Changing PolicyKit settings per user
I have been hit twice by a required authentication on my workstation after the Wifi connection got lost and it is clearly irritating, especially when you are not around. The authentication requests are handled by PolicyKit (polkit for short) and can be tweaked.The message by which I was hit was the following: "System policy prevents modification of network settings for all users."
Before you get started, the system wide configuration files that contain the default values reside inside the /usr/share/polkit-1/actions/ directory. In this directory resides the file org.freedesktop.NetworkManager.policy which contains all the default actions. It does also contain the message about the network settings for which the action id is "org.freedesktop.NetworkManager.settings.modify.system." At this point I was still clueless of what I was supposed to do.
After having search the web for information about PolicyKit I have found one interesting article that helped me getting done with my issue and learning more about this authorization framework. This action being very seldom to perform, I'm summing up everything here.
There are two useful commands to perform tests with PolicyKit, pkcheck and pkaction.
The first interesting command to use is pkcheck. It will trigger an authorization request and prompt you to type in a password, simply return true if no authorization is required otherwise false. For example:
pkcheck --action-id org.freedesktop.NetworkManager.settings.modify.system \You have to adapt the process and user parameters of course.
--process `pidof gnome-session` -u `id -u`
Next the command pkaction can be used to print the default system values, for example:
pkaction --action-id org.freedesktop.NetworkManager.settings.modify.system \Now to have a custom setting for your user, what has to be done is to create a PolicyKit Local Authority file inside the directory /var/lib/polkit-1/localauthority/. Here is an example:
--verbose
[Let user mike modify system settings for network]I have saved this file under /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla.
Identity=unix-user:mike
Action=org.freedesktop.NetworkManager.settings.modify.system
ResultAny=no
ResultInactive=no
ResultActive=yes
There are three main values you can pass to ResultActive that are no, auth_admin or yes. Respectively it will deny the authorization, ask for a password, and give access. For further information about the possible values check the polkit manpage, also don't miss the pklocalauthority manpage to read more about the localauthority tree structure.
Changing PolicyKit settings per user
I have been hit twice by a required authentication on my workstation after the Wifi connection got lost and it is clearly irritating, especially when you are not around. The authentication requests are handled by PolicyKit (polkit for short) and can be tweaked.The message by which I was hit was the following: "System policy prevents modification of network settings for all users."
Before you get started, the system wide configuration files that contain the default values reside inside the /usr/share/polkit-1/actions/ directory. In this directory resides the file org.freedesktop.NetworkManager.policy which contains all the default actions. It does also contain the message about the network settings for which the action id is "org.freedesktop.NetworkManager.settings.modify.system." At this point I was still clueless of what I was supposed to do.
After having search the web for information about PolicyKit I have found one interesting article that helped me getting done with my issue and learning more about this authorization framework. This action being very seldom to perform, I'm summing up everything here.
There are two useful commands to perform tests with PolicyKit, pkcheck and pkaction.
The first interesting command to use is pkcheck. It will trigger an authorization request and prompt you to type in a password, simply return true if no authorization is required otherwise false. For example:
pkcheck --action-id org.freedesktop.NetworkManager.settings.modify.system \You have to adapt the process and user parameters of course.
--process `pidof gnome-session` -u `id -u`
Next the command pkaction can be used to print the default system values, for example:
pkaction --action-id org.freedesktop.NetworkManager.settings.modify.system \Now to have a custom setting for your user, what has to be done is to create a PolicyKit Local Authority file inside the directory /var/lib/polkit-1/localauthority/. Here is an example:
--verbose
[Let user mike modify system settings for network]I have saved this file under /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla.
Identity=unix-user:mike
Action=org.freedesktop.NetworkManager.settings.modify.system
ResultAny=no
ResultInactive=no
ResultActive=yes
There are three main values you can pass to ResultActive that are no, auth_admin or yes. Respectively it will deny the authorization, ask for a password, and give access. For further information about the possible values check the polkit manpage, also don't miss the pklocalauthority manpage to read more about the localauthority tree structure.
Changing PolicyKit settings per user
I have been hit twice by a required authentication on my workstation after the Wifi connection got lost and it is clearly irritating, especially when you are not around. The authentication requests are handled by PolicyKit (polkit for short) and can be tweaked.The message by which I was hit was the following: "System policy prevents modification of network settings for all users."
Before you get started, the system wide configuration files that contain the default values reside inside the /usr/share/polkit-1/actions/ directory. In this directory resides the file org.freedesktop.NetworkManager.policy which contains all the default actions. It does also contain the message about the network settings for which the action id is "org.freedesktop.NetworkManager.settings.modify.system." At this point I was still clueless of what I was supposed to do.
After having search the web for information about PolicyKit I have found one interesting article that helped me getting done with my issue and learning more about this authorization framework. This action being very seldom to perform, I'm summing up everything here.
There are two useful commands to perform tests with PolicyKit, pkcheck and pkaction.
The first interesting command to use is pkcheck. It will trigger an authorization request and prompt you to type in a password, simply return true if no authorization is required otherwise false. For example:
pkcheck --action-id org.freedesktop.NetworkManager.settings.modify.systemYou have to adapt the process and user parameters of course.
--process `pidof gnome-session` -u `id -u`
Next the command pkaction can be used to print the default system values, for example:
pkaction --action-id org.freedesktop.NetworkManager.settings.modify.systemNow to have a custom setting for your user, what has to be done is to create a PolicyKit Local Authority file inside the directory /var/lib/polkit-1/localauthority/. Here is an example:
--verbose
[Let user mike modify system settings for network]I have saved this file under /var/lib/polkit-1/localauthority/50-local.d/10-network-manager.pkla.
Identity=unix-user:mike
Action=org.freedesktop.NetworkManager.settings.modify.system
ResultAny=no
ResultInactive=no
ResultActive=yes
There are three main values you can pass to ResultActive that are no, auth_admin or yes. Respectively it will deny the authorization, ask for a password, and give access. For further information about the possible values check the polkit manpage, also don't miss the pklocalauthority manpage to read more about the localauthority tree structure.
How to fix broken Xubuntu Natty panels?
Since many people have had problems with the Xubuntu Natty panels due to bug #747137 (which is fixed now), we thought it would be nice to tell how to fix the panels. Here goes:
- Log out from Xfce
- Open a TTY (eg. press Ctrl+Alt+F1)
- Log in in the TTY
- Run ‘rm -rf $HOME/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml’
- Log out from the TTH (‘logout’ should do the trick)
- Get back to TTY7 (Ctrl+Alt+F7) or if that doesn’t work, TTY8 (Ctrl+Alt+F8)
- Log in and your panels should be now fixed and have the default settings
Note that this problem with the panels only appears on systems already running Natty, new installs shouldn’t be affected.
important strategic decisions
Posting our recent decisions for Foresight Linux as sent to the mailing list by doniphon:With the ongoing mess with the gtk2 -> gtk3 migration, followed by
the announcement of the gnome reschedule, and the gnome-shell/unity
rift, we do think our 2 major desktops gnome and xfce are rendered
unusable for the unforeseeable future. Same counts for kde as nokia
started to drop support for qt. Therefore we decided to focus our work
on getting in e19, a major enhancement to enlightements e17, using an
improved and hw accelerated curses library, done by us on a still
private bitbucket repository. This change also involves getting rid of
the much hated combination of pulseaudio/alsa in favour of the much more
modern and stable OSS 4.2, and entirely dropping Xorg and evolving to
Xfree2k. We're looking foreward to provide a superior user experience
soon with fl:3++. We'll shortly set the e19 repository to public, so you
all can benefit (and contribute) after signing our standard contribution
agreement that cedes all your present and future rights to Paris Hilton.
As a side note we'll be moving our default kernel to MinixNG too.
Have a nice day.
Porto, 1th April 2011
The Foresight Linux Council
Scale 9x: Day 3
Sunday
The final day of SCALE 9x arrived far too early, since the Gentoo developers were still recovering from the merriment the previous evening/morning. We congregated in the hotel room Mike & I shared. You know you’re having some good times when hotel security places a call to your room, asking you to keep the noise down.
The hotel experience
The Hilton is a terrible, terrible hotel. I know the organizers needed a bigger venue, and the Hilton provided more rooms. Still. All the Gentoo developers and all the attendees I talked to commented on how much worse the hotel itself was compared to the Westin from previous years. The location is worse compared to what’s in the area, the parking is more limited and expensive, the rooms were more “ghetto,” and the hotel’s prices for everything were ridiculously expensive. $5 for a half-glass of orange pulp, I mean, juice. Next year I may not stay at the Hilton, even though that would be less convenient. The expo actually felt just as packed-to-overflowing compared to previous years at the Westin, so hopefully they’ll have to move SCALE again for next year.
The expo floor
Sunday is usually more sparsely attended at SCALE; Saturday is the “big” day. However, we still had a decent amount of traffic at our booth. We gave away the last couple of LiveDVDs and a bunch more minimal LiveCDs. I just manned the booth all day, since there weren’t any talks that looked particularly interesting. This gave me an opportunity to do some swag-hunting. I picked up some Ubuntu stickers for my laptop, which dual-boots Ubuntu Studio along with Gentoo. I also got to try out the upcoming Unity desktop user interface. I dunno why everyone hates it; in my brief hands-on, it was pretty cool. Plus you can switch back to the “classic” Gnome interface at any time, so there’s no reason to complain.
I picked up some excellent swag from the OpenSUSE booth, including a plush penguin and gecko for my wife. They’re pretty cute. (Side note: I had an awesome chat with their Greek ambassador; we talked about community, and how hard it is to get people to contribute, as well as discussed KDE. I gave him one of our LiveDVDs, since he’s been talking with the Greek Gentoo KDE devs, and in return I got an OpenSUSE 11.3 disc. 11.4 will be released in just a few days!)
The expo floor and conference rooms were much better this year in a key area: wireless internet. This year the SCALE organizers managed to create and maintain a speedy wifi network. I never experienced the dropouts and miniscule bandwidth that plagued previous years. I read somewhere that a 45mbit network was setup, and that it was never oversaturated. The wifi connection, even with over 1000 users, was still faster than my home network. The organizers and admins deserve special thanks for delivering such an awesome experience. I was able to check bugs, upload files, and make CVS commits as I discussed issues with my fellow developers, all without leaving the Gentoo booth.
The machines
Sometime after noon, Robin grabbed me and told me to get my USB stick with the PowerPC ISO. Why? IBM was demoing their massive server, which included a POWER7 blade. They wanted to know if Gentoo would run on it! Our handbook doesn’t list anything more recent than POWER5, so this was a good time to learn more. A few of us headed over to watch Gentoo get loaded onto new hardware. We got a few photos and videos of Gentoo booting on the massive server; here’s one:
It made it through nearly all the boot process, but apparently there are some differences in POWER7 console/tty devices or some such compared to POWER5, so it hung at the inittab step, but still! Gentoo on POWER7! It mostly boots; just needs a couple of trivial changes. That’s fantastic, given that it’s an unmodified ppc64 ISO.
We demoed a few different machines at our booth. I forgot to get any pictures of this year’s gear; sorry. Everything ran Gentoo, of course! We displayed a pair of Cr-48 ChromeOS notebooks, my ThinkPad running Xfce 4.8, an ASUS notebook, an ARM-based Nail board by Tin Can Tools, and a tiny blue XXS MIPS-based firewall/VPN cube by MyCable.
The people
Before I drove back down to San Diego, we got a group shot of current and former developers:
Left to right: vapier, omp, antarus, dertobi123, wolf31o2, nightmorph, solar, wormo, ramereth, robbat2
SCALE was a blast; it was even better than last year. We chatted with all kinds of users, corporate reps, and people from projects like XBMC. Thanks to all the folks that came by our booth and talked with us — you guys rock. I’m looking forward to next year’s SCALE!
Xfce Foundation e.V. launched at FOSDEM!
This year’s FOSDEM was a special one. Read more about it in this mail:
Hi everyone,
as some of you might have read, several of us Xfce developers and
packagers have attended FOSDEM this weekend. There was a lot of talking
and a bit of brainstorming of course. Together we enjoyed food, beer,
talks and also did something that we have been struggling with for
several years now: we launched a non-profit organization for Xfce.
Yes, you read correctly: the
Xfce Foundation e.V.
was founded by a group of us on Saturday afternoon! It still needs to
be registered, so technically it's not an "e.V." (a non-profit
organization registered in Germany) yet. But it will be, we are working
on that.
The eight founding members are:
#1 Christoph Wickert
#2 Landry Breuil
#3 Jens Luedicke
#4 Christian Dywan
#5 Nick Schermer
#6 Jérôme Guelfucci
#7 Jannis Pohlmann
#8 Lionel Le Folgoc
Please give everyone a hug or at least a thumbs up next time they pop
up on IRC. Without them being there this would not have been possible!
The main part next to signing the articles of association (which we
will soon upload somewhere, probably on foundation.xfce.org or
something like that) was to elect the initial Board of Directors of the
Xfce Foundation. Without objections the following people were elected
to the Board of Directors with a 2 years mandate:
President:
Jannis Pohlmann
Vice President:
Nick Schermer
Vice President and Treasurer:
Jérôme Guelfucci
The Board will now take care of the registration process and will meet
up for the first time on March 1st, 2011. There will be a general
assembly for all Xfce Foundation members on March 6th, 2011.
We will soon announce more details about the decisions that were made
and about how you can become an Xfce Foundation member (it's really not
difficult and it won't cost you any money -- but there are obligations
connected to it of course).
After the registration we will create a bank account and a new paypal
account as well in order to collect donations. These donations will be
tax deductible!
Stay tuned for updates on this. I hope you are as excited as we are
about this. I hope it will help a lot in pushing Xfce forward.
Cheers,
Jannis
Proud Founding Members
Xfce 4.8 on BSD flavors
I should’ve made this more clear in the Xfce 4.8 release announcement but for a moment there I forgot that not everyone knows what we developers are dealing with under the hood.
Many users have been asking what the BSD problems are that I mentioned in the announcement. As some of you may recall is that HAL, the hardware abstraction layer that has for the past few years been used for volume and power management as well as a few other things, has been deprecated and replaced by a variety of frameworks. Today there is udev for device information, udisks for volume management, upower for power management as well as ConsoleKit and PolicyKit for session and permission control.
At least udev is strongly linked to Linux and as far as I know is not available on any of the BSD flavors. Unfortunately it is now the only good way to detect storage devices, cameras, printers, scanners and other devices using a single framework. That’s why we use it in Xfce now in situations where HAL provided us with device capabilities and information to distinguish between the different device types before. The consequence is that thunar-volman no longer works without udev and thus only compiles on Linux. In Thunar itself udev remains optional.
I don’t know what the porting status of the other frameworks is. But I am pretty sure not all of them have been ported to other platforms yet which is why I felt the need to express our disappointment in the announcement. For 2-3 years now all this has been a big mess. New frameworks were invented, dropped again, renamed from *Kit to u* and somewhere on the way it became impossible to keep Xfce as portable as it was before. I know that this is nothing new and that BSD folks faced the same situation as they do now back when HAL was invented but I don’t think it has to be this way.
For the question how we can improve the situation I have no answer yet.
Xfce 4.8 released
As the Xfce team announced yesterday, Xfce 4.8 is released.
Congratulations and thanks to all contributors. I hope Xfce will have a bright future. The Xfce team has also created a new website theme for Xfce.org, which is also definitely an improvement. They are still having problems because of the small core developer team. It’s a good time to start contributing now.
Xfce 4.8 will also be in the next Xubuntu release, Natty Narwhal. Lionel Le Folgoc has been and is doing fabulous work to get it in. Thanks to him too. There is also places open in the Xubuntu team. Go fill them.
Xfce 4.8 released!
Today, after almost two years of work, we have the special pleasure of announcing the much awaited release of Xfce 4.8, the new stable version that supersedes Xfce 4.6.
We hope that everyone will enjoy this release as much as we do. Sadly, this will not be the case as the folks using any of the BSD systems will notice a sudden loss of features. We think that this announcement is a good opportunity to express our disagreement with the recent “Linux-only” developments in the open source ecosystem, especially with regards to the utilities we need in desktop environments.
Xfce 4.8 is our attempt to update the Xfce code base to all the new desktop frameworks that were introduced in the past few years. We hope that our efforts to drop pieces like ThunarVFS and HAL with GIO, udev, ConsoleKit and PolicyKit will help bringing the Xfce desktop to modern distributions.
With Xfce 4.8 our users will be able to browse remote shares using a variety of protocols (SFTP, SMB, FTP and many more). The window clutter has been reduced by merging all file progress dialogs into a single one.
Our panel application has been rewritten, thereby improvingpositioning, transparency, item and launcher management. It also introduces a new menu plugin to view directories. Its plugin framework remains compatible with 4.6 plugins.
We also improved our settings dialogs. The display configuration dialog now supports RandR 1.2, detects screens automatically and allows our users to pick their favorite resolution, refresh rate, rotation. Screens can be configured to either work in clone mode or be placed next to each other. Keyboard selection has become easier and more user-friendly. Also, the manual settings editor has been updated be more functional.
Aside from the features implemented in Xfce, the 4.8 development cycle brought us a bunch of other goodies. For the first time we had a serious release strategy formed after the “Xfce Release and Development Model” developed at the Ubuntu Desktop Summit in May 2009. A new web application made release management a lot easier. We worked hard on improving the situation of Xfce translators which led us to setting up our own Transifex server. Something else you will hopefully notice is that our server and mirroring infrastructure has been improved so that our servers hopefully will not suddenly surrender shortly after this release announcement.
There is a lot more to discover and we hope a lot of you will give Xfce 4.8 a try! There is a brief tour online on
http://xfce.org/ and http://xfce.org/about/tour
A summary of the changes since the 4.8pre3 preview release is available on the following URL (it also includes links to the changes introduced in all preview releases):
http://xfce.org/download/changelogs/4.8.0
The release can be downloaded either as individual releases or as a fat tarball including all these individual versions:
http://archive.xfce.org/xfce/4.8/
2011 has just begun and we are already planning for the future. The 4.10 schedule will be worked on soon and hopefully, we will be able to turn Xfce into a non-profit organization at this year’s FOSDEM, so stay tuned!
But until then we hope you will enjoy today’s release and join us in celebrating. Thanks go out to all our contributors, bug reporters as well as the awesome efforts of our translators and packagers.
Best regards,
The Xfce development team