<div dir="ltr">On Mon, Sep 30, 2013 at 8:40 PM, Miloslav Trmač <span dir="ltr"><<a href="mailto:mitr@redhat.com" target="_blank">mitr@redhat.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hello,<br> <div>----- Original Message -----<br> > What I'm trying to do is register a polkit authentication agent in a python<br> > script, through the dbus api. I have attached, a rather simplistic, first<br> > start of this. From what I can read out of the logs it seems to register<br> > alright but nothing is relayed to it for authentication.<br> <br> > First question is that it seems like RegisterAuthenticationAgent takes a few<br> </div>> different subject kinds . unix-process and unix-session. What is the<br> <div>> difference between these and what should I be using?<br> <br> </div>You can register more than one agent; each agent is only called for those subject they register for. unix-process is obviously limited to that single process. So if you want to register for all processes running within the session / within the appliance UI, unix-session is more appropriate.<br> </blockquote><div><br></div><div>Does this mean that if xbmc runs within another session, say gnome, and we use packagekit for installing our addons, if we'd register a unix-process that one will take precedence over the one in gnome? Or perhaps that only holds true for a polkit action which isn't registered in the session agent?</div> <div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> <div><br> > When registering I submit my object path, which is '/org/xbmc/polkit' but<br> > what is the destination for this object? I'm using 'org.xbmc.polkit' for my<br> > service, but how does polkit knows this?<br> <br> </div>An agent can only register itself; polkit uses the identity of the caller of the RegisterAuthenticationAgent operation (technically using the :number unique identifier). I don't think it's necessary to register a well-known-name.<br> </blockquote><div><br></div><div>So polkit is able to deduct the destination from the object path and the bus used for the call? I'm not a dbus expert so wasn't aware that this was possible? So if I understand you correctly I just need to make sure I use the same bus for the service as the registration?</div> <div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> <div><br> > Could this be why its not called to<br> > authenticate even if register went through alright?<br> <br> </div>These two lines seem rather suspect:<br> > 'session-id': getSessionID(),<br> > 'session_id': ""<br> <br> Other than that, if there are no error messages returned through the D-Bus API, I can suggest only running polkitd without --no-debug and capturing the output, and attaching a debugger to polkitd.<br></blockquote><div><br> </div><div>Yeah I'm very uncertain on those, from the RegisterAuthenticationAgent documentation I found this line</div><div>"<span style="font-size:medium;font-family:'Times New Roman'">Note that current versions of PolicyKit will only work if </span><em style="font-size:medium;font-family:'Times New Roman'"><code>session_id</code></em><span style="font-size:medium;font-family:'Times New Roman'"> is set to the empty string. In the future it might work for non-empty strings if the caller is sufficiently privileged."</span></div> <div><br></div>I thought that referred to be on the subject but it strikes me know that I might have misunderstood this. If so I'm not sure at all where I should set "session_id" :)<br><div><br></div><div>I tried to start polkitd with --no-debug (if I did it correctly) and checked auth.log, it gave some interesting results (which I'm not entirely sure how to interpret)</div> <div style>(at line3 is when I closed polkitd with a killall -9 polkitd)</div><div style><br></div><div><div>topfs@tobias-desktop:/var/log$ tail -f auth.log</div><div>Sep 30 20:59:44 tobias-desktop sudo: pam_unix(sudo:session): session opened for user root by topfs(uid=0)</div> <div>Sep 30 20:59:44 tobias-desktop sudo: pam_unix(sudo:session): session closed for user root</div><div>Sep 30 20:59:57 tobias-desktop sudo: topfs : TTY=pts/1 ; PWD=/home/topfs ; USER=root ; COMMAND=/usr/bin/killall polkitd</div> <div>Sep 30 20:59:57 tobias-desktop sudo: pam_unix(sudo:session): session opened for user root by topfs(uid=0)</div><div>Sep 30 20:59:57 tobias-desktop sudo: pam_unix(sudo:session): session closed for user root</div><div> Sep 30 21:00:25 tobias-desktop gnome-keyring-daemon[4236]: couldn't set environment variable in session: The name org.gnome.SessionManager was not provided by any .service files</div><div>Sep 30 21:00:25 tobias-desktop gnome-keyring-daemon[4236]: keyring alias directory: /home/topfs/.local/share/keyrings</div> <div>Sep 30 21:01:10 tobias-desktop sudo: topfs : TTY=pts/1 ; PWD=/home/topfs ; USER=root ; COMMAND=/usr/lib/policykit-1/polkitd --no-debug</div><div>Sep 30 21:01:10 tobias-desktop sudo: pam_unix(sudo:session): session opened for user root by topfs(uid=0)</div> <div>Sep 30 21:01:16 tobias-desktop polkitd(authority=local): Registered Authentication Agent for unix-session:/org/freedesktop/ConsoleKit/Session10 (system bus name :1.119 [python simple-unix-session-agent.py], object path /org/xbmc/polkit, locale sv_SE)</div> <div>Sep 30 21:05:07 tobias-desktop polkitd(authority=local): Operator of unix-session:/org/freedesktop/ConsoleKit/Session10 FAILED to authenticate to gain authorization for action com.ubuntu.softwareproperties.applychanges for system-bus-name::1.126 [/usr/bin/python3 /usr/bin/software-properties-gtk -n -t 0] (owned by unix-user:topfs)</div> </div><div><br></div><div><br></div><div style>So from what I can see it seems like it registers alright but it never calls my python scripts method (begin authentication et al).</div><div style>I've registered it under locale sv_SE, perhaps thats wrong or not what fluxbox (which is my testing session) is using by default?</div> <div style>Can I register my agent on any locale?</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> Mirek<br></blockquote><div><br></div><div style>Thanks so much for the help!</div><div style><br></div><div style>Cheers,</div><div style>Tobias</div></div><br></div></div>