Bug 2203555 - silverblue non-admin user repeatedly asked for admin password to update
Summary: silverblue non-admin user repeatedly asked for admin password to update
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: rpm-ostree
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Colin Walters
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-05-14 00:30 UTC by wayne6001
Modified: 2025-02-06 16:35 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-02-06 16:35:24 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github coreos rpm-ostree issues 4415 0 None open Possibility to do non-interactive PolKit calls 2023-05-16 07:46:27 UTC
Red Hat Issue Tracker FC-843 0 None None None 2023-05-24 13:01:59 UTC

Description wayne6001 2023-05-14 00:30:32 UTC
Have two user accounts.  One is admin and the other a regular user.  Periodically the regular user will get a popup asking them to type in the administrator password (which they do not know).  If they dismiss it, it keeps popping up over and over 7 - 12 times in a row. This happens even immediately after the admin has updated, so there are no updates.  I see over the years this has happened before.  If there is no way to avoid the non-admin user being asked, it should at the least not ask and then immediately ask again over and over.  It's bad practice to get regular users used to thinking they should be typing in the admin password whenever anything pops up asking for it.  Not having that is the whole purpose of having non-admin accounts.

Reproducible: Sometimes

Steps to Reproduce:
1.it just happens occasionally, can't cause it to happen
2.though perhaps after awaking from sleep
3.
Actual Results:  
as above, it just pops up when something in the system decides to check for updates (even immediately after an update)

Expected Results:  
Expect that a non-admin user not be asked for the admin password. If that can't be avoided, then if the user says no, don't immediately ask again over and over.

Fedora Silverblue software update or flatpak update -- I don't know what the component is.  The component I picked is certainly wrong.

Should check to see how long it has been since updated (since this can happen 10 minutes after an update).  If it essential, tell the user the admin needs to check for updates.  If that can't be done, don't repeatedly pop up if the user says NO.

Comment 1 Kevin Fenzi 2023-05-15 17:53:09 UTC
I guess this is gnome-software doing this? But not sure... lets move over there for comment.

Comment 2 Milan Crha 2023-05-16 07:46:27 UTC
This is similar to upstream bug [1], except that one is related to PackageKit, which is not used in the Silverblue, where is used rpm-ostree.

I checked the code and the rpm-ostree unconditionally calls polkit_authority_check_authorization_sync() with POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION flag, thus it doesn't have a way to set this as a non-interactive call.

I opened an rpm-ostree bug for it [2]. Once it's implemented, the relevant changes can be included in the gnome-software. As it's not a Fedora specific bug, I'm closing this here. I did not open a gnome-software counterpart upstream bug, because it won't make much sense without the rpm-ostree change.

[1] https://gitlab.gnome.org/GNOME/gnome-software/-/issues/582
[2] https://github.com/coreos/rpm-ostree/issues/4415

Comment 3 Milan Crha 2023-05-16 07:49:14 UTC
By the way, while testing it here, I've been asked only once for the admin password, not multiple times in a row. I do not know what could cause it for you.

Comment 4 wayne6001 2023-05-16 15:30:33 UTC
It has stopped asking me repeatedly.  When it asks me now, it's just once.  So, whatever it was, it isn't doing it anymore.

Comment 5 wayne6001 2023-05-20 02:49:19 UTC
I just got the same modal dialog box requiring me to login in with an admin account, from a user account, 32 times in a row - saying it was needed to update software.  Nothing else can be done except to hit cancel over and over or to reboot until it finally stops asking.

This happens on a laptop and on an Intel NUC, both of the systems that I installed Fedora 38 Silverblue.  It does not happen on 3 other PCs that are Fedora 38 but not Silverblue.

This doesn't happen all the time. It probably happens once or twice a day on my laptop and recently 2 or 3 cancels stops it, which isn't a problem.  But, 32 times in a row is too much. A fix like to stop asking for a day if you've asked 5 times and the system has been checked for updates that day (which it has - I update every day).

Comment 6 wayne6001 2023-05-23 17:34:07 UTC
After waking up from suspension it happens frequently.  today, I had to dismiss the dialog 19times in a row.  it usually stops repeating after one or two.  but, then it will be 15 or more.

I installed silverblue on a laptop and a PC to see if I should switch on my main machines and with this, the answer is definitely not to use silverblue.

Comment 7 Milan Crha 2023-05-24 13:01:31 UTC
The linked rpm-ostree bug needs to be fixed to have it propagated into the Fedora. That "it happens again" when there is no fix for the bug is nothing unusual, just the opposite.

One interesting thing, though, is that the Software, if I'm not mistaken, does the same thing for a long time now, it's for years. There changed something somewhere recently, which also triggers the polkit prompt, which was not needed before.

As a test, I just ran gnome-software 43.5 with rpm-ostree-2023.3-1.fc38.x86_64 and polkit-122-3.fc38.1.x86_64 on Fedora 38 Silverblue and I am asked for the admin password on update preparation, but when I run the latest gnome-software development code, or the stock gnome-software-43.0-4.fc37.x86_64, on Fedora 37 Silverblue, which has installed rpm-ostree-2022.13-1.fc37.x86_64 and polkit-121-4.fc37.x86_64, then I am not asked for the admin prompt.

I move this to the rpm-ostree for further investigation.

Comment 8 Milan Crha 2023-05-24 13:06:07 UTC
(In reply to Milan Crha from comment #7)
> As a test, I just ran gnome-software 43.5 with
> rpm-ostree-2023.3-1.fc38.x86_64 and polkit-122-3.fc38.1.x86_64 on Fedora 38
> Silverblue and I am asked for the admin password on update preparation, but
> when I run the latest gnome-software development code, or the stock
> gnome-software-43.0-4.fc37.x86_64, on Fedora 37 Silverblue, which has
> installed rpm-ostree-2022.13-1.fc37.x86_64 and polkit-121-4.fc37.x86_64,
> then I am not asked for the admin prompt.

Err, no, my test was wrong, stock Fedora 37 Silverblue does that too. I'm sorry.

I will still leave this in the rpm-ostree component.

Comment 9 wayne6001 2023-05-24 13:52:00 UTC
I think there are two different bugs.  One is having the non-admin user being asked at all for the system password when there isn't anything urgent.  

The other is sometimes immediately asking again repeatedly up to 20 times or so if the dialog is dismissed.  

If whatever asks checked when the last update was done before asking, there would be a way to avoid it.  I typically update every day and get asked to check fo updates in a non-admin account anyway.

Comment 10 Milan Crha 2023-05-24 15:04:49 UTC
The gnome-software executes (something like) "update --download-only". The gnome-software does not know whether there's anything to be updated, the gnome-software just asks the rpm-ostree to prepare the updates locally. I do not know whether rpm-ostree asks for the admin permissions before or after it recognizes any update.

Regarding repeated prompts, I do not know which part does the re-prompt. As far as I know, the gnome-software just runs the update operation and it does not re-trigger it immediately after the operation failed due to cancelled credentials prompt.

Comment 11 wayne6001 2023-05-26 14:01:50 UTC
It happened today in the admin account.  Typing in the admin password that it is asking for doesn't stop it from asking repeatedly.  This was after I tried to update through the software center and it was taking forever.  I eventually cancelled it after it said there were updates and I clicked on on the choice to download and reboot.  After canceling, I tried to update from the command line and it said I should cancel "refresh.md".  So, it looks like it tries to update and it can't complete and during that, it starts asking whatever user it can for the admin password.  And it keeps asking.

Comment 12 Aoife Moloney 2024-05-22 10:57:16 UTC
Fedora Linux 38 entered end-of-life (EOL) status on 2024-05-21.

Fedora Linux 38 is no longer maintained, which means that it
will not receive any further security or bug fix updates. As a result we
are closing this bug.

If you can reproduce this bug against a currently maintained version of Fedora Linux
please feel free to reopen this bug against that version. Note that the version
field may be hidden. Click the "Show advanced fields" button if you do not see
the version field.

If you are unable to reopen this bug, please file a new report against an
active release.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 13 Timothée Ravier 2024-05-23 09:05:39 UTC
We'll try to fix this with https://fedoraproject.org/wiki/Changes/UnprivilegedUpdatesAtomicDesktops

Comment 14 Timothée Ravier 2025-02-06 16:35:24 UTC
This is fixed in Fedora 41 with https://fedoraproject.org/wiki/Changes/UnprivilegedUpdatesAtomicDesktops


Note You need to log in before you can comment on or make changes to this bug.