec 2022 at 21:33:06 +0200, Andriy Grytsenko wrote:
> I use LXDE myself each day, I cannot say it's *nearly useless*
> but many people use it and rarely have problems.

I happen to have installed a Debian 12 virtual machine with LXDE recently
while investigating a different bug, so I tried checking what happens in a
default installation.

By default, task-desktop-lxde installs both lxpolkit (lxsession dependency)
and policykit-1-gnome (gnome-system-tools dependency). With these installed,
when I am logged in to a LXDE session, pkexec works as expected. I didn't
test gparted.

I also tried removing policykit-1-gnome (which requires removing
gnome-system-tools) so that lxpolkit was the only polkit agent on the
system, and then rebooting. With only lxpolkit installed, when I am
logged in to a LXDE session, pkexec and gparted both work as expected.

LXDE is not my preferred desktop environment and has more dependencies on
unmaintained components than I'm really happy about, but I confirm that
it works, is not useless, and does not need to be removed from bookworm.

On Sat, 26 Mar 2022 at 17:59:53 +0100, realroot wrote:
> If I try to use pkexec:
>
> ==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
> Authentication is needed to run `/usr/bin/env' as the super user
> Authenticating as: root
> Password:
> polkit-agent-helper-1: error response to PolicyKit daemon:
> GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
> ==== AUTHENTICATION FAILED ===
> Error executing command as another user: Not authorized
...
> If I try to launch a program tha requires root like gparted:
> 
> /usr/sbin/gparted
> Error executing command as another user: No authentication agent found.

I suspect the situation here might be that the user reporting the bug is
not using a complete desktop environment, but has installed individual
packages to make their own desktop environment out of components.

This is something that can be made to work, but if you do this, it's up
to you to make sure you're running all the necessary pieces, and that
includes choosing and running a suitable polkit agent.

For example, if I log in to a plain Openbox session, that doesn't
include a polkit authentication agent, and running gparted will fail;
but if I run `lxpolkit &` and then run gparted again, this time I get
a lxpolkit prompt. A more realistic setup would be to run both openbox
and lxpolkit from ~/.xsession.

It is not possible to auto-start a polkit agent via D-Bus activation,
because the system does not know which of potentially several polkit
agents is the one you wanted to include in your desktop environment.

pkexec is meant to be able to operate without a polkit agent, but
something is wrong in its implementation, leading to the "No session for
cookie" error message (this is a known bug, #1031676). systemctl is an
example of a component that can do the equivalent thing correctly. If
someone works out what pkexec is doing wrong, patches would be welcome.

    smcv