Home / ubuntu / Questions / 1032687
Accepted
Suncatcher
Asked: 2018-05-07 01:36:46 +0800 CST

Polkit pkla rule is not working on 18.04

  • 772

I have troubles with infamous colord policy prompts on Gnome 3.28.1. With XFCE desktop on the same system I have no such problem.

I work via xrdp and always get this prompt and I cannot disable it.

Whenever I change <action id="org.freedesktop.color-manager.create-device"> policy in /usr/share/polkit-1/actions/org.freedesktop.color.policy to <allow_any>yes</allow_any> I get Gnome fatal error in logs.

UPDATED logs after WinEunuuchs2Unix advice:

gsd-media-keys[1099]: Unable to inhibit keypresses: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Permission denied
gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit gnome-user-share-webdav.service not loaded.
gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit rygel.service not loaded.
gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit gnome-remote-desktop.service not loaded.
gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit vino-server.service not loaded.
gnome-session-binary[877]: Entering running state
dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'org.gnome.evolution.dataserver.Calendar7'
systemd[847]: Started Evolution calendar service.
dbus-daemon[867]: [session uid=1000 pid=867] Activating service name='ca.desrt.dconf' requested by ':1.56' (uid=1000 pid=1176 comm="/usr/lib/evolution/evolution-calendar-factory-subp" label="unconfined")
dbus-daemon[867]: [session uid=1000 pid=867] Activating via systemd: service name='org.gnome.evolution.dataserver.AddressBook9' unit='evolution-addressbook-factory.service' requested by ':1.56' (uid=1000 pid=1176 comm="/usr/lib/evolution/evolution-calendar-factory-subp" label="unconfined")
systemd[847]: Starting Evolution address book service...
dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'ca.desrt.dconf'
dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'org.gnome.evolution.dataserver.AddressBook9'
systemd[847]: Started Evolution address book service.
gnome-shell[922]: Error looking up permission: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.impl.portal.PermissionStore was not provided by any .service files
kerneloops-appl[1152]: Failed to load module "canberra-gtk-module"
gsd-color[1088]: failed to get edid: unable to get EDID for output
colord[1140]: failed to get seat for session c1 [pid 1088]: No data available
gnome-shell[922]: GDBus.Error:org.freedesktop.DBus.Error.NoReply: Message recipient disconnected from message bus without replying
gsd-color[1088]: unable to get EDID for xrandr-rdp0: unable to get EDID for output
kernel: [  213.817502] do_trap: 20 callbacks suppressed
kernel: [  213.817504] traps: gsd-color[1088] trap divide error ip:5592b1f5c94a sp:7fffbcc03a90 error:0 in gsd-color[5592b1f53000+12000]
gnome-shell[922]: Could not get current seat: No data available
gnome-shell[922]: GNOME Shell started at Mon May 21 2018 12:06:54 GMT+0300 (EEST)
gnome-session[877]: gnome-session-binary[877]: WARNING: Application 'org.gnome.SettingsDaemon.Color.desktop' killed by signal 8
gnome-session-binary[877]: WARNING: Application 'org.gnome.SettingsDaemon.Color.desktop' killed by signal 8
gsd-color[1240]: failed to get edid: unable to get EDID for output
colord[1140]: failed to get seat for session c1 [pid 1240]: No data available
gsd-color[1240]: unable to get EDID for xrandr-rdp0: unable to get EDID for output
kernel: [  220.142162] traps: gsd-color[1240] trap divide error ip:55c79912d94a sp:7ffcbd6a6020 error:0 in gsd-color[55c799124000+12000]
gnome-session[877]: gnome-session-binary[877]: WARNING: App 'org.gnome.SettingsDaemon.Color.desktop' respawning too quickly
gnome-session-binary[877]: WARNING: App 'org.gnome.SettingsDaemon.Color.desktop' respawning too quickly
gnome-session-binary[877]: Unrecoverable failure in required component org.gnome.SettingsDaemon.Color.desktop
gnome-session[877]: gnome-session-binary[877]: CRITICAL: We failed, but the fail whale is dead. Sorry....
gnome-session-binary[877]: CRITICAL: We failed, but the fail whale is dead. Sorry....
xrdp-sesman[846]: (846)(140561311482944)[CORE ] window manager (pid 859) did exit, cleaning up session
xrdp-sesman[846]: (846)(140561311482944)[INFO ] calling auth_stop_session and auth_end from pid 846
xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets:
xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdp_chansrv_audio_out_socket_10
xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdp_chansrv_audio_in_socket_10
xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdpapi_10
xrdp-sesman[621]: (621)(140561311482944)[INFO ] ++ terminated session:  username xoob, display :10.0, session_pid 846, ip 192.168.1.100:7137 - socket: 12
xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 26 (AF_UNIX)
at-spi-bus-launcher[884]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":10.0"
at-spi-bus-launcher[884]:       after 23 requests (23 known processed) with 0 events remaining.
kernel: [  221.144168] gnome-shell[922]: segfault at 10 ip 00007fd88cb3712f sp 00007fff690fcac0 error 4 in libmutter-2.so.0.0.0[7fd88ca73000+156000]
gsd-power[1051]: gsd-power: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
gsd-xsettings[1069]: gsd-xsettings: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
gsd-wacom[1075]: gsd-wacom: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
gsd-clipboard[1084]: gsd-clipboard: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
gsd-media-keys[1099]: gsd-media-keys: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
gsd-keyboard[1093]: gsd-keyboard: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
kerneloops-applet.desktop[1152]: kerneloops-applet: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.
conky.desktop[1150]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":10.0"
conky.desktop[1150]:       after 578 requests (578 known processed) with 0 events remaining.
xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 12 (AF_INET 192.168.1.201:7777)
xrdp[844]: (844)(140711347752192)[DEBUG] xrdp_mm_module_cleanup
xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 25 (AF_UNIX)

The same happens if I simply try to login interactively with password prompt.

I tried to create custom pkla file in /var/lib/polkit-1/localauthority/50-local.d:

<action id="org.freedesktop.color-manager.create-device">
  <description xml:lang="en">Create a color managed device</description>
  <message xml:lang="en">Authentication is required to create a color managed device</message>
  <defaults>
    <allow_any>yes</allow_inactive>
    <allow_inactive>yes</allow_inactive>
    <allow_active>yes</allow_active>
  </defaults>
</action>

It seems to me it's equivalent to directly changing actions is /usr/share/polkit-1/actions.

I also tried to create global allow pkla rule as per this proposal:

[No password prompt]
Identity=unix-group:sudo
Action=*
ResultActive=yes

I also have global rule in /etc/polkit-1/rules.d

polkit.addRule(function(action, subject) {
if (subject.isInGroup("group")) {
      return polkit.Result.YES;
   }
});

As I got it, if I have polkit < 0.106, the rules are not processed, and one should use pkla files. Correct me, if I'm wrong. My pkaction --version shows 0.105.

None of the above worked. Which steps should I try and how to debug this?

gnome security policykit xrdp 18.04

3 Answers

  1. I had a problem not being able to connect to vpn from ssh session on ubuntu 18.04. The problem was related to polkit, since

    nmcli general permissions

    Shows the lack of permissiosns.

    I've succeed with following way of adding custom polkit rule with ubuntu 18.04 (still polkit version 0.105, no support of javascript rules). As root I executed the command:

     # cat > /etc/polkit-1/localauthority/50-local.d/allow-all-for-group-sudo-polkit105.pkla

    and entered following contents (note, this allows EVERYTHING for users of sudo group, may be risky):

    [Allow all without authentication for members of sudo group even for ssh sessions]
Identity=unix-group:sudo
Action=*
ResultAny=yes

    After this without restarting of any services or rebooting I got permissions to use any nmcli commands from ssh.

    • 4
  2. Best Answer

    The issue was related to incorrect pass of single entry gamma ramp instead of a 256 entry gamma ramp. The bug was fixed in xorgxrdp version 0.2.6.

    • 0

  3. Check the syntax of your pkla file. There might be hidden characters preventing polkit from parsing the file. See here.

    • 0