when starting LXDE from root account nm-applet is there and works fine. but fails when started from different account Reproducible: Always Actual Results: Console gets following messages when current account is not root: ** (nm-applet:3529): WARNING **: <WARN> request_name(): Could not acquire the NetworkManagerUserSettings service. Error: (9) Connection ':1.19' is not allowed to own the service 'org.freedesktop.NetworkManagerUserSettings' due to security policies in the configuration file lxpanel: can't load netstat plugin emerge --info Portage 2.1.7.17 (default/linux/x86/10.0, gcc-4.3.4, glibc-2.10.1-r1, 2.6.31-gentoo-r10 i586) ================================================================= System uname: Linux-2.6.31-gentoo-r10-i586-AMD-K6-tm-_3D_processor-with-gentoo-1.12.13 Timestamp of tree: Mon, 01 Mar 2010 20:45:01 +0000 ccache version 2.4 [enabled] app-shells/bash: 4.0_p35 dev-java/java-config: 2.1.10 dev-lang/python: 2.6.4-r1 dev-util/ccache: 2.4-r7 dev-util/cmake: 2.6.4-r3 sys-apps/baselayout: 1.12.13 sys-apps/sandbox: 1.6-r2 sys-devel/autoconf: 2.13, 2.63-r1 sys-devel/automake: 1.9.6-r2, 1.10.3, 1.11.1 sys-devel/binutils: 2.18-r3 sys-devel/gcc: 4.3.4 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.6b virtual/os-headers: 2.6.30-r1 ACCEPT_KEYWORDS="x86" ACCEPT_LICENSE="* -@EULA dlj-1.1" CBUILD="i586-pc-linux-gnu" CFLAGS="-O2 -march=k6-2 -pipe -mmmx -m3dnow -fomit-frame-pointer" CHOST="i586-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -march=k6-2 -pipe -mmmx -m3dnow -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="assume-digests ccache distlocks fixpackages news parallel-fetch protect-owned sandbox sfperms strict unmerge-logs unmerge-orphans userfetch" GENTOO_MIRRORS="http://gentoo.tiscali.nl/ http://gentoo.mneisen.org/ http://de-mirror.org/distro/gentoo/" LANG="fr_FR.UTF-8" LDFLAGS="-Wl,-O1" LINGUAS="fr" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_COMPRESS="lzma" PORTAGE_COMPRESS_FLAGS="-e" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="acl berkdb bzip2 cli cracklib crypt cups cxx dri fortran gdbm gpm iconv modules mudflap ncurses nls nptl nptlonly openmp pam pcre perl pppd python readline reflection session spl ssl sysfs tcpd unicode x86 xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="fr" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga neomagic nv r128 radeon savage sis tdfx trident vesa via vmware voodoo" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY SHould the solution be similar to bug 282612 please don't forget to provide a link to a relevant procedure for patching that matches the concerned ebuild internal structure. Thks
just to clarify details about the involed logins --------------------------------------- =>User captainbloodm ~ $ groups lp wheel cron audio cdrom users portage --------------------------------------- =>Root captainblood@m ~ $ su - Mot de passe : m ~ # groups root bin daemon sys adm disk wheel floppy dialout tape video
You should have read the message in pkg_postinst elog "To save system-wide settings as a user, that user needs to have the" elog "right policykit privileges. You can add them by running:" elog 'polkit-auth --grant org.freedesktop.network-manager-settings.system.modify --user "USERNAME"' Also, you need to be in the plugdev group.
I added my user to plugdev: captainblood@m ~ $ groups lp wheel cron audio cdrom users portage plugdev polkit authorisation was already set: captainblood@m ~ $ polkit-auth --grant org.freedesktop.network-manager-settings.system.modify --user "captainblood" polkit-auth: AuthorizationAlreadyExists: An authorization for uid 1000 for the action org.freedesktop.network-manager-settings.system.modify with constraint '' already exists according to the following file : cat /etc/dbus-1/system.d/nm-applet.conf <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd"> <busconfig> <policy user="root"> <allow own="org.freedesktop.NetworkManagerUserSettings"/> <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/> <!-- Only root can get secrets --> <allow send_destination="org.freedesktop.NetworkManagerUserSettings" send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/> </policy> <policy at_console="true"> <allow own="org.freedesktop.NetworkManagerUserSettings"/> <allow send_destination="org.freedesktop.NetworkManagerUserSettings"/> <!-- Only root can get secrets --> <deny send_destination="org.freedesktop.NetworkManagerUserSettings" send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/> </policy> <policy context="default"> <deny send_destination="org.freedesktop.NetworkManagerUserSettings"/> <allow send_destination="org.freedesktop.NetworkManagerUserSettings" send_interface="org.freedesktop.DBus.Introspectable"/> </policy> <limit name="max_replies_per_connection">512</limit> </busconfig> it seems like "<policy at_console="true">" must be satisfied when user is not root. And I don't know how to do it. plugdev group seems involved in /etc/dbus-1/system.d/NetworkManager.conf which states: <policy group="plugdev"> <allow send_destination="org.freedesktop.NetworkManager"/> <deny send_destination="org.freedesktop.NetworkManager" send_interface="org.freedesktop.NetworkManager.PPP"/> </policy> Please excuse me reopening this bug in case of a misunderstanding. nm-applet is not available in LXDE under regular user account (not root). Thanks for your attention
(In reply to comment #3) > it seems like "<policy at_console="true">" must be satisfied when user is not > root. And I don't know how to do it. > You don't have consolekit running? It's a dependency of polkit, and should be enabled in the default runlevel by the user.
No I didn't have running nor installed either. Maybe because LXDE is the only WM installed, which doesn't automatically includes console-kit. I must admit I've skipped the /usr/bin/ck-launch/session thing in .xinitrc at initial setup. Sorry, So I feel a bit culprit I reopen this bug. Things are back to order now, and I'm not running WM as root anymore 8). Guess it is time to close it now. I leave it up to you. Thanks for your patience.
