Bug 1094150

Summary: policycoreutils polkit policy is desktop centric, prevents server usage
Product: [Fedora] Fedora Reporter: Stef Walter <stefw>
Component: policycoreutilsAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: policycoreutils-2.2.5-4.fc20 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-05-31 23:56:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1094121    
Attachments:
Description Flags
Patch to fix org.selinux.policy none

Description Stef Walter 2014-05-05 07:45:09 UTC
Description of problem:

The shipped polkit policy is completely desktop-centric and expects that the admin user is logged in an active local session (ie: a seat in logind parlance, with a monitor and keyboard).

This prevents DBus API use when logged in via ssh (and using pkttyagent as your polkit agent) or via Cockpit.

The <allow_any> tag in polkit policy applies to non-local sessions. It should be set to something other than 'no' unless the action directly affects hardware of the login seat.

Version-Release number of selected component (if applicable):

policycoreutils-gui-2.2.5-3.fc20.x86_64

Comment 1 Stef Walter 2014-05-05 07:50:16 UTC
Created attachment 892453 [details]
Patch to fix org.selinux.policy

Comment 2 Stef Walter 2014-05-05 07:50:57 UTC
No upstream patch, upstream git repo was hanging ... but I hope attaching the patch here helps.

Comment 3 Miroslav Grepl 2014-05-06 13:30:37 UTC
Thx. 

Do you use policycoreutils with this patch?

Comment 4 Stef Walter 2014-05-06 14:05:37 UTC
No (at least not yet). I've tried to find all the relevant instances where polkit policy would prevent server use for no good reason, and help provide patches. I haven't run with this patch.

Comment 5 Daniel Walsh 2014-05-06 20:05:01 UTC
I have added this fix in policycoreutils-2.3-1.fc21

Comment 6 Fedora Update System 2014-05-07 12:18:47 UTC
policycoreutils-2.2.5-4.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/policycoreutils-2.2.5-4.fc20

Comment 7 Fedora Update System 2014-05-08 10:06:39 UTC
Package policycoreutils-2.2.5-4.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing policycoreutils-2.2.5-4.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-6101/policycoreutils-2.2.5-4.fc20
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2014-05-31 23:56:15 UTC
policycoreutils-2.2.5-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.