New wireless requires root permission in OpenSUSE 12.3

English Network/Internet
21

Looks ok. rpm -V doesn’t give any output if all files are unchanged.

I tried various combinations for /etc/polkit-default-privs.local including

org.freedesktop.network-manager-settings.system.modify auth_admin:auth_admin:yes
org.freedesktop.NetworkManager.enable-disable-network auth_admin:auth_admin:yes
org.freedesktop.NetworkManager.enable-disable-wifi auth_admin:auth_admin:yes
org.freedesktop.NetworkManager.network-control auth_admin:auth_admin:yes
org.freedesktop.NetworkManager.settings.modify.own auth_admin:auth_admin:yes
org.freedesktop.NetworkManager.settings.modify.system auth_admin:auth_admin:yes

Oops, sorry! I think now ‘org.freedesktop.NetworkManager.enable-disable-wifi’ is for the “Enable Wireless” checkbox in the NetworkManager applet.
Maybe the right one would be ‘org.freedesktop.NetworkManager.use-user-connections’. This one is not available in /usr/share/polkit-1/actions. But it is in /etc/polkit-1/rules.d/90-default-privs.rules…

22

Oh well. This one existed once but was removed in 2010. See NetworkManager/NetworkManager - Unnamed repository; edit this file to name it for gitweb. if you’re interested.
So this can’t be the right one either…

But according to Access Denied this should work:

As root:

  • make sure package polkit-default-privs is installed
  • edit /etc/polkit-default-privs.local
    • add these lines:
      org.freedesktop.NetworkManager.settings.modify.own yes
      org.freedesktop.NetworkManager.settings.modify.system yes
  • run /sbin/set_polkit_default_privs

I will try that tomorrow to see if this has any effect on my system… (of course I will set them to ‘no’ :wink: )

23

SUCCESS!

Since you folks talked me into to sticking with systemD, I decided to read about it.

The problem appears to have arisen because I was booting into run level 2 and then having root start kdm for X.

Instead one must:

>systemctl isolate runlevel5.target

in order to start all of the various processes including kdm, then everything works. This became clear as all of you led me through the various files that determine permissions.

Incidentally, my system resides entirely on a 500 GB portable “Passport” USB drive. It is fully encrypted with root and home partititions in a LV and the boot directory on its own separate unencrypted partition. When at home I plug it into my home machine. When at work plug it into my office machine. In fact it will run any 64 bit machine. I’ve been doing this since Opensuse 11.1. In the past I was even able to install the proprietary NVIDIA driver, which loaded automatically when the appropriate hardware was present. With 12.3 the proprietary drivers don’t seem to be necessary. I had to install Opensuse 12.3 to replace 11.3 which could no longer deal with Verizon’s DSL.

Thank you all very much.

24

So maybe polkitd wasn’t even running?
That would explain why changing the privileges had no effect…rotfl!
Well, glad you found the problem!:slight_smile:

Just to finish this off:

I tried that and yes, those are really the policy action rules that affect this.
Also, changing them in the KDE systemsettings module did have effect (immediately, I didn’t even have to log out)
You just have to change the right rules, of course…:wink: Btw., the authorization dialog does show the rule which causes to ask for the password. Just click on the “Details” button.

One thing I don’t quite understand yet, is how the default privileges are supposed to work.
If I call “set_polkit_default_privs” those actions in /usr/share/polkit-1/actions aren’t touched at all and still remain active as they were set.
But anyway…

25

One thing I don’t quite understand yet, is how the default privileges are supposed to work.
If I call “set_polkit_default_privs” those actions in /usr/share/polkit-1/actions aren’t touched at all and still remain active as they were set.
But anyway…

No, the active (pkla) policy files reside in /var/lib/polkit-1/localauthority/10-vendor.d/

26

Ah, I overlooked that. (only saw /var/lib/polkit/ which was empty…)

But:
/var/lib/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.settings.modify.own.pkla contains this now:

[org.freedesktop.NetworkManager.settings.modify.own]Identity=unix-group:*
Action=org.freedesktop.NetworkManager.settings.modify.own
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_admin

On the other hand, /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy contains:

    <defaults>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>

The KDE settings module clearly shows the latter and I am not asked for a password, so this is the one that seems to be active…

And what about /etc/polkit* and set_polkit_default_privs? They didn’t seem to change /var/lib/polkit-1/localauthority/10-vendor.d/ either… Only /etc/polkit-1/rules.d/90-default-privs.rules
:\

27

Well, and “systemctl status polkit.service” tells me:

May 02 12:33:24 amiga polkitd[10805]: Started polkitd version 0.110                                                                                                                May 02 12:33:24 amiga polkitd[10805]: Loading rules from directory /etc/polkit-1/rules.d
May 02 12:33:24 amiga polkitd[10805]: Loading rules from directory /usr/share/polkit-1/rules.d
May 02 12:33:24 amiga polkitd[10805]: Finished loading, compiling and executing 2 rules

So nothing gets loaded from /var/lib/polkit-1/localauthority/ …
What role does this play then?

I only found it being mentioned in the pklocalauthority man page from polkit-0.105. But that’s not there any more in v0.110 included in oS12.3…