Bug 1409431 - XFCE PolicyKit Agent requests "guest" password to edit Network Connections
Summary: XFCE PolicyKit Agent requests "guest" password to edit Network Connections
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: NetworkManager
Version: 24
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Beniamino Galvani
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-01-01 21:41 UTC by Gordon A. Fenton
Modified: 2017-08-08 19:31 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-08-08 19:31:00 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
[PATCH] editor: change flags of firewalld proxy to prevent polkit request (1.75 KB, patch)
2017-02-02 10:25 UTC, Beniamino Galvani
no flags Details | Diff

Description Gordon A. Fenton 2017-01-01 21:41:01 UTC
Description of problem: My usual approach to installing XFCE Fedora on the several computers that I maintain is to create a "guest" account during the install and then use that to set up the real user accounts. This means that I use the "guest" account to set up the network just prior to the install (using the live version). Oddly enough, this seems to associate the user "guest" with the network and any time that I subsequently want to modify the network, I have to enter the "guest" password, and NOT the root password. This is not a big deal, but I would have expected that I should enter the root password, especially since I generally like to remove the "guest" user after everything is setup.


Version-Release number of selected component (if applicable): XFCE Fedora 24


How reproducible: Always. All computers. Since at least Fedora 20.


Steps to Reproduce:
1. boot with a Fedora Live disk/usb, Install to Hard Disk
2. during install create "guest" account and root password
3. reboot and login as guest
4. set up Internet as guest and perform post-install operations

Actual results:
Right-click on network icon and select "Edit Connections"
Select a connection to edit and click on "Edit"
XFCE PolicyKit Agent pops up asking for "guest" password. No other "Identity" options are provided. Seems to work if I type in the guest password.


Expected results:
XFCE PolicyKit Agent should at least ask for the root password, don't you think? Or perhaps no password at all?


Additional info:

Comment 1 Beniamino Galvani 2017-01-04 09:53:36 UTC
What is the output of:

 groups guest
 groups $yourotheruser

?

In order to edit a system connection, administrative privileges are
required (see the
"org.freedesktop.NetworkManager.settings.modify.system" action in
/usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy) and
probably the test user belongs to the wheel group, while the other
user not).

Also, what is the message reported in the PolicyKit dialog ("System
policy prevents ...")?

Comment 2 Gordon A. Fenton 2017-01-30 13:07:50 UTC
Sorry for the delayed response! I thought that I had already done this. Here are my answers to your questions:

44 % groups guest
guest : guest wheel
45 % groups gordon
gordon : faculty

XFCE PolicyKit Agent
System policy prevents changing the firewall configuration
Identity: guest
Password:

Comment 3 Beniamino Galvani 2017-02-02 10:25:05 UTC
Created attachment 1247046 [details]
[PATCH] editor: change flags of firewalld proxy to prevent polkit request

Comment 4 Beniamino Galvani 2017-02-02 10:28:17 UTC
(In reply to Gordon A. Fenton from comment #2)

> XFCE PolicyKit Agent
> System policy prevents changing the firewall configuration

This is an authentication request from firewalld when NM tries to load the list of available firewall zones. The attached patch in comment 3 should prevent such requests.

Anyway, if you cancel the pop-up you should be able to edit the connection, correct?

Comment 5 Thomas Haller 2017-02-07 14:23:14 UTC
(In reply to Beniamino Galvani from comment #3)
> Created attachment 1247046 [details]
> [PATCH] editor: change flags of firewalld proxy to prevent polkit request

lgtm

Comment 6 Beniamino Galvani 2017-02-07 15:28:49 UTC
(In reply to Thomas Haller from comment #5)
> (In reply to Beniamino Galvani from comment #3)
> > Created attachment 1247046 [details]
> > [PATCH] editor: change flags of firewalld proxy to prevent polkit request
> 
> lgtm

Applied to master:

https://git.gnome.org/browse/network-manager-applet/commit/?id=d898ecf9a958a1c3421b9ee79c50957044cbbcb2

Comment 7 Fedora End Of Life 2017-07-26 00:09:21 UTC
This message is a reminder that Fedora 24 is nearing its end of life.
Approximately 2 (two) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 24. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '24'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 24 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 8 Fedora End Of Life 2017-08-08 19:31:00 UTC
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.