#1143635 polkitd: Forky - root auth for progs like gparted synaptic etc. only works once after a reboot

Package:
cinnamon
Source:
cinnamon
Description:
Innovative and comfortable desktop
Submitter:
Rolf Heinrichs
Date:
2026-08-16 21:35:02 UTC
Severity:
normal
Tags:
#1143635#5
Date:
2026-08-05 08:53:18 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?
Installation of forky from daily build 05.08.26, German localisation/keyboard, X11/Lightdm/Cinnamon DE in VBox

The root auth works once after reboot, the second call brings no popup auth window, ends in processes running in the background:
From ps -ax trying to start synaptic:
2638 ?        S      0:00 /bin/sh /usr/bin/synaptic-pkexec
2641 ?        Sl     0:00 pkexec /usr/sbin/synaptic

Installed polkit related packages:
apt list -i *polkit*
gir1.2-polkit-1.0/testing,now 127-3 amd64  [Installiert,automatisch]
libpolkit-agent-1-0/testing,now 127-3 amd64  [Installiert,automatisch]
libpolkit-gobject-1-0/testing,now 127-3 amd64  [Installiert,automatisch]
polkitd/testing,now 127-3 amd64  [Installiert,automatisch]

Thank you for looking at the issue.

Rolf
#1143635#10
Date:
2026-08-05 09:07:02 UTC
From:
To:
Hi,

	forgot to mention: the additional installation of the mate-
polkit fixes the issue for me.

Thanks, Rolf
#1143635#15
Date:
2026-08-05 11:10:20 UTC
From:
To:
Hi Rolf

Am 05.08.26 um 10:53 schrieb Rolf Heinrichs:
authentication agent. It prompts the user for authentication information.
Some desktop environments, like GNOME and Cinnamon, have that
functionality built into their desktop shell directly, some desktop
environments, like MATE use a dedicated binary for that.

Since you are running cinnamon, which has a builtin authentication
agent, I'm going to re-assign this bug report to this package.
Apparently it gets confused after the first authentication prompt.
Installing mate-polkit should not be necessary.

What I do notice is, that mate-polkit pulls in the accountsservice
package, which is not a dependency of cinnamon.
Could you try the following: uninstall mate-polkit(-common) again, but
keep accountsservice installed.
Does that fix the issue?
If so, cinnamon probably has an undeclared dependency on accountsservice
and it should either add a dependency on it or handle its absence.

Regards,
Michael
#1143635#24
Date:
2026-08-05 11:16:56 UTC
From:
To:
Am 05.08.26 um 13:10 schrieb Michael Biebl:

I pulled the sources for src:cinnamon and noticed the following:


js/ui/polkitAuthenticationAgent.js:        this._accountsService =
AccountsService.UserManager.get_default();

This quick check confirms that the cinnamon authentication agent
interacts with the AccountService daemon and it probably doesn't handle
the case properly when it's not installed/running.

Regards,
Michael
#1143635#29
Date:
2026-08-05 12:07:25 UTC
From:
To:
Hi Michael,

thanks for the fast feedback. 

I did "apt remove mate-polkit" followed by an "apt autoremove" to get
rid of mate-polkit-common, accountservice was left installed. 

Rebooted the VM: auth is possible more than once now. 

Looks like your suspicion that the authentication agent might be
missing is correct.

I guess fixing the dependency between cinnamon and accountservice does
the job.

Regards, Rolf
#1143635#34
Date:
2026-08-05 12:38:14 UTC
From:
To:
Hello,

In Linux Mint, cinnamon-control-center has a dependency on accountsservice.

apt show cinnamon-control-center

Package: cinnamon-control-center
Version: 6.6.0+zena
Priority: optional
Section: x11
Maintainer: Linux Mint <root@linuxmint.com>
Installed-Size: 1.119 kB
Depends: accountsservice, cinnamon-control-center-data (= 6.6.0+zena),
cinnamon-desktop-data (>= 4.8), desktop-file-utils, gettext,
libcinnamon-control-center1 (= 6.6.0+zena), xdg-utils, libatk1.0-0t64
(>= 1.12.4), libc6 (>= 2.34), libcairo2 (>= 1.10.0),
libcinnamon-menu-3-0 (>= 2.2.0), libcolord2 (>= 1.4.3),
libgdk-pixbuf-2.0-0 (>= 2.23.0), libglib2.0-0t64 (>= 2.79.0),
libgtk-3-0t64 (>= 3.21.5), libgudev-1.0-0 (>= 232), libmm-glib0 (>=
0.7.991), libnm0 (>= 1.2.0), libnma0 (>= 1.2.0), libnotify4 (>= 0.7.3),
libpango-1.0-0 (>= 1.14.0), libpolkit-gobject-1-0 (>= 0.103),
libupower-glib3 (>= 0.99.8), libwacom9 (>= 2.0.0), libx11-6, libxi6 (>=
2:1.2.99.4)
Recommends: cinnamon-l10n, mesa-utils
Suggests: x11-xserver-utils
Homepage: https://www.github.com/linuxmint/cinnamon-control-center
Download-Size: 225 kB
APT-Manual-Installed: yes
APT-Sources: https://fastly.linuxmint.io zena/backport amd64 Packages
Description: utilities to configure the Cinnamon desktop
  This package contains configuration applets for the Cinnamon desktop,
  allowing to set accessibility configuration, desktop fonts, keyboard
  and mouse properties, sound setup, desktop theme and background, user
  interface properties, screen resolution, and other Cinnamon parameters.

I don't see that same dependency in Debian Forky's cinnamon-control-center.


On another note, I just did a cinnamon desktop installation of daily
Forky and accountsservice did indeed not get installed. The only related
packages I see
are gir1.2-accountsservice-1.0 and libaccountsservice0.

I checked with
aptitude why accountsservice
and I saw the following:

task-cinnamon-desktop depends on cinnamon-desktop-environment
cinnamon-desktop-environment recommends yelp
yelp depends libwebkitgtk-6.0-4 (>=2.5.3)
libwebkitgtk-6.0-4 recommends xdg-desktop-portal-gtk
xdg-desktop-portal-gtk suggests accountsservice

I think cinnamon-control-center, like in Linux Mint, should have a
dependency on accountsservice to draw the package in.

Best regards,
Jeroen Diederen
#1143635#39
Date:
2026-08-05 20:52:09 UTC
From:
To:

Does cinnamon-control-center use accountsservice?

If so, yes it should get a dependency (or at least Recommends) on
accountsservice.

That said, cinnamon itself seems to use accountsservice, so I think the
package should get a direct dependency and not rely on another package
to pull this dependency in.

Regards,
Michael
#1143635#42
Date:
2026-08-05 20:51:12 UTC
From:
To:
Hello,

Bug #1143635 in cinnamon reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/cinnamon-team/cinnamon/-/commit/5080d34497c3a6f2429119c6b573d5a17a11d5a0
------------------------------------------------------------------------
d/control: add the missing accountsservice dependency to cinnamon

The polkit authentication agent (js/ui/polkitAuthenticationAgent.js),
the user@ and menu@ applets and the user settings modules all talk to
the org.freedesktop.Accounts D-Bus service, but only
gir1.2-accountsservice-1.0 was pulled in, which ships just the typelib
and the client library.

Without the accounts daemon the UserManager is still created, but every
user object stays unloaded, so the authentication dialog finds no
administrator and is never shown: pkexec just hangs in the background
with no way to authenticate.

The dependency belongs here and not to cinnamon-control-center: that
package no longer uses AccountsService, so it was correctly dropped from
its dependencies.

Closes: #1143635
Thanks: Rolf Heinrichs for the report and the testing, and Michael Biebl
for the analysis

Assisted-by: Claude Code:claude-opus-5
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143635
#1143635#49
Date:
2026-08-05 21:05:37 UTC
From:
To:
Il 05/08/2026 22:52, Michael Biebl ha scritto:
Hi, as you can see from the commit message that activated the pending
option, I added it in cinnamon.I verified that it's used and needed.
Only the gir package was in the dependencies, but that's not enough.
Unfortunately, I didn't notice it in the checks I did for missing
dependencies preparing 6.6 packages. Thanks for forwarding the report
and providing the details (thanks also to Jeroen
Diederen).accountsservice was a dependency of cinnamon-control-center,
but I removed it because it was no longer used. That was correct because
the part that used it had been removed.
#1143635#54
Date:
2026-08-16 21:33:56 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
cinnamon, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1143635@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Fabio Fantoni <fantonifabio@tiscali.it> (supplier of updated cinnamon package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 16 Aug 2026 23:20:26 +0200
Source: cinnamon
Built-For-Profiles: noudeb
Architecture: source
Version: 6.6.9-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Cinnamon Team <debian-cinnamon@lists.debian.org>
Changed-By: Fabio Fantoni <fantonifabio@tiscali.it>
Closes: 993152 1143635
Changes:
 cinnamon (6.6.9-2) unstable; urgency=medium
 .
   * d/control:
     - add the missing accountsservice dependency to cinnamon
       Thanks to Rolf Heinrichs and Michael Biebl (Closes: #1143635)
     - add cups-client to cinnamon recommends (Closes: #993152)
     - drop the unused cups-pk-helper dependency from cinnamon
Checksums-Sha1:
 ac6a268d56f1f30138fab2d53de2f1fe464bf451 2964 cinnamon_6.6.9-2.dsc
 afff0c918472cc1c66a26ee905522ea6e8e356dc 2623753 cinnamon_6.6.9.orig.tar.gz
 079915a7c92d764edfd1ffc48579d9da03fef2e0 106860 cinnamon_6.6.9-2.debian.tar.xz
 b041802219fcee9e7e2afdc449b11b84ea251dd1 9837 cinnamon_6.6.9-2_source.buildinfo
Checksums-Sha256:
 150b0699cc1df13ae6fb68760d41027eb753fb899cb6248a34f34711865416ae 2964 cinnamon_6.6.9-2.dsc
 9f58ddf2b798681ae463707a6e5fafd8de5fdbb187f8a34dc438cfb0d5b6fb6d 2623753 cinnamon_6.6.9.orig.tar.gz
 08c9d3669b1e528b37c27d2c75a1277017cf20dc929faa7441a97b1962e072e1 106860 cinnamon_6.6.9-2.debian.tar.xz
 52744cd0ac14b9e241c0ab3a9d40e564a5a7111d2ee73a87565425976bcd444b 9837 cinnamon_6.6.9-2_source.buildinfo
Files:
 bfcd014fa567a92e44d7b923a3b3fa15 2964 x11 optional cinnamon_6.6.9-2.dsc
 4c2614f706bbc39a0cfdddc472960418 2623753 x11 optional cinnamon_6.6.9.orig.tar.gz
 ad5a408d027793aee8a30e70bc783253 106860 x11 optional cinnamon_6.6.9-2.debian.tar.xz
 ebaf446f4b4909dda2b4b358ff08d8ce 9837 x11 optional cinnamon_6.6.9-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEELEHRfLe4S9D5+1GzaAZorpB/EB0FAmqCKecACgkQaAZorpB/
EB3wMRAAoQFfa7n3a8OboW5+rDT4RS1z9Qw3zvFmZgxKDEXx9KrhqMkjuadODtKp
nh0ZH8Tor6vagfHgn8tjw0prQTmSsrO6Mcx/EzGk6tUpdWRlZFZ1lhZoZlJprJSh
YzOQ8U5Qowlbvbdt7x9aAIJPFw6z2r0lb17Qkny+VQYicjgRMjSH5Us96kSQ0JKF
8KRFKJ7Jxp4r1FGnH7+iDUP5na98sZZ9mIhtWG//1N1C2jjuCCZzCqpsSepQjlma
2nPyUYYVxb+qgBrhquXNEWljPrmWA5bnmKOcURwuP82ZZmyvKuJsJVLAa3C6yVI9
nO2byDSkf+eRnbN1BO4FyE4mmB8g+32IN4O2UNqJGcZO8a1W7JRLM+91w7z1W8++
oKTWPDNArhJm8IFmxLXwMTgWUCePZyATpKNDOO9kn8nQqSqo+bQtJ54UE0TKfmOm
KdkrdHrgsYLS+/lGIpYkQchn3t/oPcjti/5qo+niPyJsRdJKXV/tJfwfpv2yaGnS
v7zgvLWIdeAwfljEIRLEWI5ZzpHTWlUWwChrEzRAlgK3Lb+riBwhdahcSHYDIQ29
o94QJAWwzI5EMe1Y1sjFvLvvq20nouuuwVOgEpEgMneX733A32llTg7V9lybf43x
QoqawXODEzAM3x058GLglz4OZsh2nKxoTevW1XihZk+Q0G5FVbQ=
=o8M6
-----END PGP SIGNATURE-----