Hello,
I have a Epson perfection V30 scanner (usb) and since some times when I want to use “Image scan for linux” (iscan) it asks root password with this title “Authentication is required to manage system services or other units”, in the details I have
ident : org.freedesktop.systemd1.manage-units
Supplier: The systemd Project
polkit.subject.id:6001
polkit.caller-pid:6001
ps -ef | grep 6001
philippe 6001 2265 0 08:49 ? 00:00:00 /usr/bin/iscan
After thae authentication, if I close the iscan program and reload it the authentication is never asked again. Seems that the authentication is only asked by the first use of iscan after a reboot.
Scanner data
hpprol2:~ # lsusb | grep Perfection
Bus 001 Device 005: ID 04b8:0131 Seiko Epson Corp. GT-F720 [GT-S620/Perfection V30/V300 Photo]
philippe@hpprol2:~>sudo getfacl /dev/bus/usb/001/005
[sudo] Root password :
# file: dev/bus/usb/001/005
# owner: root
# group: root
user::rw-
group::rw-
other::r--
After authentication I have
hpprol2:~> sudo getfacl /dev/bus/usb/001/005
getfacl: Removing leading '/' from absolute path names
# file: dev/bus/usb/001/005
# owner: root
# group: lp
user::rw-
**user:philippe:rw-**
group::rw-
mask::rw-
other::r--
I found this document https://en.opensuse.org/SDB:Configuring_Scanners (maybe obsolete for tumbleweed?)
USB scanners and scanner units in USB multifunction devices (printer/scanner/copier) get normal-user read/write access via udev and for the printer unit in a USB multifunction device it is sufficient that the device node has group “lp” and group read/write access (also via udev) because the CUPS backend runs as user “lp” that is in group “lp”. (CUPS backends and SANE backends are different things. For CUPS backends see “What is a CUPS backend and how does it work” in SDB:CUPS in a Nutshell.)
Therefore USB scanners and USB multifunction devices get “rw-rw-r-- root lp” set for the device node which happens via /etc/udev/rules.d/55-libsane.rules (from sane-backends RPM) and for HP all-in-one devices additionally via /usr/lib/udev/rules.d/56-hpmud.rules (from the hplip RPM).
Both set ENV{libsane_matched}=“yes” and that one triggers in /usr/lib/udev/rules.d/70-uaccess.rules (from the systemd RPM) that TAG+=“uaccess” is set which triggers in /usr/lib/udev/rules.d/73-seat-late.rules (from the systemd RPM) to RUN{builtin}+=“uaccess” that manages device node user ACLs which finally results the ‘+’ in “rw-rw-r–+ root lp” (i.e. an ACL setting) for the device node.
I don’t understand why the authentication is needed;
I checked the different udev rules (now in /usr/lib/udev/rules.d) and all seems correct in the rules;
cat 55-libsane.rules
# Epson GT-F720 | Epson GT-S620 | Epson Perfection V30
# Epson Perfection V300 Photo
ATTR{idVendor}=="04b8", ATTR{idProduct}=="0131", MODE="0664", GROUP="lp", ENV{libsane_matched}="yes"
cat 70-uaccesss.rules
# SCSI and USB scanners
ENV{libsane_matched}=="yes", TAG+="uaccess"...
Journalctl -b for the user
mars 25 08:49:26 hpprol2 iscan[6001]: io/hpmud/model.c 532: no hp_HP_LaserJet_200_color_M251n attributes found in /usr/share/hplip/data/models/models.dat
mars 25 08:49:26 hpprol2 iscan[6001]: io/hpmud/model.c 543: no hp_HP_LaserJet_200_color_M251n attributes found in /usr/share/hplip/data/models/unreleased/unreleased.dat
mars 25 08:50:51 hpprol2 iscan[6001]: protocol/discovery/avahiDiscovery.c 472: Failed to create client object: Daemon not running
mars 25 08:51:20 hpprol2 systemd[2061]: app-iscan-b59055f3d3214b06a9674bf9d28ff0e6.scope: Consumed 1.092s CPU time.
My user is member of group lp. Why does iscan look to the printer HP_LaserJet_200_color_M251n (network printer with no scanner)?
More strange if I cancel the authentication request the iscan program starts and I can scan a page without problem.
Journalctl with root shows
Mar 25 08:50:51 hpprol2 polkitd[755]: Operator of unix-session:2 FAILED to authenticate to gain authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.102 [/usr/bin/iscan] (owned by unix-user:philippe)
Did I miss something or is it a bug?
Many thanks in advance
Philippe