GNU bug report logs - #48265
mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

Previous Next

Full log

Message #20 received at 48265 <at> debbugs.gnu.org (full text, mbox):

From: Christopher League <league <at> contrapunctus.net>
To: 48265 <at> debbugs.gnu.org
Subject: Authentication is needed to run mate-power-backlight-helper
Date: Fri, 6 Jun 2025 14:22:52 -0400

Hi, after a recent update, I am having the same authentication
issue with the brightness helper on the Mate desktop:

> Authentication is needed to run
> /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/
> mate-power-backlight-helper as the super user.

As noted previously on this bug report, the polkit
org.mate.power.policy file refers to an absolute store path.

But I think ultimately the problem may have to do with the fact that
mate-power-manager APPEARS TWICE in the system closure:

$ guix gc -R /gnu/store/2zf16...-system | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1
/gnu/store/a14gf...-mate-power-manager-1.28.1

The brightness function keys and the power-manager itself
attempt to invoke the 'ra8zy' path (and it's also in the
profile's sbin), but the polkit policy file permits only the 'a14gf'
path:

$ readlink -f (which mate-power-backlight-helper)
/gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/mate-power-backlight-helper

$ pkexec /gnu/store/a14gf...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Works perfectly

$ pkexec /gnu/store/ra8zy...-mate-power-manager-1.28.1/sbin/\
mate-power-backlight-helper --set-brightness 340
# Authentication error, same as pressing brightness buttons

Looking at gnu/services/desktop.scm and gnu/packages/mate.scm,
it's unclear to me why mate-polkit-extension would end up with a
different hash for mate-power-manager than the profile does.

The effect may be reproducible just from packages, without
needing to troubleshoot the services or system. What happens if
we build mate-power-manager vs the mate union package:

$ guix build mate-power-manager
/gnu/store/a14gf...-mate-power-manager-1.28.1

That's the one in polkit.

$ guix gc -R (guix build mate) | grep mate-power
/gnu/store/ra8zy...-mate-power-manager-1.28.1

And that's the one in the profile.

Why are they different? Does it have to do with using
union-build? Apparently a similar duplication happens with xfce,
though I don't know if it leads to the same authentication
errors:

$ guix gc -R /gnu/store/2zf16...-system | grep xfce4-power
/gnu/store/8mqna...-xfce4-power-manager-4.20.0
/gnu/store/jrflf...-xfce4-power-manager-4.20.0

The exact store paths used in these examples should be
reproducible from the following minimal configuration and
relatively recent commit:

;;; BEGIN configuration.scm
(use-modules
 (gnu bootloader)
 (gnu bootloader grub)
 (gnu system file-systems)
 (gnu services desktop))

(operating-system
  (host-name "mate-power-bug")
  (bootloader (bootloader-configuration (bootloader grub-bootloader)))
  (file-systems
   (cons (file-system
           (mount-point "/")
           (device "/dev/sda1")
           (type "ext4"))
         %base-file-systems))
  (services
   (cons (service mate-desktop-service-type)
         %desktop-services)))
;; END configuration.scm

$ guix time-machine -q --commit=ed5988f0d2cf14e3cc35a32e6ad91d7cbf535e2f\
  -- system build configuration.scm
/gnu/store/2zf16...-system

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.