When attempting to start halevt, which should automount my removable devices, nothing actually gets mounted. Further poking around in /var/log/messages reveals a dbus message: Jul 7 23:35:01 3vil halevt: Running: halevt-mount -u /org/freedesktop/Hal/devices/volume_part1_size_4009738240 -o sync -m 002 Jul 7 23:35:01 3vil dbus-daemon: Rejected send message, 1 matched rules; type="method_call", sender=":1.23" (uid=0 pid=13157 comm="halevt-mount -u /org/freedesktop/Hal/devices/volum") interface="org.freedesktop.Hal.Device.Volume" member="Mount" error name="(unset)" requested_reply=0 destination="org.freedesktop.Hal" (uid=0 pid=2114 comm="/usr/sbin/hald --use-syslog --verbose=no ")) I receive an identical error when I try to run halevt-mount on the command line, so this is the root of the problem. I'm pretty sure this is either a HAL or D-Bus issue; using hal-0.5.12_rc1-r6 and dbus-1.2.12. Reproducible: Always # emerge --info Portage 2.1.6.13 (default/linux/amd64/2008.0/desktop, gcc-4.3.3, glibc-2.10.1-r0, 2.6.30 x86_64) ================================================================= System uname: Linux-2.6.30-x86_64-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_4800+-with-gentoo-2.0.1 Timestamp of tree: Tue, 07 Jul 2009 23:30:01 +0000 app-shells/bash: 4.0_p24 dev-java/java-config: 2.1.8-r1 dev-lang/python: 2.6.2-r1 dev-util/cmake: 2.6.4 sys-apps/baselayout: 2.0.1 sys-apps/openrc: 0.4.3-r3 sys-apps/sandbox: 2.0 sys-devel/autoconf: 2.13, 2.63-r1 sys-devel/automake: 1.5, 1.9.6-r2, 1.10.2, 1.11 sys-devel/binutils: 2.19.1-r1 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.6a virtual/os-headers: 2.6.30 ACCEPT_KEYWORDS="amd64 ~amd64" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-Os -pipe -march=athlon64" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/init.d /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/udev/rules.d" CXXFLAGS="-Os -pipe -march=athlon64" DISTDIR="/tmp/portage-distfiles" FEATURES="collision-protect distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch usersandbox" GENTOO_MIRRORS=" http://mirror.datapipe.net/gentoo/ http://gentoo.mirrors.pair.com/ http://distro.ibiblio.org/pub/linux/distributions/gentoo/" LDFLAGS="-Wl,-O1" LINGUAS="en" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise /usr/local/portage/overlay" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="3dnow 3dnowext X aac aalib acl acpi alsa amd64 avahi berkdb branding bzip2 cairo cdr cli cracklib crypt cups d dbus dirac dri dvd dvdr dvdread eds emboss encode esd evo fam firefox flac fortran gdbm gif git glitz gpm gstreamer gtk hal iconv ipv6 isdnlog jpeg jpeg2k libass libcaca libnotify libv4l2 lm_sensors lua mad matroska midi mikmod mmx moonlight mp3 mpeg mudflap multilib ncurses nls nptl nptlonly ogg opengl openmp pam pcre pdf png ppds pppd pulseaudio python qt3support readline reflection samba sdl session smp spell spl sqlite srt sse sse2 ssl startup-notification subversion svg sysfs tcpd theora tiff truetype unicode usb v4l v4l2 vorbis x264 xcb xml xorg xulrunner xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en" USERLAND="GNU" VIDEO_CARDS="vesa radeon radeonhd" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Solved! tl;dr version: root needed to be added to the plugdev group. More info, for people that are finding this bug by googling: D-Bus looks for policies on who can access what in XML files in /etc/dbus-1/system.d; the relevant one in this case was /etc/dbus-1/system.d/hal.conf. In this case, I was able to get what I needed from this file by searching for the interface from the error message (org.freedesktop.Hal.Device.Volume), and I ended up with this: <allow send_destination="org.freedesktop.Hal" send_interface="org.freedesktop.Hal.Device.Volume"/> Then, scrolling up to the containing <policy> tag, I found this: <policy group="plugdev"> meaning that the policy applies to the plugdev group. I would resolve this bug as FIXED, but imo there's still a serious issue here; halevt should at absolute minimum show some kind of message mentioning that the root user needs to be in the plugdev group.
(In reply to comment #1) I am using hal-0.5.11-r9, dbus-1.2.3-r1 with halevt-0.1.4-r2 and if I start halevt as a system service it can mount the devices properly without having the root user in the plugdev group: ~# groups root bin daemon sys adm disk wheel floppy dialout tape video games ~# halevt-mount -u /org/freedesktop/Hal/devices/volume_uuid_E8D2_50BA ~# mount [snipped] /dev/sdb1 on /media/KINGSTON type vfat (rw,nosuid,nodev,uhelper=hal) which versions of hal and dbus are you using ?
dbus versions prior to 1.2.6 unintentionally allowed all method calls through, regardless of configuration. Most likely you'll run into the same problem if you upgrade dbus past version 1.2.6.
iirc latest hal has some issues. Is this bug reproducable with hal-0.5.12_rc1-r4 ?
See my previous comments - the software works as intended, it's just that it wants the user halevt is run as to be in the plugdev group, which isn't default, so it needs to make some noise about it.
Daniel, is this valid? Latest unstable hal requires users to be on plugdev group in order to make mount work?
That is half correct. If you do not have policykit, then users must be in plugdev. If you have policykit, then policykit handles it, and it will use the on_console status to determine if you can mount. I'm planning on allowing root to do things like mount no matter what in a future version, but that won't affect normal users.
(In reply to comment #7) > That is half correct. If you do not have policykit, then users must be in > plugdev. If you have policykit, then policykit handles it, and it will use the > on_console status to determine if you can mount. > > I'm planning on allowing root to do things like mount no matter what in a > future version, but that won't affect normal users. > Thanks for your quick reply :) If this is the case, I would prefer to add policykit as dependency than forcing users to add root on plugdev George is that ok? George & Ravi can you install policykit and verify that halevt works as expected? Many thanks
Didn't work here. emerged policykit, the removed root from the plugdev group and restarted dbus, hal, and halevt. Then plugged in a removable drive, and halevt-mount failed with the same error as before. Do I need to do anything else for policykit to take effect?
(In reply to comment #8) > If this is the case, I would prefer to add policykit as dependency than forcing > users to add root on plugdev > > George is that ok? > > George & Ravi can you install policykit and verify that halevt works as > expected? > > Many thanks > I wouldn't like policykit as a dep to halevt. Let's keep it as simple as possible. We should check whether it works with policykit correctly but since it's not really needed let's not add more complexity. IMHI an ewarn for root getting added to plugdev should be fine for now.
elog message added Closing
