install updates as unprivileged user

**mgoppold** · 15-Feb-2010, 11:59

Hi,

I'm getting frustrated. I want to grant an unprivileged user to install updates via gpk-update-viewer for more than 2 days

.

That's what I have tried to do:

run polkit-gnome-authorization but there ist no org.freedesktop.packagekit.system-update to edit

edit /etc/PolicyKit/PolicyKit.conf with

Code:

<config version="0.1">
   <match action="org.freedesktop.packagekit.system-update">
      <match user="user1">
         <return result="yes"/>
      </match>
   </match>
</config>

run as root polkit-auth

Code:

polkit-auth --user user1 --grant org.freedesktop.packagekit.system-update
polkit-auth --user user1 --explicit-detailorg.freedesktop.packagekit.system-update
  Authorized:  No
  Scope:       Indefinitely
  Obtained:    Mon Feb 15 18:41:29 2010 from root (uid 0)

edit /etc/polkit-default-privs.local with

Code:

org.freedesktop.packagekit.package-install                      auth_self_keep_session
org.freedesktop.packagekit.package-remove                       auth_self_keep_session
org.freedesktop.packagekit.system-update                        auth_self_keep_session

edit /etc/polkit-1/localauthority.conf.d/50-localauthority.conf with

Code:

[Updates]
Identity=unix-user:user1
Action=org.freedesktop.packagekit.system-update
ResultAny=auth_self_keep
ResultInactive=auth_self_keep
ResultActive=auth_self_keep

Without success! What's wrong? Am I too stupid to read config-files and/or man-pages?

Thanks in regard

Mario

**Knurpht** · 15-Feb-2010, 12:12

Just a wild guess:

is it in 'auth_self_keep_session' ? Could it be that that requires authentication per session? Instead of auth_self_keep ?

**mgoppold** · 15-Feb-2010, 12:26

Yes 'auth_self_keep_session' is rigth in /etc/polkit-default-privs.local but 'man pklocalauthority' says ResultActive={yes,no,auth_self,auth_self_keep, auth_admin,auth_admin_keep} in /etc/polkit-1/localauthority.conf.d/50-localauthority.conf

**mgoppold** · 18-Feb-2010, 11:36

Hi all,

the solution is to edit /etc/polkit-default-privs.local like above and run /sbin/set_polkit_default_privs once

.

The result can be found at /var/lib/polkit-1/localauthority/10-vendor.d.
There are files named like their corresponding pokit action with pkla suffix.
The content of the file is like my last try in the post (with little differences).

/var/lib/polkit-1/localauthority/10-vendor.d/org.freedesktop.packagekit.system-update.pkla:

Code:

[org.freedesktop.packagekit.system-update]
Identity=unix-user:*
Action=org.freedesktop.packagekit.system-update
ResultAny=auth_self_keep
ResultInactive=auth_self_keep
ResultActive=auth_self_keep

There is one question left:
Why doesn't polkit-gnome-authorization provide org.freedesktop.packagekit.* and other useful actions?

Mario