Running pkexec without a graphical agent fails even with falling back onto pkttyagent - polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie

[CMCDragonkai]

Issue description

Running pkexec pwd gives you:

polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

I don't have a graphical polkit agent running, so pkexec should fallback onto pkttyagent. However it doesn't seem to work in this case.

Note that to make it work, I have to run pkttyagent in a different terminal binding to the PID of the first terminal that is running pkexec pwd, and that terminal will show the same workflow but will have succeeded at authentication. But this shouldn't be necessary as the pkttyagent should just work on the original terminal when called by pkexec.

[erlandsona]

I'm trying to run hdajackretask to get the internal audio working on my system and before I downgraded back to 17.03 I couldn't even get it to run, now that it's running when I try to apply a configuration and type my password root or otherwise I'm getting this error.

Can you explain a bit more how to fix?

[EstalillaJ]

Thanks for tip @CMCDragonkai, saved me some investigation time.

@erlandsona It's probably too late but what he means is you should open two terminals.
In the first terminal run the following command to get its PID.

echo $$

In the second terminal run

pkttyagent --process PID_FROM_STEP_1

In the first terminal, do whatever you need to do with pkexec.

[Jamie-505]

saved me right there!

just in case: if you need to do this over ssh just open 2 connections in two terminals and run @EstalillaJ code!

[phisigma]

Is this related with bugs.debian.org/cgi-bin/bugreport.cgi?bug=841878?

I use Ubuntu 18.04 with Mate and running /usr/lib/x86_64-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1 solves the problem, but only temporary. Furthermore, when you create another admin user and log into his account, he does not observe any errors.

Perhaps there is a permanent solution for my account? (Besides adding above polkit command to startup programms.)

[iFreilicht]

It seems that this is due to the authentication agent not running. I am on Ubuntu, but maybe this will help in solving this problem:

I had to install policykit-1-gnome:

sudo apt install policykit-1-gnome

And then run it (same terminal using &, other terminal, or adding it to autostart all worked):

/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1

After that pkexec worked as expected.

[fcolecumberri]

Is this related with bugs.debian.org/cgi-bin/bugreport.cgi?bug=841878?

I use Ubuntu 18.04 with Mate and running /usr/lib/x86_64-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1 solves the problem, but only temporary. Furthermore, when you create another admin user and log into his account, he does not observe any errors.

Perhaps there is a permanent solution for my account? (Besides adding above polkit command to startup programms.)

also fix my problem, but on gentoo the polkit agent is /usr/libexec/polkit-mate-authentication-agent-1 and need to install mate-extra/mate-polkit

[Artturin]

#144797

[Artturin]

found more info in the thread of the patch that introduced this bug https://bugs.freedesktop.org/show_bug.cgi?id=90837#c20

[dit7ya]

Seems like there is an open merge request solving it but no more activity.
https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/122

[GrabbenD]

nixpkgs.overlays = [
  (self: super: {
    polkit = super.polkit.overrideAttrs (oldAttrs: {
      patches = oldAttrs.patches ++ [
        (super.fetchpatch {
          url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/716a273ce0af467968057f3e107156182bd290b0.patch";
          sha256 = "sha256-hOJJhUmxXm87W1ZU9Y1NJ8GCyKvPjbIVtCHlhRGlN8k=";
        })];
    });
  })
];

Thanks @Artturin (^)!
I'm able to enter the password from the shell now

[Strum355]

Is it somehow possible to use this via system.replaceRuntimeDependencies instead of an overlay to avoid large amounts of rebuilds? I wasnt able to get it working with a trivial attempt

[Artturin]

Is it somehow possible to use this via system.replaceRuntimeDependencies instead of an overlay to avoid large amounts of rebuilds? I wasnt able to get it working with a trivial attempt

It should be possible, but let's try adding a package option to the polkit module #322194
EDIT: it works so no need to overlay or replaceRuntimeDependencies

[septatrix]

This seems to be resolved in the current development branch of polkit polkit-org/polkit#423 though that is not contained in any release yet.

[Artturin]

This seems to be resolved in the current development branch of polkit polkit-org/polkit#423 though that is not contained in any release yet.

#322207

[Atemu]

I had to hide a bunch of duplicate and off-topic comments.

Please keep in mind that this is the NixOS/Nixpkgs issue tracker rather than a general Linux forum and that you can silently express your gratitude for workarounds using reactions.