主页 / unix / 问题 / 749708
Accepted
Pablo A
Asked: 2023-06-24 12:33:15 +0800 CST

systemctl 挂起，调用挂起失败：访问被拒绝

  • 772

Ubuntu 20.04 最近更新后：

$ systemctl suspend
Call to Suspend failed: Access denied

几周前，这种方式工作得很好，没有任何 root 权限。

日记上：

dbus-daemon[1310]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.991" (uid=1000 pid=683426 comm="systemctl suspend " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")

从

“拒绝发送消息”在 dbus 中相当于“权限被拒绝”。权限被拒绝的原因取决于发送者、目的地、接口和成员。

简单的搜索返回的主要是与休眠相关的问题。一种方法（1 , 2）可能是将 NOPASSWD 添加到 sudoers 文件（不相同），但似乎是polkit问题。

哪些软件包更新会导致此行为？除了编辑 sudoer 文件之外，还有其他（也许更优雅）的解决方案吗？

编辑：

$ grep -ri org.freedesktop.login1.suspend /usr/share/polkit-1/
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend-multiple-sessions">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:                <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend-ignore-inhibit">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:                <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>

$ grep -i suspend /usr/share/dbus-1/system.d/org.freedesktop.login1.conf
                       send_member="Suspend"/>
                       send_member="SuspendThenHibernate"/>
                       send_member="CanSuspend"/>
                       send_member="CanSuspendThenHibernate"/>

由于某种原因，使用其他类似的普通用户systemctl suspend -i可以完美地工作。

也尝试过这个Result.YES。

使用busctl monitor：

‣ Type=error ...  Sender=org.freedesktop.DBus  Destination=:1.4594
  ErrorName=org.freedesktop.DBus.Error.AccessDenied  ErrorMessage="Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"
  MESSAGE "s" { STRING "Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"; };
systemd

2 个回答

  1. 尝试一下，sudo systemctl suspend因为您可能需要 root 权限。

    • 2
  2. Best Answer

    D总线

    检查是否有 dbus 策略/usr/share/dbus-1/system.d或/etc/dbus-1/system.d明确拒绝与org.freedesktop.login1系统暂停相关的成员的非特权访问。

    您可以使用以下策略来允许非特权用户调用org.freedesktop.login1.Manager.Suspend和org.freedesktop.login1.Manager.SuspendWithFlags

    <?xml version="1.0"?> <!--*-nxml-*-->
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
        "https://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
        <policy context="default">
                <allow send_destination="org.freedesktop.login1"
                       send_interface="org.freedesktop.login1.Manager"
                       send_member="Suspend"/>
 
                <allow send_destination="org.freedesktop.login1"
                       send_interface="org.freedesktop.login1.Manager"
                       send_member="SuspendWithFlags"/>
        </policy>
</busconfig>

    将此策略文件另存为/etc/dbus-1/system.d/org.freedesktop.login1.conf并使用 重新加载 dbus 守护程序systemctl reload dbus。

    波尔基特

    您可以添加以下规则以允许普通用户无需身份验证即可暂停系统。

    // vi: ft=javascript
Array.prototype.includes = function (variable) {
  for (var i = 0; i < this.length; i++) { if (this[i] === variable) return true; }
  return false;
}

polkit.addRule(function (action, subject) {
  if (
    [
      "org.freedesktop.login1.suspend",
      "org.freedesktop.login1.suspend-ignore-inhibit",
      "org.freedesktop.login1.suspend-multiple-sessions"
    ].includes(action.id) &&
    // Allow user named "user_name" or users in group "wheel" to suspend this system, 
    // Modify accordingly to suit your system    
    (subject.user == "user_name" || subject.isInGroup("wheel"))
  ) {
    return polkit.Result.YES;
  }
});

    将“user_name”更改为您的用户名

    将此规则保存为/etc/polkit-1/rules.d/01-suspend.rules，立即生效。

    • 2

相关问题