pkexec graphical authentication agent popping up in another display

Kewl · 2019-06-08 06:40:24

Whenever I run pkexec from display :8, the graphical authentication agent pops up in display :0. I have not been able to understand what happens, it does not pick the right system message bus.
For test purpose I use:

pkexec echo 1

the password request window appears on display :0.

I use polkit-gnome, my DE is XFCE which is run in a VNC session on display :8.0. polkit is active and the log

journalctl -b -t polkitd

says:

 Acquired the name org.freedesktop.PolicyKit1 on the system bus.
 Registered Authentication agent for unix-session:1

As you can see, I am not familiar with polkit and would welcome any direction I should investigate. Also let me know if I forgot to mention some useful information.

Last edited by Kewl (2019-06-08 06:58:52)

seth · 2019-06-08 09:18:45

The agent is contacted via dbus and there'll be only one session bus for your user. Since *the* agent (one) was apparently started on display :0, this is where it will appear, regardless of where the calling client resides.
If it's dbus activated, it will likely guess what display to appear on. Running it explicitly on :8 might prevent that unless it completely ignores stuff and just runs on :0 unconditionally.

Kewl · 2019-06-08 09:33:17

This is correct, the agent was initially started on display :0, then I thought I could start another dbus session under the same user and that's what polkit would see.

The new xfce session is started with dbus-launch /usr/bin/startxfce4. I would have preferred to let startxfce4 deal with it and start a new dbus session via systemd but it does not seem to be compatible with tigervnc (see https://github.com/TigerVNC/tigervnc/issues/592 for example).

Thanks for your answer!

Kewl · 2019-06-09 14:18:09

I found something interesting: if I run the VNC server and the virtual XFCE session from a SSH terminal, it works fine: the agent in the new session goes to the right display :1.
However, if the VNC server and the virtual XFCE session is started from a service file or from a terminal, then, the agent in the new session (display :1) goes to display :0.

Does it give you some hint on what could fix the issue?
I have the impression I need to trigger the registering of an authentication agent for the new session, rather than reusing the existing one, which happens with the SSH session.

seth · 2019-06-09 19:46:15

Compare $DBUS_SESSION_BUS_ADDRESS between the sessions. I thought you had resolved through dbus-launch?

Kewl · 2019-06-09 20:09:41

Thanks for your follow up. $DBUS_SESSION_BUS_ADDRESS is in the virtual session:

unix:abstract=/tmp/dbus-YAvz7o6o5W,guid=15c273f4ec36f28d48f6df4c3cfd640

and in the originating session:

unix:path=/run/user/1000/bus

The only workaround I have found is launching the server & virtual DE with

$ ssh localhost 'vncserver :1 -fg'

In this case because it is starting I think from a clean environment without any polkit agent, it registers a new one and there is no mix up of display when I run `pkexec`. Otherwise it uses the same polkit agent and shows the window in the originating session.

I am not sure if what I say makes sense but this is my best guess. My workaround is quite dirty and I'm looking for a better solution.

Last edited by Kewl (2019-06-09 20:10:38)

seth · 2019-06-10 20:08:19

You could simply unset the unwanted environment variables before launching the server?
(The service spec has an Environment variable, if that doesn't work you could wrap the call in "env" or explicitly "unset DBUS_SESSION_BUS_ADDRESS")

Kewl · 2019-06-10 20:42:23

Yes DBUS_SESSION_BUS_ADDRESS is unset before calling startxfce4 in my VNC server startup script. It understands it needs to create a new dbus and does so.
but for some reason the polkit agent attached to the initial display is reused.
I've even started with an empty environment (env -i) but it does not change.

It seems it manages to send a message to polkit, but polkit is registered to the initial display, I see the following in my log:

 Registered Authentication agent for unix-session:1

it is only when I run the vncserver from ssh that it registers for a new session

 Registered Authentication agent for unix-session:2

Arch Linux

#1 2019-06-08 06:40:24

pkexec graphical authentication agent popping up in another display

#2 2019-06-08 09:18:45

Re: pkexec graphical authentication agent popping up in another display

#3 2019-06-08 09:33:17

Re: pkexec graphical authentication agent popping up in another display

#4 2019-06-09 14:18:09

Re: pkexec graphical authentication agent popping up in another display

#5 2019-06-09 19:46:15

Re: pkexec graphical authentication agent popping up in another display

#6 2019-06-09 20:09:41

Re: pkexec graphical authentication agent popping up in another display

#7 2019-06-10 20:08:19

Re: pkexec graphical authentication agent popping up in another display

#8 2019-06-10 20:42:23

Re: pkexec graphical authentication agent popping up in another display

Board footer