Ytdyklly

I have troubles with infamous colord policy prompts on Gnome 3.28.1. With XFCE desktop on the same system I have no such problem.

I work via xrdp and always get this prompt and I cannot disable it.

Whenever I change <action id="org.freedesktop.color-manager.create-device"> policy in /usr/share/polkit-1/actions/org.freedesktop.color.policy to <allow_any>yes</allow_any> I get Gnome fatal error in logs.

UPDATED logs after WinEunuuchs2Unix advice:

gsd-media-keys[1099]: Unable to inhibit keypresses: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: Permission denied

gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit gnome-user-share-webdav.service not loaded.

gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit rygel.service not loaded.

gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit gnome-remote-desktop.service not loaded.

gsd-sharing[1059]: Failed to StopUnit service: GDBus.Error:org.freedesktop.systemd1.NoSuchUnit: Unit vino-server.service not loaded.

gnome-session-binary[877]: Entering running state

dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'org.gnome.evolution.dataserver.Calendar7'

systemd[847]: Started Evolution calendar service.

dbus-daemon[867]: [session uid=1000 pid=867] Activating service name='ca.desrt.dconf' requested by ':1.56' (uid=1000 pid=1176 comm="/usr/lib/evolution/evolution-calendar-factory-subp" label="unconfined")

dbus-daemon[867]: [session uid=1000 pid=867] Activating via systemd: service name='org.gnome.evolution.dataserver.AddressBook9' unit='evolution-addressbook-factory.service' requested by ':1.56' (uid=1000 pid=1176 comm="/usr/lib/evolution/evolution-calendar-factory-subp" label="unconfined")

systemd[847]: Starting Evolution address book service...

dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'ca.desrt.dconf'

dbus-daemon[867]: [session uid=1000 pid=867] Successfully activated service 'org.gnome.evolution.dataserver.AddressBook9'

systemd[847]: Started Evolution address book service.

gnome-shell[922]: Error looking up permission: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.impl.portal.PermissionStore was not provided by any .service files

kerneloops-appl[1152]: Failed to load module "canberra-gtk-module"

gsd-color[1088]: failed to get edid: unable to get EDID for output

colord[1140]: failed to get seat for session c1 [pid 1088]: No data available

gnome-shell[922]: GDBus.Error:org.freedesktop.DBus.Error.NoReply: Message recipient disconnected from message bus without replying

gsd-color[1088]: unable to get EDID for xrandr-rdp0: unable to get EDID for output

kernel: [  213.817502] do_trap: 20 callbacks suppressed

kernel: [  213.817504] traps: gsd-color[1088] trap divide error ip:5592b1f5c94a sp:7fffbcc03a90 error:0 in gsd-color[5592b1f53000+12000]

gnome-shell[922]: Could not get current seat: No data available

gnome-shell[922]: GNOME Shell started at Mon May 21 2018 12:06:54 GMT+0300 (EEST)

gnome-session[877]: gnome-session-binary[877]: WARNING: Application 'org.gnome.SettingsDaemon.Color.desktop' killed by signal 8

gnome-session-binary[877]: WARNING: Application 'org.gnome.SettingsDaemon.Color.desktop' killed by signal 8

gsd-color[1240]: failed to get edid: unable to get EDID for output

colord[1140]: failed to get seat for session c1 [pid 1240]: No data available

gsd-color[1240]: unable to get EDID for xrandr-rdp0: unable to get EDID for output

kernel: [  220.142162] traps: gsd-color[1240] trap divide error ip:55c79912d94a sp:7ffcbd6a6020 error:0 in gsd-color[55c799124000+12000]

gnome-session[877]: gnome-session-binary[877]: WARNING: App 'org.gnome.SettingsDaemon.Color.desktop' respawning too quickly

gnome-session-binary[877]: WARNING: App 'org.gnome.SettingsDaemon.Color.desktop' respawning too quickly

gnome-session-binary[877]: Unrecoverable failure in required component org.gnome.SettingsDaemon.Color.desktop

gnome-session[877]: gnome-session-binary[877]: CRITICAL: We failed, but the fail whale is dead. Sorry....

gnome-session-binary[877]: CRITICAL: We failed, but the fail whale is dead. Sorry....

xrdp-sesman[846]: (846)(140561311482944)[CORE ] window manager (pid 859) did exit, cleaning up session

xrdp-sesman[846]: (846)(140561311482944)[INFO ] calling auth_stop_session and auth_end from pid 846

xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets:

xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdp_chansrv_audio_out_socket_10

xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdp_chansrv_audio_in_socket_10

xrdp-sesman[846]: (846)(140561311482944)[DEBUG] cleanup_sockets: deleting /tmp/.xrdp/xrdpapi_10

xrdp-sesman[621]: (621)(140561311482944)[INFO ] ++ terminated session:  username xoob, display :10.0, session_pid 846, ip 192.168.1.100:7137 - socket: 12

xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 26 (AF_UNIX)

at-spi-bus-launcher[884]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":10.0"

at-spi-bus-launcher[884]:       after 23 requests (23 known processed) with 0 events remaining.

kernel: [  221.144168] gnome-shell[922]: segfault at 10 ip 00007fd88cb3712f sp 00007fff690fcac0 error 4 in libmutter-2.so.0.0.0[7fd88ca73000+156000]

gsd-power[1051]: gsd-power: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

gsd-xsettings[1069]: gsd-xsettings: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

gsd-wacom[1075]: gsd-wacom: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

gsd-clipboard[1084]: gsd-clipboard: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

gsd-media-keys[1099]: gsd-media-keys: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

gsd-keyboard[1093]: gsd-keyboard: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

kerneloops-applet.desktop[1152]: kerneloops-applet: Fatal IO error 11 (Resource temporarily unavailable) on X server :10.0.

conky.desktop[1150]: XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":10.0"

conky.desktop[1150]:       after 578 requests (578 known processed) with 0 events remaining.

xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 12 (AF_INET 192.168.1.201:7777)

xrdp[844]: (844)(140711347752192)[DEBUG] xrdp_mm_module_cleanup

xrdp[844]: (844)(140711347752192)[DEBUG] Closed socket 25 (AF_UNIX)

The same happens if I simply try to login interactively with password prompt.

I tried to create custom pkla file in /var/lib/polkit-1/localauthority/50-local.d:

<action id="org.freedesktop.color-manager.create-device">

  <description xml:lang="en">Create a color managed device</description>

  <message xml:lang="en">Authentication is required to create a color managed device</message>

  <defaults>

    <allow_any>yes</allow_inactive>

    <allow_inactive>yes</allow_inactive>

    <allow_active>yes</allow_active>

  </defaults>

</action>

It seems to me it's equivalent to directly changing actions is /usr/share/polkit-1/actions.

I also tried to create global allow pkla rule as per this proposal:

[No password prompt]

Identity=unix-group:sudo

Action=*

ResultActive=yes

I also have global rule in /etc/polkit-1/rules.d

polkit.addRule(function(action, subject) {

if (subject.isInGroup("group")) {

      return polkit.Result.YES;

   }

});

As I got it, if I have polkit < 0.106, the rules are not processed, and one should use pkla files. Correct me, if I'm wrong. My pkaction --version shows 0.105.

None of the above worked. Which steps should I try and how to debug this?

In Stack Exchange I found this bug fix which might be helpful.

More specific you have to place a .rules file in

/etc/polkit-1/rules.d/

(Select a filename and just give the .rules extension)

and give the rules:

polkit.addRule(function(action, subject) {

   if ((action.id == "org.freedesktop.color-manager.create-device" ||

        action.id == "org.freedesktop.color-manager.create-profile" ||

        action.id == "org.freedesktop.color-manager.delete-device" ||

        action.id == "org.freedesktop.color-manager.delete-profile" ||

        action.id == "org.freedesktop.color-manager.modify-device" ||

        action.id == "org.freedesktop.color-manager.modify-profile") &&

       subject.isInGroup("ATTENTION")) {

      return polkit.Result.YES;

   }

});

Then you have to Replace the word "ATTENTION" with your user's group.

Refer back to the link for more information and additional links to follow.

Original post below

Your system logs are showing gnome-keyring errors. Solving those errors is likely key to your policy kit problems based on this Q&A: Gnome-keyring login problem that references policy kits.

Googling your specific error message:

couldn't access control socket: /run/user/1000/keyring/control: No such file or directory 

Returns a lot of results:

• Why do I get this warning from Gnome keyring in Xubuntu?


• From ArchLinux: Gnome Keyring not working
  


• From Debian: Fails to provide secrets
  

Between these three links you should find enough information to fix the gnome-keyring error. This in turn should be the precursor to fixing the policy kit problems.

The issue was related to incorrect pass of single entry gamma ramp instead of a 256 entry gamma ramp. The bug was fixed in xorgxrdp version 0.2.6.

I had a problem not being able to connect to vpn from ssh session on ubuntu 18.04.
The problem was related to polkit, since

nmcli general permissions

Shows the lack of permissiosns.

I've succeed with following way of adding custom polkit rule with ubuntu 18.04 (still polkit version 0.105, no support of javascript rules). As root I executed the command:

 # cat > /etc/polkit-1/localauthority/50-local.d/allow-all-for-group-sudo-polkit105.pkla

and entered following contents (note, this allows EVERYTHING for users of sudo group, may be risky):

[Allow all without authentication for members of sudo group even for ssh sessions]

Identity=unix-group:sudo

Action=*

ResultAny=yes

After this without restarting of any services or rebooting I got permissions to use any nmcli commands from ssh.

Check the syntax of your pkla file. There might be hidden characters preventing polkit from parsing the file. See here.