Running pkexec without a graphical agent fails even with falling back onto pkttyagent - polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie

[CMCDragonkai]

Issue description

Running pkexec pwd gives you:

polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

I don't have a graphical polkit agent running, so pkexec should fallback onto pkttyagent. However it doesn't seem to work in this case.

Note that to make it work, I have to run pkttyagent in a different terminal binding to the PID of the first terminal that is running pkexec pwd, and that terminal will show the same workflow but will have succeeded at authentication. But this shouldn't be necessary as the pkttyagent should just work on the original terminal when called by pkexec.

[erlandsona]

I'm trying to run hdajackretask to get the internal audio working on my system and before I downgraded back to 17.03 I couldn't even get it to run, now that it's running when I try to apply a configuration and type my password root or otherwise I'm getting this error.

Can you explain a bit more how to fix?

[EstalillaJ]

Thanks for tip @CMCDragonkai, saved me some investigation time.

@erlandsona It's probably too late but what he means is you should open two terminals.
In the first terminal run the following command to get its PID.

echo $$

In the second terminal run

pkttyagent --process PID_FROM_STEP_1

In the first terminal, do whatever you need to do with pkexec.

[Jamie-505]

saved me right there!

just in case: if you need to do this over ssh just open 2 connections in two terminals and run @EstalillaJ code!

[concatime]

Any news on this?

[erlandsona]

@concatime see @EstalillaJ's comment that's what worked for me. Hence all the 👍 's.

[concatime]

I would rather call his solution a hack until it really get solved ;)

[Sinbiosis]

Yeah, i'm still having the same problem. If there is a fix, i'd be happy to know.

[4him]

This only solution saved me

[elkevincorrea]

@EstalillaJ You've just saved my job. I'm grateful

[aperrot42]

yep same bug. Using Ubuntu 18 LTS and pkexec 0.105

[phisigma]

Is this related with bugs.debian.org/cgi-bin/bugreport.cgi?bug=841878?

I use Ubuntu 18.04 with Mate and running /usr/lib/x86_64-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1 solves the problem, but only temporary. Furthermore, when you create another admin user and log into his account, he does not observe any errors.

Perhaps there is a permanent solution for my account? (Besides adding above polkit command to startup programms.)

[wassafr]

@EstalillaJ Saved my day

[wirtoo]

@EstalillaJ Thank you very much!

[dereks]

@EstalillaJ Hit me up next time you're near Seattle / Lynnwood. I owe you a beer.

In my case, it was an Ubuntu 18.04 VPS, after I borked a file under /etc/sudoers.d/. (Nothing to do with NixOS.)

[daptordarattler]

Life saver

[agustinlacorazza]

Amazing, you save my life.

[rmarzocchi84]

@EstalillaJ you save me!

[iFreilicht]

It seems that this is due to the authentication agent not running. I am on Ubuntu, but maybe this will help in solving this problem:

I had to install policykit-1-gnome:

sudo apt install policykit-1-gnome

And then run it (same terminal using &, other terminal, or adding it to autostart all worked):

/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1

After that pkexec worked as expected.

[swansonba]

Yup, saved my bacon.

[tangzhiyi11]

save my life...

[fcolecumberri]

Is this related with bugs.debian.org/cgi-bin/bugreport.cgi?bug=841878?

I use Ubuntu 18.04 with Mate and running /usr/lib/x86_64-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1 solves the problem, but only temporary. Furthermore, when you create another admin user and log into his account, he does not observe any errors.

Perhaps there is a permanent solution for my account? (Besides adding above polkit command to startup programms.)

also fix my problem, but on gentoo the polkit agent is /usr/libexec/polkit-mate-authentication-agent-1 and need to install mate-extra/mate-polkit

[bb010g]

I'm trying to run hdajackretask to get the internal audio working on my system and before I downgraded back to 17.03 I couldn't even get it to run, now that it's running when I try to apply a configuration and type my password root or otherwise I'm getting this error.

With hdajackretask, you should see something like

bb010g ~ % nix-shell -p alsaTools psmisc --run 'hdajackretask'

(hdajackretask:4101): Gtk-WARNING **: 17:14:44.355: Could not load a pixbuf from /org/gtk/libgtk/theme/Adwaita/assets/check-symbolic.svg.
This may indicate that pixbuf loaders or the mime database could not be found.
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ====
Authentication is needed to run `/run/user/1000/hda-jack-retask-MQK620/script.sh' as the super user
Authenticating as: bb010g
Password:

You can manually execute sudo /run/user/1000/hda-jack-retask-MQK620/script.sh, and find logs at /run/user/1000/hda-jack-retask-MQK620/errors.log (a sibling file of the script).

[septatrix]

This seems to have an upstream ticket https://gitlab.freedesktop.org/polkit/polkit/-/issues/17 but no significant activity or progress seems to have been made there recently

[snoopiedoom]

Running ubuntu 20.04 LTS headless on rpi4 aarch64, attempting to use pkexec ls(using ls for testing, in use it fails authenticating python3 bin) results in, the same happens with pkttyagent open in second ssh terminal:

==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/usr/bin/ls' as the super user
Authenticating as: Ubuntu (ubuntu)
Password: 
polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

Trying to run it manually with /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 results in:

/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
Unable to init server: Could not connect: Connection refused

(polkit-gnome-authentication-agent-1:2063): Gtk-WARNING **: 09:14:35.147: cannot open display:

Why is it trying to connect to a display, without ever actually being connected to one?

[egianotti]

Thanks for tip @CMCDragonkai, saved me some investigation time.

@erlandsona It's probably too late but what he means is you should open two terminals. In the first terminal run the following command to get its PID.

echo $$

In the second terminal run

pkttyagent --process PID_FROM_STEP_1

In the first terminal, do whatever you need to do with pkexec.

Life saver!

[Artturin]

patching polkit with https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/59

works

  nixpkgs.overlays = [
      (self: super: {
        polkit = super.polkit.overrideAttrs (oldAttrs: {
          patches = oldAttrs.patches ++ [
            (super.fetchpatch {
              url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/716a273ce0af467968057f3e107156182bd290b0.patch";
              sha256 = "sha256-hOJJhUmxXm87W1ZU9Y1NJ8GCyKvPjbIVtCHlhRGlN8k=";
            })];
        });
      })
    ];

pkexec pwd
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ====
Authentication is needed to run `/run/current-system/sw/bin/pwd' as the super user
Multiple identities can be used for authentication:
 1.  artturin
 2.  user2
Choose identity to authenticate as (1-2): 1
Password:
==== AUTHENTICATION COMPLETE ====
/root

[Artturin]

#144797

[Artturin]

found more info in the thread of the patch that introduced this bug https://bugs.freedesktop.org/show_bug.cgi?id=90837#c20

[dit7ya]

Seems like there is an open merge request solving it but no more activity.
https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/122

[GrabbenD]

nixpkgs.overlays = [
  (self: super: {
    polkit = super.polkit.overrideAttrs (oldAttrs: {
      patches = oldAttrs.patches ++ [
        (super.fetchpatch {
          url = "https://gitlab.freedesktop.org/polkit/polkit/-/commit/716a273ce0af467968057f3e107156182bd290b0.patch";
          sha256 = "sha256-hOJJhUmxXm87W1ZU9Y1NJ8GCyKvPjbIVtCHlhRGlN8k=";
        })];
    });
  })
];

Thanks @Artturin (^)!
I'm able to enter the password from the shell now

[hctym1995]

This issue is still saving our lives and jobs.
Thanks all!