Bug#841878: policykit-1: Authentication fails with valid credentials

[Brian Vaughan]

Package: policykit-1
Version: 0.113-5
Severity: important

Dear Maintainer,

Following a recent update, launching Synaptic through the menu system fails
silently. 'sudo synaptic' at the command line launches Synaptic as expected.

Executing 'synaptic-pkexec' (as in '/usr/share/applications/synaptic.desktop',
and providing the correct password, produces the following:


==== AUTHENTICATING FOR com.ubuntu.pkexec.synaptic ===
Authentication is required to run the Synaptic Package Manager
Authenticating as: Brian Vaughan,,, (brian)
Password:
polkit-agent-helper-1: pam_authenticate failed: Authentication failure
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.


This appeared with policykit-1 0.105-17. I tried installing 0.113-5 from
experimental, but the behavior remained the same.



-- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages policykit-1 depends on:
ii adduser 3.115
ii dbus 1.10.12-1
ii libc6 2.24-5
ii libexpat1 2.2.0-1
ii libglib2.0-0 2.50.1-1
ii libmozjs185-1.0 1.8.5-1.0.0+dfsg-5
ii libnspr4 2:4.12-6
ii libpam-systemd 231-9
ii libpam0g 1.1.8-3.3
ii libpolkit-agent-1-0 0.113-5
ii libpolkit-gobject-1-0 0.113-5
ii libsystemd0 231-9

policykit-1 recommends no packages.

policykit-1 suggests no packages.

-- Configuration Files:
/etc/polkit-1/rules.d/40-debian-sudo.rules [Errno 13] Permission denied: u'/etc/polkit-1/rules.d/40-debian-sudo.rules'
/etc/polkit-1/rules.d/50-default.rules [Errno 13] Permission denied: u'/etc/polkit-1/rules.d/50-default.rules'

-- no debconf information

[Simon McVittie]

On Sun, 23 Oct 2016 at 21:13:24 -0700, Brian Vaughan wrote:
> Authenticating as: Brian Vaughan,,, (brian)
> Password:
> polkit-agent-helper-1: pam_authenticate failed: Authentication failure

Please look in /var/log/auth.log for clues as to why your configured PAM
stack might have refused your valid credentials.

(It's entirely possible that this was caused by a policykit-1 change,
but to know what to do about it, we'll likely need that information.)

Thanks,
S

[Brian Vaughan]

Here's the part of the auth.log from first launching synaptic through
the desktop menu, and second from 'synaptic-pkexec' at the command line.
(Full log is attached.)

Oct 24 10:22:13 brian-laptop polkitd[666]: Registered Authentication
Agent for unix-process:1413:40576 (system bus name :1.54 [pkexec
/usr/sbin/synaptic], object path
/org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Oct 24 10:22:24 brian-laptop polkitd[666]: Operator of
unix-process:1413:40576 FAILED to authenticate to gain authorization for
action com.ubuntu.pkexec.synaptic for unix-process:1413:40576 [/bin/sh
/usr/bin/synaptic-pkexec] (owned by unix-user:brian)
Oct 24 10:22:24 brian-laptop pkexec[1414]: brian: Error executing
command as another user: Not authorized [USER=root] [TTY=/dev/pts/0]
[CWD=/home/brian] [COMMAND=/usr/sbin/synaptic]
Oct 24 10:22:24 brian-laptop polkitd[666]: Unregistered Authentication
Agent for unix-process:1413:40576 (system bus name :1.54, object path
/org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Oct 24 10:22:55 brian-laptop sudo: brian : TTY=pts/0 ;
PWD=/home/brian ; USER=root ; COMMAND=/bin/cp /var/log/auth.log auth.log
Oct 24 10:22:55 brian-laptop sudo: pam_unix(sudo:session): session
opened for user root by (uid=0)

The error message in the terminal was slightly different.

==== AUTHENTICATING FOR com.ubuntu.pkexec.synaptic ===
Authentication is required to run the Synaptic Package Manager

Authenticating as: Brian Vaughan,,, (brian)
Password:

polkit-agent-helper-1: error response to PolicyKit daemon:
GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie

[Brian Vaughan]

Also: I had a VM, set up with Debian unstable and XFCE, which I just updated yesterday. Prior to updating, Synaptic launched from the menu system without issue; after updating, I see the same behavior as on my laptop, for which I filed the bug. The VM had updated to policykit-1 0.105-17.

Both systems use the XFCE interface and have sudo configured.

Synaptic is the application where I first noticed the issue, but I'm fairly sure it's not a Synaptic issue per se. I get the same error message if I execute 'pkexec whoami', for instance.

A few months ago, I'd had Debian stretch, with XFCE, on that laptop. After a few weeks, I had what seemed to be the same issue I'm seeing now. Unfortunately I'd wiped the laptop in between and so don't have any logs.

From what I've seen from some bug searches and general Web searches, there are a fair number of reports of applications that require authentication failing to launch from the menu system after an update, but working fine when launched from the command line with sudo. Synaptic is mentioned most often, including similar errors involving 'synaptic-pkexec' at the command line. None mention fixes, but a few mention the problem goes away again after an update. A lot of them mention XFCE, but I don't recall any other desktop environments mentioned.

policykit-1 was my best guess about where the problem lies. Please let me know if there's anything further I can do to assist in troubleshooting.