Polkit-Agent-Helper not starting

Nasendackel · December 19, 2025, 4:51pm

Hi, I just saw that the polikit-agent-helper is not running an refuses to start. Something I can do?

× polkit-agent-helper@0-1676-60578.service - Authorization Manager Agent Helper (PID 1676/UID 60578)
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper@.service; static)
     Active: failed (Result: exit-code) since Fri 2025-12-19 17:46:36 CET; 2min 21s ago
 Invocation: 32175e19912f4f38affe7db2204962de
TriggeredBy: ● polkit-agent-helper.socket
       Docs: man:polkit(8)
    Process: 4385 ExecStart=/usr/libexec/polkit-1/polkit-agent-helper-1 --socket-activated (code=exited, status=1/FAILURE)
   Main PID: 4385 (code=exited, status=1/FAILURE)
        CPU: 42ms

● polkit-agent-helper.socket - Authorization Manager Agent Helper
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper.socket; enabled; preset: enabled)
     Active: active (listening) since Fri 2025-12-19 17:46:09 CET; 2min 47s ago
 Invocation: b8f0e62543a34d52afecd5ccd8218d42
   Triggers: ● polkit-agent-helper@0-1676-60578.service
       Docs: man:polkit(8)
     Listen: /run/polkit/agent-helper.socket (Stream)
   Accepted: 1; Connected: 0;
     CGroup: /system.slice/polkit-agent-helper.socket

arvidjaar · December 19, 2025, 5:55pm

Do you observe any actual problem because of this? Something does not work?

karlmistelberger · December 19, 2025, 7:32pm

Errors occurred in previous boot:

erlangen:~ # journalctl -b -1 -u init.scope -g polkit
Dec 17 06:08:10 erlangen systemd[1]: Created slice Slice /system/polkit-agent-helper.
Dec 17 06:08:31 erlangen systemd[1]: polkit-agent-helper@0-21775-1001.service: Main process exited, code=exited, status=1/FAILURE
Dec 17 06:08:31 erlangen systemd[1]: polkit-agent-helper@0-21775-1001.service: Failed with result 'exit-code'.
Dec 17 06:08:31 erlangen systemd[1]: polkit-agent-helper@0-21775-1001.service: Triggering OnFailure= dependencies.
Dec 17 06:08:31 erlangen systemd[1]: failure-notification@polkit-agent-helper@0-21775-1001.service: Deactivated successfully.
Dec 17 06:08:38 erlangen systemd[1]: polkit-agent-helper@1-91347-1000.service: Main process exited, code=exited, status=1/FAILURE
Dec 17 06:08:38 erlangen systemd[1]: polkit-agent-helper@1-91347-1000.service: Failed with result 'exit-code'.
Dec 17 06:08:38 erlangen systemd[1]: polkit-agent-helper@1-91347-1000.service: Triggering OnFailure= dependencies.
Dec 17 06:08:38 erlangen systemd[1]: failure-notification@polkit-agent-helper@1-91347-1000.service: Deactivated successfully.
Dec 19 20:20:12 erlangen systemd[1]: Removed slice Slice /system/polkit-agent-helper.
Dec 19 20:20:12 erlangen systemd[1]: polkit.service: Deactivated successfully.
Dec 19 20:20:12 erlangen systemd[1]: polkit.service: Consumed 4.241s CPU time.
Dec 19 20:20:14 erlangen systemd[1]: polkit-agent-helper.socket: Deactivated successfully.
erlangen:~ #

Graphical sessions started at tty3 and tty5 failed. New sessions were started at tty7 and tty9.

After reboot sessions again start at tty3 and tty5. No errors occur in current boot:

erlangen:~ # journalctl -b -u init.scope -g polkit
-- No entries --
erlangen:~ #

Nasendackel · December 19, 2025, 7:50pm

No, but I just saw the error in cockpit

arvidjaar · December 19, 2025, 8:14pm

AFAIU polit agents will directly spawn polkit-agent-helper-1 if connection fails which may explain lack of problems.

I cannot reproduce it, either with or without SELinux. The only reason I can think of is lack of SUID bit. Show

ls -lZ /usr/libexec/polkit-1/polkit-agent-helper-1

Nasendackel · December 19, 2025, 8:43pm

Here we go:

-rwsr-xr-x. 1 root root system_u:object_r:policykit_auth_exec_t:s0 18552 13. Okt 10:31 /usr/libexec/polkit-1/polkit-agent-helper-1*

malcolmlewis · December 19, 2025, 9:30pm

@Nasendackel I’m not seeing your issue here…

systemctl status polkit-agent-helper.socket 
● polkit-agent-helper.socket - Authorization Manager Agent Helper
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper.socket; enabled; preset: enabled)
     Active: active (listening) since Fri 2025-12-19 15:26:23 CST; 39s ago
 Invocation: 5405835a04d04d15a88e4eed0a2ab0c3
       Docs: man:polkit(8)
     Listen: /run/polkit/agent-helper.socket (Stream)
   Accepted: 0; Connected: 0;
     CGroup: /system.slice/polkit-agent-helper.socket

Dec 19 15:26:23 systemd[1]: Listening on Authorization Manager Agent Helper.

journalctl -b -1 -u init.scope -g polkit
Dec 18 15:59:02 systemd[1]: polkit.service: Deactivated successfully.
Dec 18 15:59:02 systemd[1]: polkit-agent-helper.socket: Deactivated successfully.

ls -lZ /usr/libexec/polkit-1/polkit-agent-helper-1
-rwsr-xr-x. 1 root root system_u:object_r:policykit_auth_exec_t:s0 18552 Oct 13 03:31 /usr/libexec/polkit-1/polkit-agent-helper-1

cat /etc/os-release | grep VERSION_ID
VERSION_ID="20251217"

Nasendackel · December 19, 2025, 9:44pm

Thanks. My Problem is

sudo systemctl status polkit-agent-helper@0-1718-60578.service

That creates error. I am totally sorry, but can some explain to me what the @0-178… does?

sudo systemctl status polkit-agent-helper@0-1718-60578.service 
× polkit-agent-helper@0-1718-60578.service - Authorization Manager Agent Helper
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper@.service; static)
     Active: failed (Result: exit-code) since Fri 2025-12-19 22:35:36 CET; 7min ago
 Invocation: 6f838e8fb01a4a02afb09d7b52000c76
       Docs: man:polkit(8)
   Main PID: 4099 (code=exited, status=1/FAILURE)
        CPU: 49ms

malcolmlewis · December 19, 2025, 9:51pm

@Nasendackel Look at the pstree | grep polkit or output for that PID 4099, but likely gone…
I see no service like that here on GNOME.

Nasendackel · December 19, 2025, 10:02pm

I just get
| -polkitd---3*[{polkitd}]

So you don’t have a helper@service?

malcolmlewis · December 19, 2025, 10:04pm

@Nasendackel no, none at all… If you mask it, does another get created?
systemctl mask polkit-agent-helper@0-1718-60578.service

karlmistelberger · December 20, 2025, 6:16am

Nope. It doesn’t create an error. An earlier instance of polkit-agent-helper@ failed. Show the status:

erlangen:~ # systemctl --failed 
  UNIT          LOAD   ACTIVE SUB    DESCRIPTION
● Crucial.mount loaded failed failed /Crucial

Legend: LOAD   → Reflects whether the unit definition was properly loaded.
        ACTIVE → The high-level unit activation state, i.e. generalization of SUB.
        SUB    → The low-level unit activation state, values depend on unit type.

1 loaded units listed.
erlangen:~ #

Clear the status:

erlangen:~ # systemctl reset-failed 
erlangen:~ # systemctl --failed 
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.
erlangen:~ #

For details see Polkit-Agent-Helper not starting - #3 by karlmistelberger

Nasendackel · December 20, 2025, 8:49am

yes, another is created. I think, I will just do a reinstall…

karlmistelberger · December 20, 2025, 9:02am

That is a complete exaggeration. Reboot and try again.

Nasendackel · December 20, 2025, 9:42am

yes, but after every reboot the error appeared again. So rolled back to 5 day old snapshot.
no more polkit error.
No doing an update and see, if it appears again.

Nasendackel · December 20, 2025, 9:58am

Ok. error back when I updated to lastest packages:

sudo systemctl --failed
  UNIT                                     LOAD   ACTIVE SUB    DESCRIPTION
● polkit-agent-helper@0-1611-60578.service loaded failed failed Authorization Manager Agent Helper (PID 1611/UID 60578)

karlmistelberger · December 20, 2025, 11:34am

But your machine runs a graphical login I presume.

Occasionally sddm gets confused. You may run as root rm -r /var/lib/sddm/ and reboot.

Nasendackel · December 20, 2025, 11:55am

Thanks. I use GDM. I did a fresh reinstall. thanks to my backup, it just takes a few hours and everythink is back to normal.
Not the most elegant way, but the easiest…

susedog · January 8, 2026, 4:45pm

I think I have run into a related problem. I’m no specialist in this, so I admit I had Claude troubleshoot it with me, which was slow going. But then I pasted the content of this thread in the conversation and that seems to have put Claude on the right track. It seems to have found the issue and suggested a workaround that works. I then had it summarise the problem and workaround, so that somebody more knowledgeable than me here on the forum can hopefully look into it, since I would prefer to undo the workaround.

Please don’t slam me for troubleshooting with AI, but I didn’t get any further on my own.

Here’s the summary:

Problem

After a recent Tumbleweed polkit update, YubiKey (pam_u2f) authentication for GNOME admin popups stopped working. The polkit-agent-helper fails with:

gnome-shell[5701]: Unknown line 'polkit-agent-helper-1: pam_authenticate failed: Authentication failure' from helper
polkit-agent-helper-1: pam_unix(polkit-1:auth): conversation failed

Root cause: The new systemd socket-activated polkit-agent-helper.socket cannot properly handle interactive PAM conversations required by pam_u2f (YubiKey touch prompts). The socket activation breaks the PAM conversation flow needed for hardware authentication tokens.

Workaround

Disable socket activation to revert to direct helper spawning:

sudo systemctl mask polkit-agent-helper.socket
sudo systemctl stop polkit-agent-helper.socket

No reboot needed - YubiKey authentication works immediately after stopping the socket.

Configuration

/etc/pam.d/polkit-1 with YubiKey requirement:

auth       required     pam_u2f.so    authfile=/etc/Yubico/u2f_keys    cue

Works fine with direct helper spawning, fails with socket activation.

Request: This regression affects any interactive PAM module (hardware tokens, biometrics, etc.). The socket activation needs to properly support PAM conversations or should be disabled for configurations using interactive authentication.

system · February 7, 2026, 4:45pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.