[Pkg-utopia-maintainers] Bug#1076728: elogind: privileged operation with polkit fails

[Yves-Alexis Perez]

On Tue, Dec 17, 2024 at 10:53:39AM +0000, Simon McVittie wrote:
> Context for XFCE and polkitd maintainers (cc'd): a user of XFCE on a
> sysvinit/elogind system has found that authorizing privileged operations
> via polkit is not working as intended. I'm not at all sure that this is
> actually an elogind problem: it might be a result of XFCE not obviously
> containing a polkit agent (the component that does the actual prompting).

Hey Simon,

I'm a bit unsure how to reply to your mail because I don't really see
questions. Still providing some bits which might be helpful.
> 
[...]
> 
> I am not familiar with XFCE, but I believe it is meant to include a polkit
> agent of some sort? I can't find a particularly obvious candidate among
> the packages that depend on libpolkit-agent-1-0 or provide
> polkit-1-auth-agent, though. It might be helpful to install a standalone
> polkit agent (perhaps lxpolkit or mate-polkit) and see what happens if you
> run it manually before triggering a privileged operation.

Xfce doesn't provide an authentication agent, as far as I can tell.
There was an xfce-polkit agent tentative
https://github.com/ncopa/xfce-polkit but it didn't really pick up, is
not really maintained and we never packaged it in Debian.
> 
[...]
> 
> Historically the polkit agent of last resort was policykit-1-gnome (which
> was the one that was used in GNOME 2), but that one is unmaintained
> upstream (a concerning situation for a security-critical component!) and
> no longer accepts bug reports or merge requests, so the polkit maintainers
> are trying to arrange for it not to be included in trixie (#990271).
> Please do not rely on policykit-1-gnome. If it is the most suitable polkit
> agent for XFCE, then the XFCE team will need to fork it and become the new
> upstream maintainers of the fork.
> 
On this box I'm apparently indeed using policykit-1-gnome. I think we
might use mate-polkit without too much issues (although it brings
accountsservice as a new dependency).

Regards,
-- 
Yves-Alexis