<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr">On Mon, Sep 30, 2013 at 8:40 PM, Miloslav Trmač <span dir="ltr"><<a href="mailto:mitr@redhat.com" target="_blank">mitr@redhat.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hello,<br><div><hr id="zwchr">
> What I'm trying to do is register a polkit authentication agent in a python<br>
> script, through the dbus api. I have attached, a rather simplistic, first<br>
> start of this. From what I can read out of the logs it seems to register<br>
> alright but nothing is relayed to it for authentication.<br><div><br></div>
> First question is that it seems like RegisterAuthenticationAgent takes a few<br></div>> different subject kinds . unix-process and unix-session. What is the<br><div>> difference between these and what should I be using?<br><div><br></div></div>You can register more than one agent; each agent is only called for those subject they register for. unix-process is obviously limited to that single process. So if you want to register for all processes running within the session / within the appliance UI, unix-session is more appropriate.<br></blockquote><div><br></div><div>Does this mean that if xbmc runs within another session, say gnome, and we use packagekit for installing our addons, if we'd register a unix-process that one will take precedence over the one in gnome?</div></div></div></div></blockquote><div>Yes. (You can also register a "fallback agent" for a unix-process, but you wouldn't to in this case.)<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> Or perhaps that only holds true for a polkit action which isn't registered in the session agent?</div></div></div></div></blockquote><div>No, agents register for subjects, not for actions.<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>> When registering I submit my object path, which is '/org/xbmc/polkit' but<br>
> what is the destination for this object? I'm using 'org.xbmc.polkit' for my<br>
> service, but how does polkit knows this?<br><div><br></div></div>An agent can only register itself; polkit uses the identity of the caller of the RegisterAuthenticationAgent operation (technically using the :number unique identifier). I don't think it's necessary to register a well-known-name.<br></blockquote><div><br></div><div>So polkit is able to deduct the destination from the object path and the bus used for the call? I'm not a dbus expert so wasn't aware that this was possible?</div></div></div></div></blockquote><div>Yes; this is fundamental to being able to send a reply to a request at all.<br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> So if I understand you correctly I just need to make sure I use the same bus for the service as the registration?</div></div></div></div></blockquote><div>That should be basically it. But I'm not a D-Bus expert either I'm afraid, and especially not an expert in the various interface libraries.<br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>> Could this be why its not called to<br>
> authenticate even if register went through alright?<br><div><br></div></div>These two lines seem rather suspect:<br>
> 'session-id': getSessionID(),<br>
> 'session_id': ""<br><div><br></div>
Other than that, if there are no error messages returned through the D-Bus API, I can suggest only running polkitd without --no-debug and capturing the output, and attaching a debugger to polkitd.<br></blockquote><div><br></div><div>Yeah I'm very uncertain on those, from the RegisterAuthenticationAgent documentation I found this line</div><div>"<span style="font-size:medium;font-family:'Times New Roman'">Note that current versions of PolicyKit will only work if </span><em style="font-size:medium;font-family:'Times New Roman'"><code>session_id</code></em><span style="font-size:medium;font-family:'Times New Roman'"> is set to the empty string. In the future it might work for non-empty strings if the caller is sufficiently privileged."</span></div><div><br></div>I thought that referred to be on the subject but it strikes me know that I might have misunderstood this. If so I'm not sure at all where I should set "session_id" :)</div></div></div></blockquote><div>(For others looking, it is data/org.freedesktop.PolicyKit1.Authority.xml . I'm afraid this is a bug in the documentation; for now filed as <a href="https://bugs.freedesktop.org/show_bug.cgi?id=69980">https://bugs.freedesktop.org/show_bug.cgi?id=69980</a> ).<br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>I tried to start polkitd with --no-debug (if I did it correctly)</div></div></div></div></blockquote><div>Note that, at least on Fedora, --no-debug is default, so it is necessary to _remove_ it (and then capture stderr).<br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> and checked auth.log, it gave some interesting results (which I'm not entirely sure how to interpret)</div><div style="">(at line3 is when I closed polkitd with a killall -9 polkitd)</div><div style=""><br></div><div><div>topfs@tobias-desktop:/var/log$ tail -f auth.log</div>Sep 30 21:01:16 tobias-desktop polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session10 (system bus name :1.119 [python simple-unix-session-agent.py], object path /org/xbmc/polkit, locale sv_SE)<div>Sep 30 21:05:07 tobias-desktop polkitd(authority=local): Operator of unix-session:/org/freedesktop/ConsoleKit/Session10 FAILED to authenticate to gain authorization for action com.ubuntu.softwareproperties.applychanges for system-bus-name::1.126 [/usr/bin/python3 /usr/bin/software-properties-gtk -n -t 0] (owned by unix-user:topfs)</div></div><div><br></div><div style="">So from what I can see it seems like it registers alright but it never calls my python scripts method (begin authentication et al).</div></div></div></div></blockquote><div>I'm afraid it's time for gdb then; there is no logging inside the code of get_authentication_agent_for_subject AFAICS.<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div style="">I've registered it under locale sv_SE, perhaps thats wrong or not what fluxbox (which is my testing session) is using by default?</div><div style="">Can I register my agent on any locale?</div></div></div></div></blockquote><div>The locale is not involved in choosing which agent to run, only what messages to give to it.<br></div><div> Mirek<br></div></div></body></html>