"AUTHENTICATING FOR org.freedesktop.Flatpak.metadata-update" when updating through SSH

[dreua]

Linux distribution and version

Fedora 34

Flatpak version

Flatpak 1.10.2

Description of the problem

When issuing flatpak updatethrough an SSH connection, I need to authenticate and I really don't want to: I'd rather use sudo or not authenticate at all if possible. Upgrades for user installed packages should be possible through SSH because it is possible by running flatpak update directly in a gnome-terminal.

Steps to reproduce

I'd like to copy & paste those, but the AUTHENTICATION message kills the scroll back. Go figure.

[da@David-UB ~]$ flatpak update
Looking for updates…
Nothing to do.
[da@David-UB ~]$ ssh localhost -X         # same thing without -X 
Host key fingerprint [...]
Last login: Sun May  9 16:19:38 2021 from 127.0.0.1
[da@David-UB ~]$ flatpak update
==== AUTHENTICATING FOR org.freedesktop.Flatpak.metadata-update ====
Authentication is required to update metadata
Multiple identities can be used for authentication:
 [...]
Choose identity to authenticate as (1-2): 

Related: #4136 #3001

[shoaibnawaz]

I experienced the same similar issue while I was using screen multiplexer (Byobu). I quit it and flatpak update ran finely.

[refi64]

Upgrades for user installed packages should be possible through SSH because it is possible by running flatpak update directly in a gnome-terminal.

If you want to do only user upgrades, flatpak update --user should do the trick. In particular:

sudo flatpak update --system && flatpak update --user

I think should do what you want.

[dreua]

Actually I'd like to do what I think flatpak update does on a non-SSH connection: Update the user packages without asking for authentication and asking for authentication only if it finds updates for system packages. How can I achieve that?

[refi64]

Afaik flatpak update does need to authenticate to update the metadata (which is required to check if any updates are available), it just doesn't show an auth prompt because tells polkit there's no need. This isn't really an option over SSH, however (TBH I'm not sure why.)

[Tennyleaz]

Similar issue happened to me when using flatpak update as normal user account via VNC session. I'm using debian 11 and xfce desktop.

No such problem when using on a real monitor.

[thekad]

I also have this problem, so I created a workaround using a policykit rule in /etc/polkit-1/rules/60-flatpak.rules like so:

/* Allow users in root group to run flatpak without authentication */
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.Flatpak.metadata-update" &&
        subject.isInGroup("root")) {
        return polkit.Result.YES;
    }
});
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.Flatpak.appstream-update" &&
        subject.isInGroup("root")) {
        return polkit.Result.YES;
    }
});

YMMV

[smcv]

If you don't like the default security policy that Flatpak provides, then creating your own polkit rule like the one in the previous comment (I haven't audited it or anything, but it looks plausible) is the correct way to configure your own security policy.

[thekad]

If you don't like the default security policy that Flatpak provides, then creating your own polkit rule like the one in the previous comment (I haven't audited it or anything, but it looks plausible) is the correct way to configure your own security policy.

The polkit rules can definitely be tightened up a bit, but that would be up to the operator. The stock policy in my fedora workstation (/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules) looks like this:

polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.app-install" ||
         action.id == "org.freedesktop.Flatpak.runtime-install"||
         action.id == "org.freedesktop.Flatpak.app-uninstall" ||
         action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
         action.id == "org.freedesktop.Flatpak.modify-repo") &&
        subject.active == true && subject.local == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.Flatpak.override-parental-controls") {
            return polkit.Result.AUTH_ADMIN;
    }

    return polkit.Result.NOT_HANDLED;
});

So I ended up with a custom rule /etc/polkit-1/rules/60-flatpak.rules like this:

/* Allow users in wheel group to run flatpak without authentication */
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.metadata-update" ||
         action.id == "org.freedesktop.Flatpak.appstream-update") &&
        subject.active == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});

This removes the authentication prompt when it is refreshing the metadata, but would still ask for authentication on install/uninstall. YMMV 🙂

[moneroexamples]

On Fedora 37 this worked for me:

Add /etc/polkit-1/rules.d/60-cusotm.rules file with the content of:

polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.app-install" ||
         action.id == "org.freedesktop.Flatpak.runtime-install"||
         action.id == "org.freedesktop.Flatpak.app-uninstall" ||
         action.id == "org.freedesktop.Flatpak.metadata-update" ||
         action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
         action.id == "org.freedesktop.Flatpak.modify-repo") &&
        subject.active == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});

Also you must add yourself to wheel group in /etc/groups.

[nicekiwi]

Still relevant for Fedora 43 and installing flathub packages via remote Cockpit Terminal.

[zeroepoch]

@moneroexamples solution isn't quite the same as @thekad's solution since it misses org.freedesktop.Flatpak.appstream-update. Combining a few solutions here this works on Fedora 42.

/etc/polkit-1/rules.d/60-flatpak.rules

/* Allow users in wheel group to run flatpak without authentication */
polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.Flatpak.app-install" ||
         action.id == "org.freedesktop.Flatpak.runtime-install"||
         action.id == "org.freedesktop.Flatpak.app-uninstall" ||
         action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
         action.id == "org.freedesktop.Flatpak.modify-repo" ||
         action.id == "org.freedesktop.Flatpak.metadata-update" ||
         action.id == "org.freedesktop.Flatpak.appstream-update") &&
        subject.active == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }

    return polkit.Result.NOT_HANDLED;
});