Subject: bug#48265: Authentication is needed to run mate-power-backlight-helper

From: Christopher League <[email-masked]>
Date: Fri, 6 Jun 2025 14:22:52 -0400

Hi, after a recent update, I am having the same authentication
issue with the brightness helper on the Mate desktop:

> Authentication is needed to run
> /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/
> mate-power-backlight-helper as the super user.

As noted previously on this bug report, the polkit
org.mate.power.policy file refers to an absolute store path.

But I think ultimately the problem may have to do with the fact that
mate-power-manager APPEARS TWICE in the system closure:

$ guix gc -R /gnu/store/2zf16...-system | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1
/gnu/store/a14gf...-mate-power-manager-1.28.1

The brightness function keys and the power-manager itself
attempt to invoke the 'ra8zy' path (and it's also in the
profile's sbin), but the polkit policy file permits only the 'a14gf'
path:

$ readlink -f (which mate-power-backlight-helper)
/gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/mate-power-backlight-helper

$ pkexec /gnu/store/a14gf...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Works perfectly

$ pkexec /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Authentication error, same as pressing brightness buttons

Looking at gnu/services/desktop.scm and gnu/packages/mate.scm,
it's unclear to me why mate-polkit-extension would end up with a
different hash for mate-power-manager than the profile does.

The effect may be reproducible just from packages, without
needing to troubleshoot the services or system. What happens if
we build mate-power-manager vs the mate union package:

$ guix build mate-power-manager
/gnu/store/a14gf...-mate-power-manager-1.28.1

That's the one in polkit.

$ guix gc -R (guix build mate) | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1

And that's the one in the profile.

Why are they different? Does it have to do with using
union-build? Apparently a similar duplication happens with xfce,
though I don't know if it leads to the same authentication
errors:

$ guix gc -R /gnu/store/2zf16...-system | grep xfce4-power
/gnu/store/8mqna...-xfce4-power-manager-4.20.0
/gnu/store/jrflf...-xfce4-power-manager-4.20.0

The exact store paths used in these examples should be
reproducible from the following minimal configuration and
relatively recent commit:

;;; BEGIN configuration.scm
(use-modules
  (gnu bootloader)
  (gnu bootloader grub)
  (gnu system file-systems)
  (gnu services desktop))

(operating-system
   (host-name "mate-power-bug")
   (bootloader (bootloader-configuration (bootloader grub-bootloader)))
   (file-systems
    (cons (file-system
            (mount-point "/")
            (device "/dev/sda1")
            (type "ext4"))
          %base-file-systems))
   (services
    (cons (service mate-desktop-service-type)
          %desktop-services)))
;; END configuration.scm

$ guix time-machine -q --commit=ed5988f0d2cf14e3cc35a32e6ad91d7cbf535e2f\
   -- system build configuration.scm
/gnu/store/2zf16...-system