[Pkg-utopia-maintainers] Bug#1076728: elogind: privileged operation with polkit fails

[Simon McVittie]

On Tue, 17 Dec 2024 at 16:40:42 +0000, Mark Hindley wrote:
> On my working setup, polkitd is running

This is not in doubt: if pkexec works, then polkitd must necessarily
be either running, or available for D-Bus autostarting (after which it
will be running). If that wasn't the case then pkexec could not work.

Please see polkit(8) for a diagram of polkit's architecture. The component
that I'm concerned you might not have available on all XFCE systems is the
authentication agent, which is the part that does the actual prompting.

Unfortunately, the authentication agent protocol doesn't include owning
a well-known name on the system bus, so it isn't instantly obvious from
busctl(1) or similar tools whether there is an authentication agent
or not.

The authentication agent will be a process running as you (for example as
the 'test' uid on your test system), connected to the system bus. Depending
on desktop environment, it might be an independent process, or it might be
integrated into a larger process like gnome-shell.

> > You can disable the internal agent for debugging by running a command like:
> > 
> >     pkexec --disable-internal-agent id
> > 
> > which would be closer to an apples-to-apples comparison with other polkit
> > clients. If this fails with the same error message that you have seen for
> > other privileged operations, then the problem is that your polkit agent
> > is absent or not correctly registered with polkitd.

This is an important debugging step: it will discover whether there is
an authentication agent available, other than the one pkexec provides
as a fallback.

    smcv