Xfce Forum

puneet336

Member

Registered: 2024-01-10

Posts: 8

assertion 'POLKIT_IS_SUBJECT (subject)' failed

Hi,
We have Rocky 8.10 OS on few login servers, and we use vnc sessions for daily operations.

We recently migrated our servers from CentOS 7 to Rocky 8.10 and all users are facing issue where an empty XFCE polkit dialog box appears on XFCE vnc session launch / restart.
i have reported issue here- https://github.com/ncopa/xfce-polkit/issues/12 , but no response so far.

While launching the XFCE session via tigervnc 1.13.1, i see popup with following message in the vnc client logs

** (xfce-polkit:134287): CRITICAL **: 10:40:55.215: polkit_agent_listener_register_with_options: assertion 'POLKIT_IS_SUBJECT (subject)' failed

here is the link to the full session launch logs 
https://github.com/ncopa/xfce-polkit/is … 2329629763

screenshot of the empty xfce popup - https://github.com/ncopa/xfce-polkit/is … 2487884666

We have NFS mounted HOME directory , and i understand that it houses configurations from CentOS 6 , CentOS 7 and rocky 8. Now suspecting some local configuration issue i performed config cleanup. On a different account on same server (say user2), i performed cleanup of all config files -

rm -rf .vnc .local .cache .config .fvwm .dbus .vscode .gnupg perl5 .singularity .p4qt .ICEauthority .Xauthority

As expected, after restarting XFCE vnc session, i did not see this issue again for user2. So i believe there is some configuration which is potentially causing xfce-polkit to misbehave.

Now i copied over all the configuration files from the impacted users account(cp /home/impacteduser/{.vnc,.local,.config,.cache..} $HOME) and restarted my vnc session (i had to make some minor changes, i.e. in /home/user2/.vnc/config   PlainUsers=impactedusername -> PlainUsers=user2  before restarting session)
but still i was unable to replicate the issue in user2 account.

Also, it will be very difficult for us to perform a completed configuration cleanup for all the users on the servers as there are log of Preferences and customizations from CentOS 7 which appear to work on Rocky 8 , so complete cleanup configuration will cause inconvenience to a lot of userbase in our infra.

Here are the questions -
1) Which critical config files may impact the xfce-polkit launch behavior? i.e. under $HOME/.config/xfce4/ , $HOME/.local etc
i can try cleaning those files for a start.

2) I tried disabling xfce-polkit from the xfce startup commands, and i dont see the dialog box. But i am not aware about the importance of running xfce-polkit command on session startup. Am i impacting any functionality / feature in my vnc session by excluding it from the startup commands?
https://github.com/ncopa/xfce-polkit/is … 2329567569

Last edited by puneet336 (2024-09-05 03:32:44)

puneet336

Member

Registered: 2024-01-10

Posts: 8

Re: assertion 'POLKIT_IS_SUBJECT (subject)' failed

The aforementioned post is lengthy, so i am  reposting the questions. Here are the questions -

Q 1) Which critical config files under $HOME may impact the xfce-polkit launch behavior? i.e. under $HOME/.config/xfce4/ , $HOME/.local, .ICEauthority etc
incase i have issues with xfce polkit, which config files should be investigated?

Q 2) If i  xfce-polkit from the xfce startup commands, and i dont see the XFCE pop up / dialog box. What is the importance of running xfce-polkit command on session startup. Am i impacting any functionality / feature in my vnc session by excluding it from the startup commands?

CwF

Member

Registered: 2018-01-28

Posts: 305

Re: assertion 'POLKIT_IS_SUBJECT (subject)' failed

Q1 = None
Q2 = Never seen such a thing, polkit is alive long before login. It is not started by Xfce.

puneet336

Member

Registered: 2024-01-10

Posts: 8

Re: assertion 'POLKIT_IS_SUBJECT (subject)' failed

Thanks for the response @Cwf. Yes, i am aware that polkit daemon runs as systemd service

   2447 polkitd   20   0 2056832  30916  17232 S   0.0   0.0   5:06.68 /usr/lib/polkit-1/polkitd --no-debug
● polkit.service - Authorization Manager
   Loaded: loaded (/usr/lib/systemd/system/polkit.service; static; vendor preset: disabled)
   Active: active (running) since Wed 2024-07-10 21:09:57 MDT; 6 months 25 days ago
     Docs: man:polkit(8)
 Main PID: 2447 (polkitd)
    Tasks: 12 (limit: 3355442)
   Memory: 28.9M
   CGroup: /system.slice/polkit.service
           └─2447 /usr/lib/polkit-1/polkitd --no-debug

I was referring to  /usr/libexec/xfce-polkit which is invoked by xfce4-session  -

[user1@server1]~> ps -o 'pid,ppid,cmd' 138653 138497 138335 138329 138327
    PID    PPID CMD
 138329  138327 xinit /etc/X11/xinit/Xsession startxfce4 -- /usr/bin/Xvnc :12 -geometry 1920x1080 -listen TCP -pam_service login -plainusers user2 -securitytyp
 138335  138329 -/bin/tcsh -c startxfce4
 138497  138335 xfce4-session
 138653  138497 /usr/libexec/xfce-polkit

So , there is a xfce startup command editor, and i can disable the xfce-polkit command,
but i am not sure about the impact of the action.

Last edited by puneet336 (2024-09-05 03:33:53)

gogogadget

Member

Registered: 2023-03-19

Posts: 28

Re: assertion 'POLKIT_IS_SUBJECT (subject)' failed

So , there is a xfce startup command editor, and i can disable the xfce-polkit command,
but i am not sure about the impact of the action.

From Archlinux wiki :

An authentication agent is used to make the user of a session prove that they really are the user (by authenticating as the user) or an administrative user (by authenticating as an administrator). The polkit package contains pkttyagent, a textual authentication agent which is used as a general fallback.

If you are using a graphical environment, make sure that a graphical authentication agent is installed and autostarted on login (e.g. via xinitrc).

---

EndeavourOS
Xfce+gtk3-classic (no CSD)+Picom

CwF

Member

Registered: 2018-01-28

Posts: 305

Re: assertion 'POLKIT_IS_SUBJECT (subject)' failed

Thanks for the response @Cwf. Yes, i am aware that polkit daemon runs as systemd service
I was referring to  /usr/libexec/xfce-polkit which is invoked by xfce4-session  -

Of course, I forgot about the agent, my bad. I do define user rights so there either is no password for an action or no response without any external agent. CLI execution is still possible with the password using the internal agent.