PolicyKit authentication agent changes

Kevin Kofler kevin.kofler at chello.at
Sat Feb 26 15:15:38 UTC 2011

Christoph Wickert wrote:
> Please try to look beyond the rim of your KDE teacup for a moment. What
> about the DEs / WMs that do not provide a polkit agent? Shouldn't we
> make things like virt-manager just work in *every* environment?

Well, the DEs which don't provide their own agent should pick one to require 

> We could even go one step further and question your approach: I need to
> use some KDE applications and due to the monolithic packaging I also
> need to install kdebase-workspace. But I never start KDE, so why am I
> forced to install a second polkit agent then? I have to admit that I
> don't know the answer to this question and requiring polkit-kde looks
> like the best solution because my situation is a corner case.

Well, the real problem there is some apps dragging in kdebase-workspace. In 
principle, libplasma having moved to kdelibs should have solved this, but 
there are still parts of Plasma in kdebase-workspace which get dragged in by 
some plasmoids (which indeed aren't always separately packaged), and there 
are also some other things in kdebase-workspace getting used by some stuff. 
This is quite unfortunate; IMHO, those libs should really move to kdelibs! 
Once we dragged in kdebase-workspace, you're already getting KWin, KDM, 
Plasma etc.; polkit-kde is just a drop in the water. :-(

> s/the/an. 'The' agent can only be used if there is one.

There should be exactly one which is supposed to run on the desktop you're 
using, otherwise you end up with #657006.

> Which basically means that you don't care about all DEs / WMs in Fedora
> being (more or less) broken because we cannot run many of our
> system-config-* tools there.

I do care. But I think it's their job to actually provide a complete 
environment (through external Requires if necessary), not the application's.

> Please take the time to read my initial proposal or my previous mail. I
> said that all agents *but* *one* should have OnlyShowIn. The remaining
> one gets "NotShowIn" to not conflict with the others. I suggested this
> one to be lxpolkit because it has only a few deps and will be pulled in
> by yum if all other providers match of because it's name.
> If anybody has a better idea, I am keen to hear it but so far nothing
> sounded convincing to me.

Actually, I don't see anything wrong with the idea of lxpolkit setting 
itself as the agent to run in all the non-GNOME non-KDE desktops, and the 
change mclasen did to polkit-gnome doesn't actually preclude that. (Quite 
the opposite, since there now isn't a second agent trying to run in the same 
desktops.) It's really up to the maintainers of the respective desktops and 
of lxpolkit to decide how they start the polkit agent. As long as your DEs 
actually Require lxpolkit, it doesn't matter whether the autostart file is 
carried in the DE or in lxpolkit itself. (FWIW, we have no plans to move 
polkit-kde's autostart file out of polkit-kde. It's OnlyShowIn=KDE; anyway, 
and the package is required by kdebase-workspace. I don't see a need to fix 
what's not broken.)

What I disagree with is the idea of applications being responsible for 
requiring such a desktop service. This just doesn't work, because they can't 
know which desktop's service should be dragged in.

        Kevin Kofler

More information about the devel mailing list