search

ctc-oss / fapolicy-analyzer

Tools to assist with the configuration and management of fapolicyd.
https://ctc-oss.github.io/fapolicy-analyzer
GNU General Public License v3.0
12 stars 5 forks source link

Extremely intermittent authentication issue. #906

Open tparchambault opened 1 year ago

tparchambault commented 1 year ago

This ticket is to capture an observed and known issue. The work-around is to send a SIGINT/Ctrl-C to terminate the registration attempts, and immediately attempt to invoke the fapolicy-analyzer again. I don't recall seeing two sequential invocation attempts failing.

I occasionally see the following dbus registration failure. Anecdotally, it has been observed <5% of the time. The issue may just be inherent in the underlying dbus implementation or its libraries, however it may be in the fapolicy-analyzer's wrapper script's interaction with the pkexec program and/or our use of the default authentication agent.

$ fapolicy-analyzer -a -v
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
^C
[toma@fedora Development]$ fapolicy-analyzer -a -v
pkttyagent registering on the dbus...
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ====
Authentication is needed to run `/usr/bin/env' as the super user
Authenticating as: Thomas Archambault (toma)
Password: 
==== AUTHENTICATION COMPLETE ====
 Creating '/var/log/fapolicy-analyzer'
tparchambault commented 11 months ago

Datapoint:

pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
pkttyagent registering on the dbus...
^C

Observed the issue again. Checked if there were any audit.log or journalctl -f messages during these dbus comm failures. No output messages observed unfortunately.