Re: pkexec doesn't bring up a graphical password prompt

On October 23, 2025 2:08:16 PM PDT, "Cliff mcDiarmid"
<[email protected]> wrote:
>Hi
>
>I'm not big on pexec, pam and polkit so I need some advice here please.
>
>I have a program(Tuxedo Control Centre)that requires the root password to
>save
>any settings. This not achieved with ssh-askpass as with gparted but, (I
>think) with pexec and pam through polkit.
>
>The program works fine on the distro that I used for LFS. When settings are
>saved the following appears in the journal:
>
>Oct 20 21:33:22 tuxedo-14 pkexec[7933]: pam_unix(polkit-1:session): session
>opened for user root(uid=0) by cliffhanger(uid=1000)
>Oct 20 21:33:22 tuxedo-14 pkexec[7933]: cliffhanger: Executing command
>[USER=root] [TTY=unknown] [CWD=/home/cliffhanger] [COMMAND=/opt/tuxedo-
>control-center/resources/dist/tuxedo-control-center/data/service/tccd --
>new_profiles /tmp/tmptccprofiles --new_settings /tmp/tmptccsettings]
>
>I have compared the .policy files, .rules files etc from the distro and LFS
>and can't see any thing different that would influence the error I get under
>LFS when saving, which is:
>
>Oct 23 16:42:47 cliffhanger pkexec[8626]: pam_warn(polkit-1:session):
>function=[pam_sm_open_session] flags=0 service=[polkit-1]
>terminal=[<unknown>]
>user=[root] ruser=[<unknown>] rhost=[<unknown>]
>
>Both the distro and LFS do have two .policy files under /usr/share/polkit-1/
>actions
>
>com.tuxedocomputers.tccd.policy - I thought this was responsible
>com.tuxedocomputers.tomte.policy
>
>But both are identical under both OS.
>
>Can someone see what might be wrong here? It seems it might be a pam issue
>with authentication?
>
>Cliff

>For polkit to bring up a  it needs a graphical connector to
>be started with the desktop. On LFS we have polkit-qt and polkit-gnome. Make
>sure that those are installed and if you don't use KDE or Gnome add this to
>your desktops auto start (for gnome it is similar for qt iirc)

>Thanks Rahul. Yes I have polkit-gnome

>/usr/libexec/polkit-gnome-authentication-agent-1

>And polkit-gnome-authentication-agent-1

>You can try running this in your terminal before adding it to auto start and
>make sure that the gui pops up for apps that need escalation.

>It already runs from /etc/xdg/autostart and have this message when trying to
>start it which is to be expected?

>Cannot register authentication agent:
>GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent
>already exists for the given subject

Right, after some digging around it appears that Gnome no longer uses the
'polkit-gnome-authentication-agent-1' and hasn't for some time.  It has its
own built into Gnome Shell.   This would account for the error message:

GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: An authentication agent
already exists for the given subject

So there appears to be a conflict between the two when starting.  So the
question is - do we need polkit-gnome anymore for Gnome?  If one does, how
does one disable the built in authentication-agent so 'polkit-gnome-
authentication-agent-1'  can function?

Am i seeing this correctly?   Incidently I've tried disabling polkit-gnome at
startup but I still don't get a graphical prompt for root.

Cliff

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page