GNU bug report logs - #48265
mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

Previous Next

To reply to this bug, email your comments to 48265 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: bug-guix <at> gnu.org
Subject: mate-power-backlight-helper is referred to by store name instead of
 polkit action (IIUC)
Date: Thu, 06 May 2021 22:24:43 +0200

[Message part 1 (text/plain, inline)]

Related to: https://issues.guix.gnu.org/22952

On a mate desktop (mate-desktop-service-type).

FN-F9, FN-F10 (binded to ‘decrease brightness’ and ‘increase brightness’):

> Authentication is needed to run '/gnu/store/mp33h4vqdw0scdkjj0v6c3gima9wz8lm-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper' as the super user.

Contents of /etc/polkit-1/actions/org.mate.power.policy:


  [...]
  <icon_name>battery</icon_name>
  <action id="org.mate.power.backlight-helper">
    <!-- SECURITY:
          - A normal active user on the local machine does not need permission
            to change the backlight brightness.
     -->
    <description>Modify the laptop brightness</description>
    <message>Authentication is required to modify the laptop brightness</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-help>
  </action>
  [...]

FWIW, the following works as expected (no error message), using the store path in .policy:
$ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
of referring to the action by name org.mate.power.backlight-helper.

Note the store path is different. Now try something different

$ which mate-power-backlight-helper
> /run/current-system/profile/sbin/mate-power-backlight-helper
$ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
> /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

Now we have three different store paths so far!

Not sure what the proper way to resolve this, and what causes the three different store paths,
but one way to resolve this would be referring to /run/current-system/profile/sbin/mate-power-backlight-helper
in org.mate.power.policy (untested!).

It looks like there could very well be be similar issues in (unverified):

* /etc/polkit-1/actions/org.gnome.controlcenter.remote-login-helper.policy
* /etc/polkit-1/actions/org.gnome.gnome-system-monitor.policy
* /etc/polkit-1/actions/org.gnome.settings-daemon.plugins.power.policy
* /etc/polkit-1/actions/org.gnome.settings-daemon.plugins.wacom.policy
* grep for /gnu/store/ in /etc/polkit-1/actions/*.policy

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Message #8 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: 48265 <at> debbugs.gnu.org
Subject: Re: bug#48265: mate-power-backlight-helper is referred to by store
 name instead of polkit action (IIUC)
Date: Thu, 06 May 2021 23:02:25 +0200

Hi!

Maxime Devos <maximedevos <at> telenet.be> skribis:

> FWIW, the following works as expected (no error message), using the store path in .policy:
> $ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
> Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
> of referring to the action by name org.mate.power.backlight-helper.
>
> Note the store path is different. Now try something different
>
> $ which mate-power-backlight-helper
>> /run/current-system/profile/sbin/mate-power-backlight-helper
> $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
>> /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

These are different versions (1.24.2 vs. 1.24.1).  But that’s just two
store file names; where’s the third one?

Isn’t the problem that you reconfigured and so there’s now a mismatch
between the polkit rule in effect, which expects 1.24.1 (say), and the
version you’re running?

(FWIW brightness change works in GNOME.)

Thanks,
Ludo’.

Message #11 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 48265 <at> debbugs.gnu.org
Subject: Re: bug#48265: mate-power-backlight-helper is referred to by store
 name instead of polkit action (IIUC)
Date: Thu, 06 May 2021 23:18:59 +0200

[Message part 1 (text/plain, inline)]

Ludovic Courtès schreef op do 06-05-2021 om 23:02 [+0200]:
> Hi!
> 
> Maxime Devos <maximedevos <at> telenet.be> skribis:
> 
> > FWIW, the following works as expected (no error message), using the store path in .policy:
> > $ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
> > Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
> > of referring to the action by name org.mate.power.backlight-helper.
> > 
> > Note the store path is different. Now try something different
> > 
> > $ which mate-power-backlight-helper
> > > /run/current-system/profile/sbin/mate-power-backlight-helper
> > $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
> > > /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper
> 
> These are different versions (1.24.2 vs. 1.24.1).
I didn't notice that. Also, this makes the problem even weirder.
Were does the version mismatch come from?

I would try to run "guix gc --referrers /gnu/store/PATH-WITH-POWER-BACKLIGHT-HELPER"
as that might shed some light on the matter, but I don't have a lot of free time
currently, so I'm hoping someone else fixes the bug first :p.

> But that’s just two store file names; where’s the third one?

1.: Authentication is needed to run
    /gnu/store/mp33h4vqdw0scdkjj0v6c3gima9wz8lm-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper [...]
2.: (in org.mate.power.policy)
    /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper
3.: $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
    > /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

> Isn’t the problem that you reconfigured and so there’s now a mismatch
> between the polkit rule in effect, which expects 1.24.1 (say), and the
> version you’re running?

I've had this problem for a month, I think? I'll try to confirm / falsify
tomorrow. FWIW, I don't see any mate stuff in my use profile.

Greetings,
Maxime.

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: 48265 <at> debbugs.gnu.org
Subject: mate-power-backlight-helper is referred to by store name instead of
 polkit action (IIUC)
Date: Fri, 07 May 2021 08:38:27 +0200

>> Isn’t the problem that you reconfigured and so there’s now a mismatch
>> between the polkit rule in effect, which expects 1.24.1 (say), and the
>> version you’re running?
> I've had this problem for a month, I think? I'll try to confirm / falsify
> tomorrow. FWIW, I don't see any mate stuff in my use profile.

I booted my system, and the issue is still present.

Greetings,
Maxime.

Message #17 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Maxime Devos <maximedevos <at> telenet.be>
To: 48265 <at> debbugs.gnu.org
Subject: Re: bug#48265: mate-power-backlight-helper is referred to by store
 name instead of polkit action (IIUC)
Date: Fri, 07 May 2021 08:48:57 +0200

[Message part 1 (text/plain, inline)]

It looks like my suspicion that "mate-power-backlight-helper" is referred to by absolute
file name instead of by its polkit action is correct:
Excerpt from src/gpm-brightness.c
(https://git.mate-desktop.org/mate-power-manager/tree/src/gpm-brightness.c)

> static gboolean
> gpm_brightness_helper_set_value (const gchar *argument, gint value)
> {
>         [...]
>         /* get the data */
>         command = g_strdup_printf ("pkexec " SBINDIR "/mate-power-backlight-helper --%s %i", argument, value);
>         ret = g_spawn_command_line_sync (command, NULL, NULL, &exit_status, &error);
>         [...]
> }

Next step: look at the GNOME source code, maybe it does things differently.

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Christopher League <league <at> contrapunctus.net>
To: 48265 <at> debbugs.gnu.org
Subject: Authentication is needed to run mate-power-backlight-helper
Date: Fri, 6 Jun 2025 14:22:52 -0400

Hi, after a recent update, I am having the same authentication
issue with the brightness helper on the Mate desktop:

> Authentication is needed to run
> /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/
> mate-power-backlight-helper as the super user.

As noted previously on this bug report, the polkit
org.mate.power.policy file refers to an absolute store path.

But I think ultimately the problem may have to do with the fact that
mate-power-manager APPEARS TWICE in the system closure:

$ guix gc -R /gnu/store/2zf16...-system | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1
/gnu/store/a14gf...-mate-power-manager-1.28.1

The brightness function keys and the power-manager itself
attempt to invoke the 'ra8zy' path (and it's also in the
profile's sbin), but the polkit policy file permits only the 'a14gf'
path:

$ readlink -f (which mate-power-backlight-helper)
/gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/mate-power-backlight-helper

$ pkexec /gnu/store/a14gf...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Works perfectly

$ pkexec /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Authentication error, same as pressing brightness buttons

Looking at gnu/services/desktop.scm and gnu/packages/mate.scm,
it's unclear to me why mate-polkit-extension would end up with a
different hash for mate-power-manager than the profile does.

The effect may be reproducible just from packages, without
needing to troubleshoot the services or system. What happens if
we build mate-power-manager vs the mate union package:

$ guix build mate-power-manager
/gnu/store/a14gf...-mate-power-manager-1.28.1

That's the one in polkit.

$ guix gc -R (guix build mate) | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1

And that's the one in the profile.

Why are they different? Does it have to do with using
union-build? Apparently a similar duplication happens with xfce,
though I don't know if it leads to the same authentication
errors:

$ guix gc -R /gnu/store/2zf16...-system | grep xfce4-power
/gnu/store/8mqna...-xfce4-power-manager-4.20.0
/gnu/store/jrflf...-xfce4-power-manager-4.20.0

The exact store paths used in these examples should be
reproducible from the following minimal configuration and
relatively recent commit:

;;; BEGIN configuration.scm
(use-modules
 (gnu bootloader)
 (gnu bootloader grub)
 (gnu system file-systems)
 (gnu services desktop))

(operating-system
  (host-name "mate-power-bug")
  (bootloader (bootloader-configuration (bootloader grub-bootloader)))
  (file-systems
   (cons (file-system
           (mount-point "/")
           (device "/dev/sda1")
           (type "ext4"))
         %base-file-systems))
  (services
   (cons (service mate-desktop-service-type)
         %desktop-services)))
;; END configuration.scm

$ guix time-machine -q --commit=ed5988f0d2cf14e3cc35a32e6ad91d7cbf535e2f\
  -- system build configuration.scm
/gnu/store/2zf16...-system

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.