Re: permissions and connection editor

[Ramon Diaz-Uriarte <rdiaz02 gmail com>]

Dan, thanks a lot. This is now taken care of (the other thread about
running as root
http://mail.gnome.org/archives/networkmanager-list/2011-November/msg00020.html).
For completeness I comment below to some specific issues, but I summarize
the issue and solution here in case someone else runs into the problem:



a) I was not using kdm or gdm (in my case, wdm) as display manager


b) I was not using gnome (in my case, xmonad) as window manager.




It seems that a) was the cause of not having ck-list-sessions accurately
report that the local and active user was actually local and active. I
searched for, and this problem has been reported; you can find many
reports and complaints related mainly to xdm and xfce, but this also
affects wdm, slim, and using a startx after login.


None of what I found, however, allowed me to solve it with wdm (or xdm),
so I gave up (for now) and I am now using gdm or kdm.



Using Dan Williams suggested changes to:

/usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy

in
<action id="org.freedesktop.network-manager-settings.system.modify">

everything worked OK if under 

<action id="org.freedesktop.NetworkManager.settings.modify.system">

I set
       <allow_inactive>yes</allow_inactive>
       <allow_active>yes</allow_active>




However, it did not work with 

<allow_active>auth_admin_keep</allow_active>


As indicated by Michael Biebl, that was probably caused because I did not have 
/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
running (as I said, I am not using gnome, and
polkit-gnome-authentication-agent seems not be started by
either gdm or kdm, but rather by the window manager itself). 

If I start that manually or from my .xinitrc, then everything works OK,
and I get prompted for the root password as needed.



On Fri, 04 Nov 2011 19:32:20 -0500,Dan Williams <dcbw redhat com> wrote:
> On Tue, 2011-10-25 at 17:46 +0200, Ramon Diaz-Uriarte wrote:
> > Dear All,
> > 
> > Since my troubles with nm-connection-editor continued, I decided to remove
> > and install again all of gnome, consolekit, keyring, and
> > policykit. However, the problems remain.
> > 
> > 
> > 1. I cannot add wireless connections, as non-root, if they have any kind
> > of security. The "Save" box is greyed, and I get repeated messages saying 
> > 
> > ** (nm-connection-editor:22077): WARNING **: Invalid setting Wireless Security: Invalid wireless security

> You may get this periodically; but this warning means that there is some
> piece of the wifi security tab that isn't yet valid.  What security are

Yes, sorry. 

> you using?  WPA PSK?  WPA Enterprise?  WEP?

It didn't really matter; I tried several (WPA personal, WPA enterprise,
and one or two others), and I could not save it.


> > 
> > 2. If I try to access one of the available wireless networks, and enter
> > the authentication info (e.g., CA certificate, password, etc) then I get a
> > box asking for the root password.
> > 
> > However, when I enter the root password, it stays there for a long time,
> > and eventually I get a message saying "You are not allowed to modify the
> > system configuration" and "An error occurred while checking for
> > authorizations: Did not receive a reply. Possible causes include: the
> > remote application did not send a reply, the message bus security policy
> > blocked the reply, the reply timeout expired, or the network connection
> > was broken.  You may report this as a bug."

> This seems like a PolicyKit bug or some misconfiguration thereof.  NM's
> usage of PolicyKit is pretty simple: it just asks polkitd if the user is
> authorized.  Then PolicyKit takes over.  Can you perhaps paste some logs
> of NetworkManager (/var/log/messages, or /var/log/daemon.log,
> of /var/log/NetworkManager.log) that show what's going on when this
> error happens?

> > 
> > 
> > Error 2. also happens if I try to, say, access any system-wide
> > configuration that require root access (e.g., services).
> > 
> > 
> > So I am not sure where the error is, nor what can I do, since I have
> > reinstalled everything (after purging configuration files). I am using
> > Debian, and here are some of the relevant packages. (Note, though, that
> > gnome-keyring seems to work, at least with other programs).
> > 
> > 
> > network-manager                                 0.9.0-2 
> > network-manager-gnome                           0.9.0-4  
> > policykit-1                                     0.102-1 
> > policykit-1-gnome                               0.104-1
> > consolekit					0.4.5-1
> > gnome-keyring                                   3.0.3-2
> > libgnome-keyring0                               3.2.0-3
> > libpam-gnome-keyring                            3.0.3-2
> > python-gnomekeyring                             2.32.0-4

> Definitely sounds like a PolicyKit problem.  There are some things you
> can do, like using pkcheck to test this stuff out, but you might get
> better debugging help by asking PolicyKit people too.

> Dan



R.


-- 
Ramon Diaz-Uriarte
Department of Biochemistry, Lab B-25.
Facultad de Medicina (UAM)
Arzobispo Morcillo, 2
28029 Madrid
Spain


Phone: +34-91-497-2412

Email: rdiaz02 gmail com
       ramon diaz iib uam es

http://ligarto.org/rdiaz