VNC permission forwarding with CentOS 7

Question

So I'm running into another strange issue on CentOS 7.

I have vncserver installed as a systemd service, running as my normal non-privileged user.

There are a couple processes that don't prompt me for the root password as they should: yumex and "Disk Management".

When I open Disk Management, instead of getting a password prompt, I just see "There are no filesystems which are allowed to mount or unmount. Contact your administrator."

When I run yumex, I get: Fatal error: polkit-not-autherized (yes, it says autherized, spelled wrong...) "Could not get polkit autherisation to start backend Yum Extender will terminate"

I've done some research on this issue, and the only solution is to run: su -c 'yumex --root' And then put the root password in there. But I hate having to type that every time I want to run it. It's supposed to prompt.

I can confirm this is ONLY a problem when using VNC. If I use the local console, both of those programs do ask me for the root password and work correctly.

What is strange about this is that most other programs do work correctly. GParted asks for root password, among other things. It's just these particular ones.

Any ideas how to fix this? I'm using MATE rather than GNOME3, for what it's worth.

Answer 1

This is because yumex enforces that polkit interactive password authentication can only be done at physical consoles and not remotely:

https://github.com/timlau/yumex/blob/3a0f2830e42d43a83d2dc803cc2c3c119dfa1687/misc/dk.yumex.backend.policy.in#L15

Documentation on polkit actions:

https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html

To change the default behavior and enable running yumex authorized by polkit from a VNC session edit

/usr/share/polkit-1/actions/dk.yumex.backend.policy

and change

<allow_any>no</allow_any>

to

<allow_any>auth_admin</allow_any>

It should take effect immediately.