Bug 2203555
| Summary: | silverblue non-admin user repeatedly asked for admin password to update | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | wayne6001 <redhat.stark007> |
| Component: | rpm-ostree | Assignee: | Colin Walters <walters> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | amurdaca, dustymabe, fedoraproject, gnome-sig, jmarrero, jonathan, kevin, lucab, mboddu, mcrha, miabbott, pbrobinson, philip.wyett, rhughes, thrcka, travier, walters |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2025-02-06 16:35:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
wayne6001
2023-05-14 00:30:32 UTC
I guess this is gnome-software doing this? But not sure... lets move over there for comment. This is similar to upstream bug [1], except that one is related to PackageKit, which is not used in the Silverblue, where is used rpm-ostree. I checked the code and the rpm-ostree unconditionally calls polkit_authority_check_authorization_sync() with POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION flag, thus it doesn't have a way to set this as a non-interactive call. I opened an rpm-ostree bug for it [2]. Once it's implemented, the relevant changes can be included in the gnome-software. As it's not a Fedora specific bug, I'm closing this here. I did not open a gnome-software counterpart upstream bug, because it won't make much sense without the rpm-ostree change. [1] https://gitlab.gnome.org/GNOME/gnome-software/-/issues/582 [2] https://github.com/coreos/rpm-ostree/issues/4415 By the way, while testing it here, I've been asked only once for the admin password, not multiple times in a row. I do not know what could cause it for you. It has stopped asking me repeatedly. When it asks me now, it's just once. So, whatever it was, it isn't doing it anymore. I just got the same modal dialog box requiring me to login in with an admin account, from a user account, 32 times in a row - saying it was needed to update software. Nothing else can be done except to hit cancel over and over or to reboot until it finally stops asking. This happens on a laptop and on an Intel NUC, both of the systems that I installed Fedora 38 Silverblue. It does not happen on 3 other PCs that are Fedora 38 but not Silverblue. This doesn't happen all the time. It probably happens once or twice a day on my laptop and recently 2 or 3 cancels stops it, which isn't a problem. But, 32 times in a row is too much. A fix like to stop asking for a day if you've asked 5 times and the system has been checked for updates that day (which it has - I update every day). After waking up from suspension it happens frequently. today, I had to dismiss the dialog 19times in a row. it usually stops repeating after one or two. but, then it will be 15 or more. I installed silverblue on a laptop and a PC to see if I should switch on my main machines and with this, the answer is definitely not to use silverblue. The linked rpm-ostree bug needs to be fixed to have it propagated into the Fedora. That "it happens again" when there is no fix for the bug is nothing unusual, just the opposite. One interesting thing, though, is that the Software, if I'm not mistaken, does the same thing for a long time now, it's for years. There changed something somewhere recently, which also triggers the polkit prompt, which was not needed before. As a test, I just ran gnome-software 43.5 with rpm-ostree-2023.3-1.fc38.x86_64 and polkit-122-3.fc38.1.x86_64 on Fedora 38 Silverblue and I am asked for the admin password on update preparation, but when I run the latest gnome-software development code, or the stock gnome-software-43.0-4.fc37.x86_64, on Fedora 37 Silverblue, which has installed rpm-ostree-2022.13-1.fc37.x86_64 and polkit-121-4.fc37.x86_64, then I am not asked for the admin prompt. I move this to the rpm-ostree for further investigation. (In reply to Milan Crha from comment #7) > As a test, I just ran gnome-software 43.5 with > rpm-ostree-2023.3-1.fc38.x86_64 and polkit-122-3.fc38.1.x86_64 on Fedora 38 > Silverblue and I am asked for the admin password on update preparation, but > when I run the latest gnome-software development code, or the stock > gnome-software-43.0-4.fc37.x86_64, on Fedora 37 Silverblue, which has > installed rpm-ostree-2022.13-1.fc37.x86_64 and polkit-121-4.fc37.x86_64, > then I am not asked for the admin prompt. Err, no, my test was wrong, stock Fedora 37 Silverblue does that too. I'm sorry. I will still leave this in the rpm-ostree component. I think there are two different bugs. One is having the non-admin user being asked at all for the system password when there isn't anything urgent. The other is sometimes immediately asking again repeatedly up to 20 times or so if the dialog is dismissed. If whatever asks checked when the last update was done before asking, there would be a way to avoid it. I typically update every day and get asked to check fo updates in a non-admin account anyway. The gnome-software executes (something like) "update --download-only". The gnome-software does not know whether there's anything to be updated, the gnome-software just asks the rpm-ostree to prepare the updates locally. I do not know whether rpm-ostree asks for the admin permissions before or after it recognizes any update. Regarding repeated prompts, I do not know which part does the re-prompt. As far as I know, the gnome-software just runs the update operation and it does not re-trigger it immediately after the operation failed due to cancelled credentials prompt. It happened today in the admin account. Typing in the admin password that it is asking for doesn't stop it from asking repeatedly. This was after I tried to update through the software center and it was taking forever. I eventually cancelled it after it said there were updates and I clicked on on the choice to download and reboot. After canceling, I tried to update from the command line and it said I should cancel "refresh.md". So, it looks like it tries to update and it can't complete and during that, it starts asking whatever user it can for the admin password. And it keeps asking. Fedora Linux 38 entered end-of-life (EOL) status on 2024-05-21. Fedora Linux 38 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora Linux please feel free to reopen this bug against that version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see the version field. If you are unable to reopen this bug, please file a new report against an active release. Thank you for reporting this bug and we are sorry it could not be fixed. We'll try to fix this with https://fedoraproject.org/wiki/Changes/UnprivilegedUpdatesAtomicDesktops This is fixed in Fedora 41 with https://fedoraproject.org/wiki/Changes/UnprivilegedUpdatesAtomicDesktops |