Bug 652272 - No automagic escalation of privileges to add a printer
Summary: No automagic escalation of privileges to add a printer
Alias: None
Product: Fedora
Classification: Fedora
Component: kdeadmin
Version: 14
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Than Ngo
QA Contact: Fedora Extras Quality Assurance
: 668665 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2010-11-11 14:11 UTC by Dhaval Giani
Modified: 2011-05-24 14:07 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-05-20 13:15:43 UTC
Type: ---

Attachments (Terms of Use)
Running via the command line (698.12 KB, image/png)
2010-12-13 13:38 UTC, Steven Moix
no flags Details
Running via the GUI (122.36 KB, image/png)
2010-12-13 13:38 UTC, Steven Moix
no flags Details
dialog asking me for root's password (54.05 KB, image/png)
2011-05-20 13:07 UTC, Jiri Popelka
no flags Details

Description Dhaval Giani 2010-11-11 14:11:41 UTC
Description of problem:
Trying to add a new printer leads to an error stating, "Not Authorized" "The password maybe incorrect"

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. KDE Button -> System Settings -> Printer Settings -> New Network Printer
Actual results:
Fails as mentioned in the description

Expected results:
Query for the password or some other means of escalating the privilege of the application.

Additional info:

Comment 1 Tim Waugh 2010-11-11 15:23:14 UTC
Works for me with system-config-printer using GNOME.

system-config-printer-kde is part of the kdeadmin package.  Reassigning.

Comment 2 Jiri Popelka 2010-11-11 15:49:08 UTC
Confirming with system-config-printer-kde-4.5.3-1.fc14.x86_64

I'm new to KDE.
Had been using GNOME up to last week when I installed F14 with KDE.
Just now I have realized that there's some s-c-p-kde package in KDE.

Wonder what is it good for.
What it does that system-config-printer doesn't ?
I don't see anything special except that
- I can't add new printer (this bug)
- all options in Server Setting are greyed so I can't change anything there (another bug)
- there are no Advanced Server Settings so I can't add 'Browse servers', which is the easiest way how to use printers in our office

Comment 3 Steven Moix 2010-12-13 13:38:13 UTC
Created attachment 468373 [details]
Running via the command line

Comment 4 Steven Moix 2010-12-13 13:38:46 UTC
Created attachment 468374 [details]
Running via the GUI

Comment 5 Steven Moix 2010-12-13 13:38:59 UTC
I can confirm this with the current 4.5.4 KDE SC. Running "kdesu kcmshell4 system-config-printer-kde" from the command line starts the printer configuration with the right privileges, but directly using the GUI fails. See the 2 attached screenshots for the working and not working examples!

Comment 6 Kevin Kofler 2011-01-11 12:51:47 UTC
*** Bug 668665 has been marked as a duplicate of this bug. ***

Comment 7 Orion Poplawski 2011-05-14 21:37:28 UTC
Still a problem in F15.


Comment 8 Jiri Popelka 2011-05-20 13:07:41 UTC
Created attachment 500053 [details]
dialog asking me for root's password

Seems to be fixed with

Comment 9 Rex Dieter 2011-05-20 13:15:43 UTC
To be clear,

* Fri Apr 08 2011 Rex Dieter <rdieter@fedoraproject.org> 7:4.6.2-2
- No automagic escalation of privileges to add a printer (#652272)

the only thing fixed is systemsettings->printers , not right-click printer-applet... yada yada or any other method of launching this (I suppose we could add more kdesu usage everywhere, but that's a rabbit-hole I'm not sure I'm willing to go down).

Doing any better will require upstream to port this to use KAuth properly

Comment 10 Tim Waugh 2011-05-20 14:17:04 UTC
Using kdesu is the wrong fix.

system-config-printer does not need any root privilege in order to do its job.  It does, however, need to authenticate with cupsd, and cups-pk-helper allows this to happen via D-Bus and polkit.

This is all working fine in GNOME; if it isn't working in the KDE "version", that's a bug in that version.

Comment 11 Rex Dieter 2011-05-20 14:49:31 UTC
emphatically agreed, that's the origin of my "upstream needs to port this to use KAuth properly" comment.

(we downstream are not in a position to implement that ourselves anytime in the foreseeable future.

As a matter of fact, I'd personally just rather use system-config-printer that "just works", than continue the facade of a kinda-sorta-but-not-really-workable system-config-printer-kde, but that's another battle.

Comment 12 Tim Waugh 2011-05-20 15:08:02 UTC
There won't be any KAuth support in system-config-printer.  What's wrong with using D-Bus and polkit?  Surely KDE has an authentication agent for it...?

Comment 13 Rex Dieter 2011-05-20 15:15:50 UTC
I think we agree, though may be talking past each other.  let me clarify, that when I mean upstream in the past couple of comments, I mean system-config-printer-kde, and that adding KAuth support essentially means using dbus/polkit properly for privledges.

Comment 14 Kevin Kofler 2011-05-20 16:47:21 UTC
The question is: What code is responsible for the privilege escalation authentication? Is it the shared code in system-config-printer-libs or the UI code in system-config-printer(-kde)?

If it's the shared code, why does this not just work? We need to debug this.

If it's the UI code, then system-config-printer-kde needs some code using PolicyKit and D-Bus (or a wrapper around them, e.g. KAuth or python-slip) which it currently doesn't have.

I really wonder what system-config-printer (the GTK+ UI) does differently from system-config-printer-kde there.

Comment 15 Tim Waugh 2011-05-24 11:09:30 UTC
There is no privilege escalation; only delegation.

The cups-pk-helper package is responsible for providing a system D-Bus interface for performing administrative operations on the local CUPS server.  This D-Bus interface is polkit-enabled, and KDE is responsible for providing an authentication agent.

    `--> cups-pk-helper -> polkit -> authentication agent
             `--> cupsd

The particular parts of system-config-printer that talk to cups-pk-helper:

Comment 16 Kevin Kofler 2011-05-24 14:07:57 UTC
The authentication agent is there (polkit-kde), it looks like what's missing in system-config-printer-kde is the "system-config-printer --> cups-pk-helper" part of the diagram.

Note You need to log in before you can comment on or make changes to this bug.