Xfce Forum

Sub domains
 

You are not logged in.

#1 2022-11-16 15:59:19

graemev
Member
Registered: 2021-08-06
Posts: 8

greyed out reboot / shutdown / suspend

I see this is an historic topic:

https://forum.xfce.org/viewtopic.php?id=7713

I have a client machine and I connect to various boxes running XFCE via X2GO.  The older boxes (stretch , buster)  allow me to shutdown
the remote boxes (I tend to power these boxes up the ONLY access via X2GO, never a local screen & keyboard) .

The oldest severs just allow the shutdown button in XFE gui. The newer boxes allow it but prompt for a password. But in the lasted version
the reboot / shutdown / suspend buttons on XFCE screen are just greyed out.

Now I found the above post and it seems about right (I need permission to reboot etc) however it points at:

    /usr/local/etc/polkit-1/localauthority/50-local.d

Which does not exist. This appears to relate to polkit(8) and more specifically pklocalauthority(8) , however a man(1) on this produces:

PKLOCALAUTHORITY(8)            pklocalauthority            PKLOCALAUTHORITY(8)

NAME
       pklocalauthority - polkit Local Authority Compatibility

DESCRIPTION
       The polkit Local Authority no longer exists. Existing configuration
       files are honored; see pkla-admin-identities(8) and pkla-check-
       authorization(8) for description of the configuration format.

So is there a newer flavour of this solution?  (I can't see a simply way to mechanically translate to the new formats)

Offline

#2 2022-11-18 04:26:07

CwF
Member
Registered: 2018-01-28
Posts: 287

Re: greyed out reboot / shutdown / suspend

Yes, a new flavor!
Write rules in the new format under /etc/polkit-1/rules.d
OR
install new package polkitd-pkla to restore the old style format and location.

Offline

#3 2022-11-19 12:04:53

graemev
Member
Registered: 2021-08-06
Posts: 8

Re: greyed out reboot / shutdown / suspend

1st thanks to @CwF and apologies if I'm slow, didn't see the email notification yesterday (amid a sea of Advertising  emails) ... I was rather hoping for a "new flavour of the solution ( :-) )   .... but are you saying:

  1. The syntax of polkt has changed , so I need to use new syntax (no  opinion WRT the solution) OR

  2. The solution DOES work, I just need to change the syntax

AFYI I did the following:

Added two new launchers, one with the "exit icon" the other with "power off" icon.  I attached the actions to:

Power off-->xfce4-session-logout -h
exit --->/usr/local/bin/shutdown-menu 

Where /usr/local/bin/shutdown-menu   was:

#!/bin/bash

### Uncomment either the zenity or yad command

#ans=$(zenity  --title "Save With Exit" --height 300 --width 200 --list  --text "Log Out: $USER" --radiolist  --column " " --column "Method" TRUE Logout FALSE Shutdown FALSE Reboot FALSE Suspend FALSE Hibernate FALSE "Lock Screen" FALSE "Reboot Kubuntu")

ans=$(yad  --window-icon=system-devices-panel-information --on-top --sticky --fixed --center --width 200 --entry --title "Xfce Exit" --text "\nSelect an action:\n" --image=xfce4_xicon3 --image-on-top --button="gtk-ok:0" --button="gtk-cancel:1" --text-align center --entry-text  "Logout" "Reboot" "Suspend" "Hibernate" "Power Off" "Lock Screen" "Reboot Kubuntu")

[[ $ret -eq 1 ]] && exit 0

case $ans in 
	Logout*)
		xfce4-session-logout -l
	;;
	Power*)
		xfce4-session-logout -h
	;;
	Reboot)
		xfce4-session-logout -r
	;;
	Suspend*)
		xfce4-session-logout -s
	;;
	Hibernate*)
		xfce4-session-logout --hibernate
	;;
    	Lock*)
        	xflock4
	;;
	Reboot\ Kubuntu)
		sudo grub-reboot "Kubuntu" 
		xfce4-session-logout -r		
    	;;
	*)
	;;
esac
exit 0

Which was copied verbatim from https://forum.xfce.org/viewtopic.php?id=11735  ( by @ToZ)

Offline

#4 2022-11-19 21:32:15

CwF
Member
Registered: 2018-01-28
Posts: 287

Re: greyed out reboot / shutdown / suspend

I was only commenting on the change in polkit for times existing setup solutions stop working across upgrades to polkit. List-changes will warn if installed, to install the extra package polkitd-pkla which restores pklocalauthority.

Sound like you didn't have a former solution?

I just use the regular "Log Out" offered by the menu, or maybe use 'Action Buttons'. No permission issues there. As far as reaching in to another computer I would use X2X which works fine as the local user. I'm not familiar with X2GO. Sounds like if X2GO presents as a remote user then the polkit rule needs tweaked...

:~$  pkaction --verbose --action-id org.xfce.session.xfsm-shutdown-helper
org.xfce.session.xfsm-shutdown-helper:
  description:       Shutdown, restart, suspend, or hibernate the system
  message:           Authentication is required to shutdown, restart, suspend, or hibernate the system.
  vendor:            XFCE Session Manager
  vendor_url:        http://xfce.org/
  icon:              xfce4-session
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes
  annotation:        org.freedesktop.policykit.exec.path -> /usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper

So X2GO is which type of user? implicit 'any' or 'inactive' need a rule or a password, only 'active' returns yes.

Offline

#5 2022-11-20 14:19:09

graemev
Member
Registered: 2021-08-06
Posts: 8

Re: greyed out reboot / shutdown / suspend

OK, here's my output (as user graeme):

graeme@real:~$ pkaction --verbose --action-id org.xfce.session.xfsm-shutdown-helper
org.xfce.session.xfsm-shutdown-helper:
  description:       Shutdown, restart, suspend, or hibernate the system
  message:           Authentication is required to shutdown, restart, suspend, or hibernate the system.
  vendor:            XFCE Session Manager
  vendor_url:        http://xfce.org/
  icon:              xfce4-session
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes
  annotation:        org.freedesktop.policykit.exec.path -> /usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper

As x2gouser

root@real:/etc# sudo -u x2gouser id
uid=121(x2gouser) gid=130(x2gouser) groups=130(x2gouser)
root@real:/etc# sudo -u x2gouser pkaction --verbose --action-id org.xfce.session.xfsm-shutdown-helper
org.xfce.session.xfsm-shutdown-helper:
  description:       Shutdown, restart, suspend, or hibernate the system
  message:           Authentication is required to shutdown, restart, suspend, or hibernate the system.
  vendor:            XFCE Session Manager
  vendor_url:        http://xfce.org/
  icon:              xfce4-session
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes
  annotation:        org.freedesktop.policykit.exec.path -> /usr/lib/x86_64-linux-gnu/xfce4/session/xfsm-shutdown-helper

Looks similar to me?

So, I now dubious that this has anything "privileges"   as when I added a launcher with the action

xfce4-session-logout -h

It prompts for my passwd (I have the group sudo in my set) then shutsdown. This suggests to me if the GUI option were not greyed out in XFCE then it would do similar.

So, I'm thinking this is a usability design feature of XFCE, they've decided to grey out certain "globally affecting actions" from the desktop.

Now, since it's very hard to post a picture here, let me be clear were these "buttons" are:

  1. I've connected to the machine "real" via a x2go session which launched XFCE

  2. I login as the user "graeme" (who is in sudo group)

  3. In the top RH corner of the screen is 1st the date, then my name. If I click on my name I get a dropdown with 5 "buttons" on it

    • Lock screen

    • Switch User

    • Suspend

    • Shutdown

    • Logout

The options suspend and shutdown are greyed out. I have a similar choice on a older XFCE system  (xfce4-about -v says 4.12.1 ) connected in a similar fashion but here the buttons are not greyed out.

So I'm thinking (now) this is a "default" setting to ensure a user new to XFCE does not shut the system down in error .If I open the session on the "console" (Direct HDMI connected screen) the options are active (not grey). (so the polkit discussion was possibly a diversion).

Offline

#6 2022-11-20 16:42:28

CwF
Member
Registered: 2018-01-28
Posts: 287

Re: greyed out reboot / shutdown / suspend

graemev wrote:

. (so the polkit discussion was possibly a diversion).

Possibly, but I am leading down this discussion poorly perhaps...
So, some clarifications for all;

root@real:/etc# sudo -u x2gouser pkaction

I see your thinking, but it's wrong.the pkaction command is reading the same info regardless of who invokes it, it is NOT user sensitive. Polkit has it's own 'as user' facilities, root bypasses both polkit and sudo, and sudo is essentially a competing methodology to polkit. So untangle such attempts to mix them all together!
So, yes, you will get identical results stating the overall policy of the action. It states only a local user has the rights.

xfce4-session-logout -h

It prompts for my passwd

I think this means you do NOT qualify as a local user 'active' and are under the rules of 'any' an/or 'inactive' which require a password as reported. Also in the policy is no mention of 'Allow_GUI' so I suspect there is no facility to talk to any gui agent to allow a password entry, of a greyed out button. That step in a cli allows entering a password, as you say. So the rule you'd create if this is the issue is to change 'inactive' to yes. Since I haven't messed with this I may be wrong, but look at /usr/share/polkit-1/actions/org.freedesktop.login1.policy for clues. The pkaction command is read from here, and parsing the one action. Which action is the target of your modified rule I'm not sure, point is the 'inactive' I do think is the relevant topic.

To check the authority process for a user action use pkcheck, this may be of help, and do as user:

pkcheck --process $$ --action-id org.xfce.session.xfsm-shutdown-helper --allow-user-interaction --enable-internal-agent

No response means that user can execute that action.
'--allow-user-interaction' is not required unless the user is required to enter a password.
'--enable-internal-agent' is not required unless  the user is required to enter a password, and there is no gui 'agent' installed.

If there is no return from this command as user in a user terminal without the use of sudo = then it's not a polkit issue I'd think. Clear as mud.

Last edited by CwF (2022-11-20 16:45:53)

Offline

#7 2022-11-20 18:03:48

graemev
Member
Registered: 2021-08-06
Posts: 8

Re: greyed out reboot / shutdown / suspend

Well, using:

pkcheck --process $$ --action-id org.xfce.session.xfsm-shutdown-helper --allow-user-interaction --enable-internal-agent

I get a password prompt. If I cancel or get it wrong 3 times I get:

Authentication request was dismissed.  or Not authorized.

If I give the right password, I get no output.


If I modify the command to

$ pkcheck --process $$ --action-id org.xfce.session.xfsm-shutdown-helper  --enable-internal-agent
Authorization requires authentication and -u wasn't passed.

Offline

#8 2022-11-20 18:36:02

CwF
Member
Registered: 2018-01-28
Posts: 287

Re: greyed out reboot / shutdown / suspend

graemev wrote:

If I give the right password, I get no output.

...which means the user with that valid password is allowed. No output is affirmative, it would be nice if the response was 'authorized', but no answer is the good answer.

However, remember the cli and a gui are not the same.

Last edited by CwF (2022-11-20 18:37:36)

Offline

#9 2023-10-02 21:52:54

jprofesorek
Member
Registered: 2023-10-02
Posts: 3

Re: greyed out reboot / shutdown / suspend

CwF wrote:

Yes, a new flavor!
Write rules in the new format under /etc/polkit-1/rules.d
OR
install new package polkitd-pkla to restore the old style format and location.

Hurr durr.

The documentation of polkit, of writing the rules and of login1 are written as if the corresponding developers attempted to force people into paid support...

Once you go through the documentation that makes your eyes bleed (systemd, polkit), it's feasible to write the following rule that allows any user to reboot and shutdown (the rule need to go to e.g., /etc/polkit-1/rules.d/99-allow_shutdown_reboot.rules ; one has to create the directories manually):

polkit.addRule(function(action, subject){
        if(action.id.match(/^org\.freedesktop\.login1\.reboot.*/))
                return polkit.Result.YES;
        if(action.id.match(/^org\.freedesktop\.login1\.power-off.*/))
                return polkit.Result.YES;
});

consolekit + pkla used action org.freedesktop.consolekit.system.stop,
systemd + pkla used action org.freedesktop.login1.shutdown.*,
systemd + rules use action org.freedesktop.login1.power-off.*.
Does some sadist change the last bit of the action name every now and then?
Notice that the action itself is poweroff, but you must allow power-off.

Let me leave this here for other people who stumble upon this so they don't have to reverse-engineer all this over again.

Offline

#10 2023-10-02 22:58:20

graemev
Member
Registered: 2021-08-06
Posts: 8

Re: greyed out reboot / shutdown / suspend

Well at some point in the past I added a couple of "buttons" on the XFCE menu (loggoff & shutdown ...sort of)  ..they worked but required a password.
Following this change they no longer require a password.

...going back using the XFCE menu ... YES!! the shutdown button no longer greyed out and it works. Many thanks @jprofesorek

(I don't see a Kudos option on this site ... so ..." A warm round of applause" )

Offline

#11 2023-11-03 13:33:42

soleen
Member
Registered: 2006-08-02
Posts: 5

Re: greyed out reboot / shutdown / suspend

I have tried solutions listed in this thread, and nothing worked. The following worked for me on Ubuntu 22.04.3 running xfce in a chrome remote desktop session:

# cat /etc/polkit-1/localauthority/50-local.d/power.pkla 
[all users to use login1_power-off-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.power-off-multiple-sessions;org.freedesktop.login1.power-off
ResultAny=yes
ResultActive=yes
ResultInactive=no

Last edited by soleen (2023-11-03 13:36:04)

Offline

#12 2023-11-04 10:20:30

graemev
Member
Registered: 2021-08-06
Posts: 8

Re: greyed out reboot / shutdown / suspend

As I think I've amply demonstrated, I know almost nothing of polkit .... but (@CwF) does your solution not look like the same "format" as the referenced URL in post#1

I see this is an historic topic:

https://forum.xfce.org/viewtopic.php?id=7713

i.e. "the old format" ?

Offline

#13 2023-11-04 17:18:01

CwF
Member
Registered: 2018-01-28
Posts: 287

Re: greyed out reboot / shutdown / suspend

graemev wrote:

.... but (@CwF) does your solution not look like the same "format"

As I remember I was trying to help out after seeing this subject come up again and again - and never myself replicating the issue!

My Debians have no issue, and needed no solution!  The 'old format' comment refers to pkla style while recently Debian split to using the java script style for defining polkit rules. For bookworm pkla style requires the additional package polkit-pkla to understand the old rules. However, I never had to add anything for session control.

Offline

Board footer

Powered by FluxBB