Polkit issue sanity check

[Cauchy]

I just wanted to sanity check something I did and make sure I didn’t leave anything in an unsafe state:

My mothers manjaro install (still going strong after a long time!) had some kind of issue while updating it seems, and the .vmlinuz boot files were missing (so, couldn’t boot).

I flashed a fresh manjaro iso to usb, manjaro-chroot’d in, and reinstalled the kernel. I then managed to boot up the system. However, the kernel that was installed was an older version (5-something), whereas she was running the latest 6- LTS kernel

Upon making sure everything was okay, I ended up getting issues with the password input prompt thing, which, from my understanding, is polkit

Eventually, to fix the issue, I masked polkit-agent-helper.socket, reinstalled linux 6-… and then unmasked it again. It now seems to work fine

A few questions:
(1) Is there any way I can double check I have correctly unmasked the service and it’s back to normal?
(2) Other users mentioned that masking polkit-agent-helper.socket is not a permanent solution, and is “unsafe”. Is this true, and why?
(3) Is unmasking it enough for things to be safe again?

[scotty65]

Welcome to the Manjaro community @Cauchy

@Cauchy

(1) Is there any way I can double check I have correctly unmasked the service and it’s back to normal?

To check which systemd units are masked:

systemctl list-unit-files --state=masked

To check the status of polkit-agent-helper.socket:

systemctl status polkit-agent-helper.socket

Note that, after unmasking polkit-agent-helper.socket, you should reboot the system. I just did a test masking & unmasking of it, and couldn’t do a transaction in Pamac’s GUI until I rebooted.

@Cauchy

(2) Other users mentioned that masking polkit-agent-helper.socket is not a permanent solution, and is “unsafe”. Is this true, and why?

According to DBus and Polkit Introduction | Blog:

When a Mechanism receives a request from a Subject, it calls methods on the org.freedesktop.PolicyKit1 interface to check permissions. The polkitd daemon evaluates these permissions based on predefined rules and actions provided by services. If user authentication is required, polkitd indirectly invokes an authentication agent through a helper binary.

This helper binary (/usr/lib/polkit-1/polkit-agent-helper-1) is a setuid root program that uses the PAM API to prompt the user for credentials and perform the authentication. Once the credentials are verified, polkitd receives the result from the agent and informs the Mechanism of the authorization outcome.

So masking polkit-agent-helper.socket interferes with that process. I assume it could allow unauthorised users to run privileged operations.

@Cauchy

(3) Is unmasking it enough for things to be safe again?

Yes. Just make sure you reboot after unmasking it. And stick with a recent kernel - linux66 and later won’t experience the polkit issue.

[Aragorn]

@scotty65

This helper binary (/usr/lib/polkit-1/polkit-agent-helper-1) is a setuid root program that uses the PAM API to prompt the user for credentials and perform the authentication.

The SUID bit is no longer required for kernels above 6.12, and it is actually better to not have it SUID. However, with kernels older than 6.12, one does need to have /usr/lib/polkit-1/polkit-agent-helper-1 SUID, or else it won’t work.