|
This just in from 'man pklocalauthority'
1. gksudo gedit /etc/polkit-1/localauthority.conf.d/60-desktop-admin-policy.conf [Configuration] AdminIdentities=unix-group:wheel ResultAny=no ResultInactive=no ResultActive=auth_self_keep 3. Save EXPLANATION: By default, we add the first user on the system to the wheel group upon installation. The above configuration allows users in the wheel group to make changes in all the places where 'auth_admin' is needed, providing that they are the active user and provide their own password. Please report back if this works for you so that we can get it integrated. António, where would a fix like this belong? My guess would be to change package "polkit" to ship that fix. But thats my guess only.
Ok, just had a quick look at the polkit recipe.
Apparently, the framework is in place for using the desktop_user_r and desktop_admin_r groups to do passwordless authentication for a well defined subset of actions that require elevated privileges. Unfortunately, the first user on the system is not added to those two groups by default, meaning these convenience policies do not take effect on a default install. I have updated the polkit recipe to include the above fix, which will be installed to /etc/polkit-1 and not /var/lib/polkit-1/ – let's hope it doesn't cause too many issues. well, we have enough data to get around this in a clean satisfatory way,
ermo ping me on #foresight-devel when online plz Reinstalled this system in this morning and I had created a file as "60-desktop-admin-policy.conf".
Now I can control some of administration. (tested only few minutes) Please tell me if you want to report another thing. I will erase this system tonight for another testing. @Yukimi,
Which parts can't you control? On my systems, the above change appears to give me access to edit all the things in "System->Administration". I could't find critical problem. No parts can't control now.
Checked this issue with Admin menus. System -> Administration (a)...No need to authenticate. (No dialog) BTW: Sometimes "auth-dialog" displayed behind another window. Yukimi,
Thanks for reporting back. I suspect that the reason you are seeing 'No need to authenticate' is because I've used 'auth_self_keep', which keeps credentials for a short interval (as opposed to 'auth_self'). This is a convenience feature. Fixed in polkit on fl:2-devel and fixed trove promoted to 2-qa.
crashing if added new admin when Authentication.
Reproduce = 100% Yukimi,
https://wiki.ubuntu.com/DebuggingGnomeSystemTools When I tried to reproduce using the procedure described in the link, I could not reproduce the error. Thank you for advise. I had success getting logs as attached.(reproduced)
The point is making another admin and 3 times authentication. Linux FL0303.local 2.6.30.10-2-fl.smp.gcc4.1.x86_64 #1 SMP Mon Dec 28 17:22:23 UTC 2009 x86_64 x86_64 x86_64 GNU/Linux Doniphon,
Please skip reading if this is not point.
This screen-shot was taken after this problem. "newadmin"'s UID/GID is same as made at first. Maybe some program is trying to set GID as (unsigned long) -1. System>Administration>Users and Groups> Advanced Setting>User privilege>admin privilege? (I do not use adduser and useradd now.) ------- [yukimi@FL20100305 ~]$ id uid=500(yukimi) gid=500(yukimi) groups=10(wheel),500(yukimi) [yukimi@FL20100305 ~]$ id newadmin uid=6668(newadmin) gid=6668(newadmin) groups=6668(newadmin),4(video),10(wheel),11(cdrom),18(dialout),19(floppy),33(tape),46(plugdev),63(audio),71(scanner) Attached file is screen-shot of process in the user privilege.
1. default 2. Create "newadmin" 3. Set password (is not same as yukimi's) 4. "newadmin" made at group (null). 5. Advanced setting of "newadmin" 6. User Privileges 7. Be able to get administrator privileges can you guys do a conary update polkit{,-gnome} in either 2-qa or 2-devel, log off/log in and confirm issue is fixed for real this time ?
thanxs. fl:2-qa : Result changed from previous check.
Install (yukimi) => change repo 2-qa => updateall => reboot => login => add "newadmin" => set privilege as root => yukimi CAN be authenticated => DIED in choosing "newadmin" fl:2-devel : Result is same as 2-qa. Install (yukimi) => change repo 2-devel => updateall => reboot => login => add "newadmin" => set privilege as root => yukimi CAN be authenticated => DIED in choosing "newadmin" yukimi...
try to lunch virt-manager (other app that deps on polkit-gnome) see if things work. (also you on x86or x86_64) ? Thanxs!!!!!!!!!!!!!! Yukimi,
I discovered a subtle bug with users-admin that was related to differences in output between the Debian (the expected output format) and RH (which we use) versions of the /usr/bin/passwd program. System-tools-backends would consequently list users as not being enabled no matter their actual status. This should be fixed in system-tools-backends=/foresight.rpath.org at fl:devel//2-devel/2.10.0-0.3-1 Do note that, due to design deficiencies in g-s-t / s-t-b (according to the maintainer, no less!), you should create a new user, close the users-admin applet and then restart it before you make changes to the new user, such as adding the user to additional groups. Please report back if this solves your issues. Good morning, ermo.
Unfortunatelly I seem my Gnome(x86_64) is broken after updateall with 2-qa in this morning. (installed as clean) To tell the truth I found this issue yesterday on another machine(x86) too. Now I can't check this issue. To be continued in another thread... (after the dairy work) — Mon Apr 12 06:57:01 JST 2010 — more data plz.
there was an updateall issue introduced late last week that prevented conary from finding all deps on update. this has been fixed (afaik)
can you try updateall again plz ? (and thanxs) Thank you for fixing. Broken gnome issue is solved. I do not making new thread.
By the way this issue has changed situation with 3-1. Please see attached screen-shot named 20100412.tar.gz. [Operate] install 2.3.0qa -> conary updateall fl:2-qa -> reboot -> conary update system-tools-backends=/foresight.rpath.org at-mark fl:devel//2-devel/2.10.0-0.3-1 (1) Add 'newadmin' as administrator default. (It's not problem) Yukimi,
I can confirm that g-s-t is periodically slow to respond and that it's hard to understand why. Earlier on, I mentioned that [2] is a design deficiency according to the current Ubuntu maintainer. According to him, you should create a new user, close users-admin, open users-admin and only then assign extra permissions to your user. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
|
Bug
Closed
Normal
2.3.0qa: Can't control Administration (Network/Services/DateandTime) by root-auth
sudo passwd root
and write 2 times the password you want to use, then try again to control network.