Page MenuHomeSolus

Software Center not working in Plasma with systemdBoot
Closed, ResolvedPublic

Description

In Plasma, when I use systemdBoot (kwriteconfig5 --file startkderc --group General --key systemdBoot true), Software Center is unable to install or update applications. Also, SC won't notify of updates.

Workaround: running SC as sudo (sudo solus-sc) or not using systemdBoot.

Event Timeline

clauded created this task.Nov 12 2021, 5:06 PM

mmmh yes, and don't see any errors inside the terminal. What doesn't happen is it doesn't trigger the password field

@JoshStrobl can you give some hints?

If I kill the solus-update-checker process, I can run solus-sc and install packages (password dialog is shown).

Also, this patch seems to work for me: https://github.com/getsolus/solus-sc/pull/16/commits/c1d4e17119cd4b10fe144c2ff093665118fe315e. After logon, the update process is running and I can install packages from solus-sc.

Maybe the solus-update-process starts too early (when network connection is not established yet)?

Doesn't make really sense, because I can trigger this issue manually and I don't see why this should be fixing it.

While pulling down the patch and rebuilding Software center, did you get any ABI changes?

I killed the solus-update-checker process then I manually patched the file (/usr/lib/python2.7/site-packages/solus_update/application.py) + reboot. Now I always get the password prompt.

tried to patch it and did not work for me

clauded added a comment.EditedNov 16 2021, 2:54 PM

Sorry, my mistake: I had disabled systemdBoot :( so back to square one.

One thing I noticed however is that under systemdBoot, the solus-update-checker is not running.

  1. when systemdBoot is enabled, the plasma-polkit-agent is not running so solus-sc can't ask for password. You can see by running the command systemctl --user status plasma-polkit-agent :
plasma-polkit-agent.service - KDE PolicyKit Authentication Agent
     Loaded: loaded (/usr/lib/systemd/user/plasma-polkit-agent.service; static)
     Active: inactive (dead) since Tue 2021-11-23 11:44:00 EST; 6min ago
    Process: 43647 ExecStart=/usr/lib64/kf5/polkit-kde-authentication-agent-1 (code=killed, signal=TERM)
   Main PID: 43647 (code=killed, signal=TERM)
        CPU: 51ms

nov 23 11:44:00 thinkpad systemd[1291]: Started KDE PolicyKit Authentication Agent.
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: New PolkitAgentListener  0x115b200
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: Adding new listener  PolkitQt1::Agent::Listener(0x11>
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: Listener online
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: "Cannot create unix session: No session for pid 4364>
nov 23 11:44:00 thinkpad polkit-kde-auth[43647]: polkit_agent_listener_register_with_options: assertion 'POLKIT_IS_SUBJ>
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: "Cannot register authentication agent!"
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: Authentication agent result: false
nov 23 11:44:00 thinkpad polkit-kde-authentication-agent-1[43647]: Couldn't register listener!
nov 23 11:44:00 thinkpad systemd[1291]: plasma-polkit-agent.service: Succeeded.
  1. I managed to have solus-update-checker running by creating a systemd user service:
$ mkdir -p ~/.config/systemd/user/
$ vi ~/.config/systemd/user/solus-update-checker.service

[Unit]
Description=solus-update-checker

[Service]
ExecStart=/usr/bin/solus-update-checker

[Install]
WantedBy=default.target

$ systemctl --user enable solus-update-checker.service
$ systemctl --user start solus-update-checker.service
$ systemctl --user status solus-update-checker.service

well yea this would work, but this is more a workaround patch then acutally fixing the main issue that polkit fails, I suspect that our polkit version is just to old but this won't be a simple update

Girtablulu added a project: Software.

By the way, a quite nasty CVE affects polkit (https://access.redhat.com/security/cve/CVE-2021-3560) and it's fixed in version 0.119 so it might be worthwhile to upgrade.

By the way, a quite nasty CVE affects polkit (https://access.redhat.com/security/cve/CVE-2021-3560) and it's fixed in version 0.119 so it might be worthwhile to upgrade.

Our polkit package has had patches for all known CVEs backported to it, so us being on 0.113 does not mean we are less secure than if we were on a newer version.

We're on 0.113 because upstream polkit added a highly divisive hard dependency on mozjs as a javascript engine (mozjs is 800MB once installed, this is also the reason Ubuntu/Debian are on an "old" version as well). Ikey forked the then-current version of polkit and ripped the mozjs dependency out of it, but unfortunately that fork has not been maintained and it would likely be a substantial amount of work to rebase it on a current version.

The upstream polkit effort to allow duktape (371KB installed) to be used instead of mozjs is nearing completion however, so perhaps we could switch to that instead once it's part of a released version?

One other thing I noticed: when using systemdBoot with plasma, not only solus-sc is affected but other software that require elevated privileges like the partition editor.

@clauded that makes sense because they all rely on polkit.

DataDrake triaged this task as Needs More Info priority.
DataDrake moved this task from Backlog to Update Requested on the Software board.

I need to rebase out polkit-noscript branch on the latest polkit release. Let's see where we land after that.

It looks like polkit 121-26-1 in unstable fixes this issue.

I figured it would. Go ahead and close this then (I don't have permission to do so).

Staudey closed this task as Resolved.Jul 29 2022, 7:09 PM
Staudey added a subscriber: Staudey.