X2Go Bug report logs - #459
PolicyKit authentication within apps often fails

Full log

🔗 View this message in rfc822 format

X-Loop: owner@bugs.x2go.org
Subject: Bug#459: PolicyKit authentication within apps often fails
Reply-To: Michael DePaulo <mikedep333@gmail.com>, 459@bugs.x2go.org
Resent-From: Michael DePaulo <mikedep333@gmail.com>
Resent-To: x2go-dev@lists.berlios.de
Resent-CC: X2Go Developers <x2go-dev@lists.berlios.de>
X-Loop: owner@bugs.x2go.org
Resent-Date: Sun, 23 Mar 2014 16:30:02 +0000
Resent-Message-ID: <handler.459.B.13955919607376@bugs.x2go.org>
Resent-Sender: owner@bugs.x2go.org
X-X2Go-PR-Message: report 459
X-X2Go-PR-Package: x2goserver
X-X2Go-PR-Keywords: 
Received: via spool by submit@bugs.x2go.org id=B.13955919607376
          (code B); Sun, 23 Mar 2014 16:30:02 +0000
Received: (at submit) by bugs.x2go.org; 23 Mar 2014 16:26:00 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-0.5 required=5.0 tests=BAYES_05,FREEMAIL_FROM,
	T_DKIM_INVALID,URIBL_BLOCKED autolearn=ham version=3.3.2
Received: from mail-wg0-f51.google.com (mail-wg0-f51.google.com [74.125.82.51])
	by ymir (Postfix) with ESMTPS id 3DFAD5DB11
	for <submit@bugs.x2go.org>; Sun, 23 Mar 2014 17:25:59 +0100 (CET)
Received: by mail-wg0-f51.google.com with SMTP id k14so2779241wgh.34
        for <submit@bugs.x2go.org>; Sun, 23 Mar 2014 09:25:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:date:message-id:subject:from:to:content-type;
        bh=08xu99wyhjitU57D7Clbca+IRH81ajBJGPWr4ds36C8=;
        b=YE52g6LAMJQmZV836DtfidPzBPBarbmlRLpXSTU+CaPOwFXMuiIi5L3T52es13jngy
         uEHcWtK5uCKPlU5v3n3KUo19g8vg/YMya47xwlOTRw/QjPeY53NZfLInziHQvM2ZleQF
         vNvESRqTHCGjmAitsKRYFLQV6YihEe7uNk8xQS6kN0V27tM/+JRrlnPNt4dDEhlP+zJV
         Jk9AypNdTfzNZKATeJHAu1nh6smXheefi0XzoAGb9Rs/17Jnu/SrAILMF/0M40mI46K9
         Us5Q4vKSK/BZ1aY7zIS9zM8Trj3W3Uow/UWVFnIOQ++jERJFX/s6mmKwuYbtn66oo38U
         uInA==
MIME-Version: 1.0
X-Received: by 10.180.91.164 with SMTP id cf4mr10354784wib.37.1395591958716;
 Sun, 23 Mar 2014 09:25:58 -0700 (PDT)
Received: by 10.181.11.130 with HTTP; Sun, 23 Mar 2014 09:25:58 -0700 (PDT)
Date: Sun, 23 Mar 2014 12:25:58 -0400
Message-ID: <CAMKht8hxORsAXk32K=9ruNpF-PYWLUeyVvWqyeMsZhhb4uTWEQ@mail.gmail.com>
From: Michael DePaulo <mikedep333@gmail.com>
To: submit@bugs.x2go.org
Content-Type: text/plain; charset=ISO-8859-1

Package: x2goserver
Version: 4.0.1.13

Notes:

1. I am not sure if this is a bug in x2goserver, x2goserver-xsession,
or in nx-libs.

2. PolicyKit depends on ConsoleKit (and on systemd-logind in
newer distros.)

3. The behavior seems to be distro-specific and/or app-specific.

4. This bug report differs from 458 because PolicyKit authentication
is being called within an app, not when launching the app. This is
part of the PolilcyKit architecture: The apps run unprivileged and
rely on PolicyKit in order to speak to privileged processes that do
the actual task. For example, in test case 2, gpk-application is
launched unprivileged. It uses PolicyKit to speak to the PackageKit
backend, and the PackageKit backend does the package install.

Test system:
Fedora 20 64-bit
MATE Desktop 1.6.2.1.fc20 - used for all 3 test cases
x2goserver 4.0.1.13.2.fc20
x2goserver-xsession 4.0.1.13.2.fc20
nxlibs 3.5.0.22.1-fc20
(This distro uses logind)
(/usr/libexec/polkit-mate-authentication-agent-1 is launched
automatically when I login over X2Go. This distro is not affected by
bug 457)

Test Case 1:
Steps:
1. Launch yumex (from start menu or from console)
2. Switch to the yumex's "history" tab on the left..

Expected result:
A policykit authentication window opens up, I select a user to
authenticate as (myself or root), enter my password, and then the
history is populated within yumex.

Here is an image of that policykit authentication window:
http://imgur.com/JUZTBHo

Actual result:
The authentication window does not open up and the history is no
populated. Instead, I get an error message windows. When I click
"Close" on the window, yumex closes.

Error message:
Fatal Error: polkit-not-authorized

Could not get polkit autherisation to start backend

Yum Extender will terminate

Here's an image of the error message window
http://imgur.com/ABYETM0

From the command-line, I can see this output when I select the history tab:
15:53:07 : INFO - YUM: Error executing command as another user: Not authorized
15:53:14 : INFO - yum backend process is ended
15:53:14 : INFO - yum backend process is ended

Test Case 2:
Steps:
1. Launch gpk-application (GNOME "Software Install" AKA "Add/Remove Software")
2. Select to install a single package.
3. Click "Apply Changes"

Expected result: A policykit authentication window opens up, I select
a user to authenticate as (myself or root), enter my password, and
then the package is downloaded & installed (over the course of at
least a few seconds), during which a progress bar is displayed.

Screenshot:
http://imgur.com/lLNof08

Actual result:
The authentication window does not open up. The progress bar for the
install completes in about 1 second. The package is not installed.
(Interestingly enough, the package is still selected to be installed,
but the "Apply Changes" and "cancel" button are hidden. This is a bug
in gpk-application, it does not know how to handle policykit having an
error. But this gpk-application bug is besides the point.)

Screenshot:
http://i.imgur.com/28lCZF5.png

Also, the command-line does not show any relevant output.

Test Case 3:
Steps:
1. Launch virt-manager (AKA "Virtual Machine Manager")

This test case actually passes!

Expected & Actual result:
A policykit authentication window opens up, I select a user to
authenticate as (e.g., myself or root), enter my password, and then I
am connected to the local libvirtd instance and see the VMs running.

Screenshot:
http://imgur.com/mZSgdMW

Also, the command-line output does not include any details about
PolicyKit (succeeding.)

Note: Test case 3 fails on CentOS 6.5 64-bit. However, CentOS 6.5
64-bit is affected by bug 457, so that precludes running this test
case.

Send a report that this bug log contains spam.