GNOME Bugzilla – Bug 772537
Log full of "Error executing command as another user: Not authorized" errors from attempts to run /usr/libexec/gsd-backlight-helper
Last modified: 2017-09-02 16:22:54 UTC
My Fedora 24 laptop, with: gdm-3.20.1-3.fc24.x86_64 gnome-settings-daemon-3.20.1-3.fc24.x86_64 polkit-0.113-5.fc24.x86_64 has its logs stuffed with messages like this: Oct 06 16:18:53 xps13.happyassassin.net pkexec[4929]: pam_unix(polkit-1:session): session opened for user root by (uid=1001) Oct 06 16:18:53 xps13.happyassassin.net pkexec[4929]: adamw: Executing command [USER=root] [TTY=unknown] [CWD=/home/adamw] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 99] Oct 06 16:18:53 xps13.happyassassin.net pkexec[4930]: gdm: Error executing command as another user: Not authorized [USER=root] [TTY=unknown] [CWD=/var/lib/gdm] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 90] Oct 06 16:18:53 xps13.happyassassin.net gnome-settings-daemon.desktop[1577]: Error executing command as another user: Not authorized Oct 06 16:18:53 xps13.happyassassin.net gnome-settings-daemon.desktop[1577]: This incident has been reported. Oct 06 16:19:00 xps13.happyassassin.net pkexec[4942]: gdm: Error executing command as another user: Not authorized [USER=root] [TTY=unknown] [CWD=/var/lib/gdm] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 85] Oct 06 16:19:00 xps13.happyassassin.net gnome-settings-daemon.desktop[1577]: Error executing command as another user: Not authorized Oct 06 16:19:00 xps13.happyassassin.net gnome-settings-daemon.desktop[1577]: This incident has been reported. Oct 06 16:19:00 xps13.happyassassin.net pkexec[4943]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Oct 06 16:19:00 xps13.happyassassin.net audit[4943]: USER_START pid=4943 uid=1001 auid=1001 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/pkexec" hostname=? addr=? terminal=? res=success' Oct 06 16:19:00 xps13.happyassassin.net pkexec[4943]: pam_unix(polkit-1:session): session opened for user root by (uid=1001) I get them over and over. My user is an admin (in wheel group).
I guess bug 764896 wasn't completely fixed yet :-(
yeah...by the looks of things that patch was in 3.20.1, and I've had 3.20.1 on this laptop since upgrading to F24 according to dnf history, so it definitely seems like it still happens somehow.
A few additional info, if it helps: - Running gnome-shell 3.22.2 under Debian and still having the issue - One new line appear every-time I hit lower/greater brightness keys on the physical keyboard: brightness is changed and gnome-shell display the pop-up about it, but there is still a new line logged. - Adding "blacklist acpi_als" in /etc/modprobe.d/blacklist.conf does reduce a LOT of these messages, but not all of them. Periodically I can still see some messages in the logs (one every minute or so). - "Automatic brightness" is disabled while "Dim screen when inactive" is enabled and "Blank screen" after 15 minutes.
*** Bug 773685 has been marked as a duplicate of this bug. ***
Bug 773685 has a work-around patch, but I'd rather it was root-caused. I couldn't reproduce the problem on my system because the IIO subsystem is buggy. So allow me to go down that rabbit hole and I'll let you know when I come back out of it again.
It seems like the code in gsd-power-manager.c is meant to claim the light sensor only if: * iio-sensor-proxy is available on the bus * the backlight is not disabled * the session is active But the code is not structured to actually do this - most transitions don't check the other parts. For example, when iio-sensor-proxy appears on the bus or the backlight is enabled, then the code unconditionally claims the light sensor. I don't have an exact theory for what code path gets triggered on my system to cause this pproblem for the gdm session, but I suspect that if there was some function somewhere that was: should_claim_light = proxy && backlight_enabled && session_active; if (should_claim_light) claim_light (); else disclaim_light(); it might well fix this problem. (With appropriate checking for not making redundant calls.) I of course might be misunderstanding the code structure :-)
While I still think there are some issues with the state transition logic, the root cause of the problem on my machine turns out to be a selinux problem where the gdm gnome-session-binary couldn't set up an inotify watch on /var/run/systemd/sessions/ Feb 02 11:52:04 localhost.localdomain audit[1518]: AVC avc: denied { read } for pid=1518 comm="gnome-session-b" name="machines" dev="tmpfs" ino=22942 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_machined_var_run_t:s0 tclass=dir permissive=0 Feb 02 11:52:04 localhost.localdomain gnome-session[1518]: gnome-session-binary[1518]: WARNING: Error getting login monitor: -13
Created attachment 344802 [details] [review] gsm-systemd.c: Restrict the login monitor to the "session" category We only are interested in changes to sd_session_get_active(), so only listen for changes in the "session" category. This reduces overhead by a small amount, and also reduces the amount of /var/run/systemd that needs to be read. (Bug 772537 is a failure because of a SELinux policy preventint reading /var/run/systemd/machines - which we don't need to monitor anyways.)
Review of attachment 344802 [details] [review]: ::: gnome-session/gsm-systemd.c @@ +232,3 @@ sd_source = (SdSource *)source; + if ((ret = sd_login_monitor_new ("session", &sd_source->monitor)) < 0) { makes the code better, fixes selinux problem. win-win i guess.
Pushed to gnome-3.22 and master Attachment 344802 [details] pushed as 73dba36 - gsm-systemd.c: Restrict the login monitor to the "session" category
*** Bug 766067 has been marked as a duplicate of this bug. ***
This does not seem to be fixed. # uname -a Linux box 4.12.9-200.fc25.x86_64 #1 SMP Fri Aug 25 13:23:30 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux # rpm -q gnome-shell gnome-settings-daemon gdm | sort gdm-3.22.3-1.fc25.x86_64 gnome-settings-daemon-3.22.2-1.fc25.x86_64 gnome-shell-3.22.3-1.fc25.x86_64 # ps axuwww | grep setting[s] user 12089 0.6 0.5 1383012 47672 tty2 Sl+ 08:35 0:05 /usr/libexec/gnome-settings-daemon gdm 20308 0.7 0.4 1144196 32832 tty1 Sl+ 08:47 0:01 /usr/libexec/gnome-settings-daemon # journalctl -f [...] Sep 02 08:49:03 box pkexec[22275]: pam_unix(polkit-1:session): session opened for user root by (uid=8000) Sep 02 08:49:03 box pkexec[22275]: tele: Executing command [USER=root] [TTY=unknown] [CWD=/home/tele] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 843] Sep 02 08:49:03 box pkexec[22274]: gdm: Error executing command as another user: Not authorized [USER=root] [TTY=unknown] [CWD=/var/lib/gdm] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 843] Sep 02 08:49:03 box gnome-settings-daemon.desktop[20308]: Error executing command as another user: Not authorized Sep 02 08:49:03 box gnome-settings-daemon.desktop[20308]: This incident has been reported. Sep 02 08:49:04 box pkexec[22290]: gdm: Error executing command as another user: Not authorized [USER=root] [TTY=unknown] [CWD=/var/lib/gdm] [COMMAND=/usr/libexec/gsd-backlight-helper --set-brightness 843] Sep 02 08:49:04 box gnome-settings-daemon.desktop[20308]: Error executing command as another user: Not authorized Sep 02 08:49:04 box gnome-settings-daemon.desktop[20308]: This incident has been reported. Sep 02 08:49:04 box pkexec[22291]: pam_systemd(polkit-1:session): Cannot create session: Already running in a session Sep 02 08:49:04 box pkexec[22291]: pam_unix(polkit-1:session): session opened for user root by (uid=8000)
(In reply to Martin Dengler from comment #12) > This does not seem to be fixed. This issue is about a particular part of the problem, which isn't the one your logs mention. > # uname -a > Linux box 4.12.9-200.fc25.x86_64 #1 SMP Fri Aug 25 13:23:30 UTC 2017 x86_64 > x86_64 x86_64 GNU/Linux > # rpm -q gnome-shell gnome-settings-daemon gdm | sort > gdm-3.22.3-1.fc25.x86_64 > gnome-settings-daemon-3.22.2-1.fc25.x86_64 > gnome-shell-3.22.3-1.fc25.x86_64 You'll probably need the patches in bug 786164, or the ones in the 3.22.x branch, for gnome-settings-daemon. If you still see problems, file a new bug against gnome-settings-daemon.