Welcome
FAQ
Downloads
Wiki
Recent Posts31
TCE Bugs / Re: polkitd hardwired to user=tc?
« Last post by GNUser on December 18, 2025, 03:07:24 PM »What I'm actually trying to do is to figure out a way to use flatpak without the --user flag. It works in Devuan but not in TCL16 x86_64.
Does anyone think the following is worth investigating, or is it more trouble than it's worth? It seems that it's a problem with how flatpak interacts with dbus +/- polkit:
P.S. If I can figure this out, I will resubmit the flatpak extension so that the polkit rule looks for "staff" group rather than "wheel". But for my purposes right now it doesn't make a difference because my system has both groups and I'm part of both.
Does anyone think the following is worth investigating, or is it more trouble than it's worth? It seems that it's a problem with how flatpak interacts with dbus +/- polkit:
Code: [Select]
bruno@x230:~$ tce-load -wil flatpak
bruno@x230:~$ mkdir /home/tc
bruno@x230:~$ sudo /usr/local/etc/init.d/dbus start
starting dbus daemon...
bruno@x230:~$ sudo /usr/local/lib/polkit-1/polkitd &
Successfully changed to user tc
Error getting login monitor: -215:02:40.365: Loading rules from directory /usr/local/etc/polkit-1/rules.d
15:02:40.366: Loading rules from directory /usr/local/share/polkit-1/rules.d
15:02:40.366: Finished loading, compiling and executing 2 rules
Entering main event loop
Connected to the system bus
15:02:40.367: Acquired the name org.freedesktop.PolicyKit1 on the system bus
bruno@x230:~$ flatpak remote-add flathub https://flathub.org/repo/flathub.flatpakrepo
Note that the directories
'/var/local/lib/flatpak/exports/share'
'/home/bruno/.local/share/flatpak/exports/share'
are not in the search path set by the XDG_DATA_DIRS environment variable, so
applications installed by Flatpak may not appear on your desktop until the
session is restarted.
15:02:57.458: Registered Authentication Agent for unix-process:10702:25666 (system bus name :1.1 [flatpak remote-add flathub https://flathub.org/repo/flathub.flatpakrepo], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
15:02:57.488: Unregistered Authentication Agent for unix-process:10702:25666 (system bus name :1.1, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
error: Flatpak system operation EnsureRepo not allowed for userCode: [Select]
$ cat /usr/local/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules
polkit.addRule(function(action, subject) {
if ((action.id == "org.freedesktop.Flatpak.app-install" ||
action.id == "org.freedesktop.Flatpak.runtime-install"||
action.id == "org.freedesktop.Flatpak.app-uninstall" ||
action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
action.id == "org.freedesktop.Flatpak.modify-repo") &&
subject.active == true && subject.local == true &&
subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
return polkit.Result.NOT_HANDLED;
});
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.Flatpak.override-parental-controls") {
return polkit.Result.AUTH_ADMIN;
}
return polkit.Result.NOT_HANDLED;
});
$ id
uid=1000(bruno) gid=50(staff) groups=10(wheel),50(staff),1000(bruno)I'm in the "wheel" group so polkit should let me do flatpak things with the implied --system flag, right?P.S. If I can figure this out, I will resubmit the flatpak extension so that the polkit rule looks for "staff" group rather than "wheel". But for my purposes right now it doesn't make a difference because my system has both groups and I'm part of both.
