NetworkManager and PolicyKit

English Network/Internet
1

Hi all,

I am having problem with, I believe, PolicyKit. When I try to start OpnVPN connection from SystemTray NetworkManager applet a dialog pops up asking for root password. The title on the dialog window says “PloicyKit KDE Agent”. After a valid root password entered it is rejected. But the same password accepted by “su” command in bash, so the password is valid.
I remember that about a month ago everything worked fine. In the meantime I installed some updates and apparently something got broken. Has anybody encountered similar problem, does anybody has a hunch how to fix it?

I am running Tumbleweed, KDE Plasma (X11). The only thing that shows up in logs is “gkr-pam: unable to locate daemon control file” (what file? is gkr=gnome-keyring? why Gnome?)

Here are the relevant messages from systemd journal:
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: "Password: "
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: Request: "Password: "
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: REQUEST
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: Trying again
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: Finishing obtaining privileges
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: Completed: false
Jun 11 20:47:31 some.host polkit-kde-authentication-agent-1[3093]: COMPLETED
Jun 11 20:47:29 some.host polkit-agent-helper-1[4092]: pam_unix(polkit-1:auth): authentication failure; logname= uid=1000 euid=1000 tty= ruser=root rhost= >
Jun 11 20:47:29 some.host unix_chkpwd[4096]: password check failed for user (root)
Jun 11 20:47:29 some.host unix_chkpwd[4096]: check pass; user unknown
Jun 11 20:47:29 some.host polkit-agent-helper-1[4092]: pam_kwallet5(polkit-1:auth): (null): pam_sm_authenticate
Jun 11 20:47:29 some.host polkit-agent-helper-1[4092]: gkr-pam: unable to locate daemon control file
Jun 11 20:47:29 some.host polkit-kde-authentication-agent-1[3093]: Dialog accepted
Jun 11 20:47:19 some.host NetworkManager[1795]: <info> [1560300439.3528] audit: op=“statistics” arg=“refresh-rate-ms” pid=3088 uid=1000 result=“success”
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: "Password: "
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: Request: "Password: "
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: REQUEST
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: Trying again
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: WinId of the shown dialog is 41943085 41943085
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: WinId of the dialog is 41943085 41943085
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: Action description has been found
Jun 11 20:47:19 some.host NetworkManager[1795]: <info> [1560300439.2976] audit: op=“statistics” arg=“refresh-rate-ms” pid=3088 uid=1000 result=“success”
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: Message of action: "System policy prevents modification of network settings for all use>
Jun 11 20:47:19 some.host polkit-kde-authentication-agent-1[3093]: Initiating authentication

2

I wonder if your problem is related to 2 other gkr-pam problems posted within the last few days in the Applications forum…
Those other two problems use gkr-pam for User authentication on a dovecot mailserver while yours appears to be kwallet related.

A short term workareoudn probably would be to not use kwallet for saving your passwords… I find it curious that your log says that first root credentials were tried but not found before trying regular User credentials.

Recommend submitting a bug to https://bugzilla.opensuse.org.
Include the logfile snippet you posted.

TSU

3

Hi,
thank you for letting me know that there are two other reports, that seem to be related to gkr-pam. I will take a look. Also, I disabled kwallet but the problem still persists. My understanding is that kwalled is used to store VPN passwords in an encrypted form. In my case I set NetworkManager to ask for passwords every time I want to open a VPN connection, so there is a chance that kwallet has nothing to do with this problem. Also, if I use nmcli as root ( “su -” works and accepts root password) to launch OpenVPN connection it works (“nmcli connection up [VPN_NAME] --ask”).

4

Hi,
un-installing pam_kwallet fixes the problem. I also posted on “Application” forum [https://forums.opensuse.org/showthread.php/536440-PolicyKit-fails-with-systemsettings5-NetworkManager-ssh-(and-more-)] and the fix was suggested there.