Aloha, running 10.3 and I updated to a newer HAL using software.opensuse.org and 1-click (needed for a new USB app I installed,) and until now I’ve had no problems suspending. Now I can only suspend from root. From a user account I get this:
> powersave -u
User is not allowed for hal-power-suspend according to PolicyKit.
I read up a bit on PolicyKit and tried to gain the action:
> polkit-grant --gain org.freedesktop.hal.power-management.suspend
Attempting to gain the privilege for org.freedesktop.hal.power-management.suspend.
polkit-grant-helper: given auth type (8 -> yes) is bogus
Failed to gain the privilege for org.freedesktop.hal.power-management.suspend.
Googling found others with similar problems but no resolutions, so after reading the man page for the polkit config file:
<match user="mauibay">
<return result="yes"/>
</match>
I expected the user mauibay to be able to perform any action, but I still get the same “User is not allowed” error. So, I just used sudo to run powersave and thought that would work around it, but I noticed that after a few suspends the system wouldn’t suspend any more and needed to be rebooted. My best guess is that using root to suspend is borking something on resume that eventually causes a problem, so I thought I’d get back to trying to fix the polkit issue and am now stuck. This is the first time I’ve run into polkit and the solution eludes me so far.
Is there a way to disable polkit completely? I have no need for it. Or is there at least a way to give my user account permission for all actions?
Any advice would be welcomed!
PolicyKit has evolved considerably over the last few months, so the exact implementation and file layout varies between distro versions. Do you have a /usr/share/PolicyKit/policy directory? If so, have a look for the power-management policy:
linux:/usr/share/PolicyKit/policy # ls
ConsoleKit.policy
org.freedesktop.hal.dockstation.policy
org.freedesktop.hal.killswitch.policy
org.freedesktop.hal.policy
org.freedesktop.hal.power-management.policy
org.freedesktop.hal.storage.policy
org.freedesktop.hal.wol.policy
org.freedesktop.network-manager-settings.system.policy
org.freedesktop.packagekit.policy
org.freedesktop.policykit.policy
My settings look like this:
<action id=“org.freedesktop.hal.power-management.suspend”>
<description>Suspend the system</description>
<message>System policy prevents suspending the system</message>
<defaults>
<allow_inactive>no</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
Not sure of the differences between 10.3 and 11, but once you’ve located the relevant policy file, post the output here for further help with it. I’ve found editing these permissions by hand easier for me.
Aha. So I take it that /etc/PolicyKit/PolicyKit.conf is no longer used.
I do have /usr/share/PolicyKit/policy with those files in it, and /usr/share/PolicyKit/policy/org.freedesktop.hal.power-management.policy has exactly the same contents as your file.
The file header lists http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd as the location of the documentation, but that page returns a 404 error. I browsed through several directories at the server root but didn’t see anything PolicyKit related. Where can I find docs for these config files? I assume I should just need to edit /usr/share/PolicyKit/policy/org.freedesktop.hal.power-management.policy in some way so that user accounts are allowed to suspend.
At first glance it looks like the default is to allow suspending, so I think I’ll need the docs to understand what I need to change since obviously that’s not the case.
Also, is there a process to bounce or command to use to reload the config after I edit the file? I would hope there is a convenient way to reload he config without rebooting. I’ve seen mention of polkit-reload, but that command doesn’t exist on my system:
> polkit-
polkit-config-file-validate polkit-grant polkit-list-actions polkit-policy-file-validate
Don’t want to lead you on a wild goose chase, but I’m intrigued by your problem. I’d like to know what causes it to break for some users. Not sure what commands you have available with your PolicyKit version…What does polkit-auth --user <your username here> give (if anything)?
I get:
linux:/home/dean # polkit-auth --user dean
org.freedesktop.packagekit.refresh-cache
org.freedesktop.consolekit.system.stop
org.freedesktop.consolekit.system.restart
org.freedesktop.hal.lock
org.freedesktop.hal.killswitch.bluetooth
org.freedesktop.hal.killswitch.wlan
org.freedesktop.hal.killswitch.wwan
org.freedesktop.hal.storage.mount-removable
org.freedesktop.hal.storage.eject
org.freedesktop.hal.storage.crypto-setup-removable
org.freedesktop.hal.power-management.shutdown
org.freedesktop.hal.power-management.reboot
org.freedesktop.hal.power-management.set-powersave
org.freedesktop.hal.power-management.suspend
org.freedesktop.hal.power-management.hibernate
org.freedesktop.hal.power-management.standby
org.freedesktop.hal.power-management.cpufreq
org.freedesktop.hal.power-management.lcd-panel
org.freedesktop.hal.power-management.light-sensor
org.freedesktop.hal.power-management.keyboard-backlight
org.freedesktop.hal.dockstation.undock
org.freedesktop.hal.wol.enabled
org.freedesktop.hal.wol.enable
org.freedesktop.hal.wol.supported
There is a ‘polkituser’ group kisted in YaST > User and Group Management (at least with openSUSE 11) but I’m not sure how relevant this is to you. You could try adding the user to it. (However, for me this is not necessary).
Hopefully, someone more knowledgeable than me can offer some useful advice.
As you can see from my post above, I don’t have polkit-auth on my system.
I suspect the situation is that the HAL version I installed is either mismatched with my PolicyKit version and/or it’s dependencies are incomplete.
I just now downgraded the hal 0.5.11 to 0.5.9 via the ymp 1-click and the polkit issue has gone away.
I had to use the hal-devel 1-click to downgrade, the hal package took me to dependency hell, one of the broken dependencies was hal-devel so I canceled and tried the hal-devel instead hoping that it would result in a working dependency chain and it seemed to work. So now I have:
> rpm -qa |grep hal
hal-devel-0.5.9_git20070831-13.2
hal-palm-0.12.2-26
hal-resmgr-0.1_SVNr141-29
hal-32bit-0.5.9_git20070831-13
hal-0.5.9_git20070831-13.2
I did still have to install hal-32bit manually, the 1-click kept the 0.5.11 version. I really wish the dependencies worked for this stuff, it mostly defeats the purpose of using a package manager when it’s so often results in mixed-version packages, but that’s a whole other issue. 
Anyway, I don’t know if my PolicyKit issue is real or not. Either I ran into a real bug and am now avoiding it by changing the HAL, or it was a broken/mismatched HAL/PolicyKit version in the first place, or there was just something bad with one of the package installs in the first place.
One thing I do know is PolicyKit seems inadequately documented. There are no man pages installed for the standard package and the links in the conf files point to nonexistent web pages.
None of my package updates had PolicyKit in the dependencies, and so my version 0.4-21 was never updated. I suspect that’s a problem and that hal 0.5.11 requires a newer version. Unless I run into more problems I’ll be content to wait for the next version of openSuse and upgrade at that time.
Well, it seems you’ve managed to ‘fix’ the permissions problem. I wish I knew more about the interplay between HAL and PolicyKit. BTW, what PolicyKit package version do have installed?
I just used the openSUSE software web search tool to check out available PolicyKit packages. Quite a few versions available.
As I said in my previous post, the PolictKit version I have installed is 0.4-21. I’m convinced the dependencies for newer versions are similarly incomplete to the HALs. Apparently there is version sensitivity between PolicyKit and HAL.