KDE Discover shows a permissions dialog

Describe your issue

What's the expected behaviour?

KDE Discover has all permissions necessary to do updates. Just like it works in GNOME Software.

What's the current behaviour?

It shows a permissions dialog, where the user needs to type in their password.

How to reproduce your issue?

Run Discover on postmarketOS.

What device are you using?

pine64-pinephone

On what postmarketOS version did you encounter the issue?

• v21.03

On what environment did you encounter the issue?

Phone environments

• Plasma Mobile

How did you get postmarketOS image?

• from https://images.postmarketos.org
• I built it using pmbootstrap
• It was preinstalled on my device

What's the build date of the image? (in yyyy-mm-dd format)

20210329-0201-postmarketOS-v21.03-plasma-mobile-3.3-pine64-pinephone.img.xz

Also happens after installing updates from today.

Additional information

This is a postmarketOS specific bug, I just compared with Manjaro and there this doesn't happen there.

We can probably use the same mechanism as GNOME Software to fix this.

(I'm mentioning this in the Plasma Mobile wiki page so users are aware.)

CC: @PureTryOut, @minlexx

added release-v21.03 type::bug ui-plasma-mobile labels

changed the description

By Oliver Smith on 2021-03-31T00:47:16

Works as intended. Even updating apkindexes to show list of updates requires superuser access (not even talking about add/remove packages)

By Alexey Min on 2021-03-31T08:18:20

Agreed, I didn´t expect this to be mentioned as a bug as it´s just how apk works. You require superuser permissions for doing anything in apk that is not just getting info on something.

@ollieparanoid are you saying GNOME Software doesn´t require superuser access for this? How then?

By Bart Ribbers on 2021-03-31T08:18:20

This is achievable I think. According to the https://develop.kde.org/docs/kauth/#the-basic-actions-file you should be able to change Policy=auth_admin to Policy=yes (?) in org.kde.discover.alpineapkbackend.actions to allow privileged action without auth dialog. I'm just not sure it's the right thing to do

By Alexey Min on 2021-03-31T19:35:54

I guess to test this on a running system you'll need to modify /usr/share/polkit-1/actions/org.kde.discover.alpineapkbackend.policy (.actions file is somehow converted to plkit .policy?) and restart polkit (easier to reboot)

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
   <action id="org.kde.discover.alpineapkbackend.pkgmgmt" >
      <description>Package management</description>
      <message></message>
      <defaults>
         <allow_inactive>no</allow_inactive>
         <allow_active>auth_admin_keep</allow_active>
      </defaults>
   </action>
</policyconfig>

But it's unclear to me what the exact modification should be

P.S. Apparently it should look like

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
   <action id="org.kde.discover.alpineapkbackend.pkgmgmt" >
      <description>Package management</description>
      <message></message>
      <defaults>
         <allow_inactive>no</allow_inactive>
         <allow_active>yes</allow_active>
      </defaults>
   </action>
</policyconfig>

So to test on live system without rebuilding/reinstalling packages change

<allow_active>auth_admin_keep</allow_active>

to

<allow_active>yes</allow_active>

By Alexey Min on 2021-03-31T22:59:07

In my tests in virtualized env modifying /usr/share/polkit-1/actions/org.kde.discover.alpineapkbackend.policy changing

<allow_active>auth_admin_keep</allow_active>

to

<allow_active>yes</allow_active>

worked, I do not get password prompts when discover starts or when installing/removing packages

By Alexey Min on 2021-03-31T23:04:12

assigned to @minlexx

By Alexey Min on 2021-03-31T21:05:06

PureTryOut (matrix.org):
 Would it be possible to split it like that? Don't ask password for updating sources,
 but do ask it for actually updating and installing?

It is possible, would that be fine @ollieparanoid ? Keep in mind that even currently you have to type password only once per session

By Alexey Min on 2021-04-01T14:34:57

@ollieparanoid are you saying GNOME Software doesn´t require superuser access for this? How then?

GNOME software does not ask for a password during installation of updates. It works through polkit probably, as @minlexx found above.

Would it be possible to split it like that? Don't ask password for updating sources, but do ask it for actually updating and installing?

Some thoughts on that:

• GNOME software and KDE discover should behave consistently in postmarketOS
  • it would be nice if KDE discover in plasma mobile behaved the same across all distros, if we do it differently we should have a good reason.
• The password dialog of KDE discover in plasma mobile has bad usability right now, since the password is always numeric, a PIN, but the password dialog of discover assumes that any characters are allowed. This makes it confusing for the user.
• Having no password is obviously easiest for usability, it "just works", but of course we should also make sure that it doesn't bring any security issues.

@Cogitri, if you don't mind, what was your reasoning to make it not ask for a password at all with apk-polkit-rs?

By Oliver Smith on 2021-04-04T20:15:03

This should be fixed when plasma-5.22 upgrade lands upstream in Alpine repos

By Alexey Min on 2021-05-23T15:24:16

Resolved fixed

By Alexey Min on 2021-06-09T09:18:58

closed