[PATCH 1/5] polkit: add polkit as a required distro feature

[PATCH 1/5] polkit: add polkit as a required distro feature

[Stefan Agner]

From: Stefan Agner <stefan.agner@toradex.com>

Make sure polkit is in DISTRO_FEATURERS if this package is being
installed. This will make sure that people who do use polkit in
their image also do enabled the recently introduced distro feature
polkit in their distro.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
---
 meta-oe/recipes-extended/polkit/polkit_0.115.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-oe/recipes-extended/polkit/polkit_0.115.bb b/meta-oe/recipes-extended/polkit/polkit_0.115.bb
index ad0f66a5e..90c2fb152 100644
--- a/meta-oe/recipes-extended/polkit/polkit_0.115.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_0.115.bb
@@ -9,6 +9,8 @@ DEPENDS = "expat glib-2.0 intltool-native mozjs"
 
 inherit autotools gtk-doc pkgconfig useradd systemd gobject-introspection
 
+REQUIRED_DISTRO_FEATURES = "polkit"
+
 PACKAGECONFIG = "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)} \
                  ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', \
                     bb.utils.contains('DISTRO_FEATURES', 'x11', 'consolekit', '', d), d)} \
-- 
2.13.6

[PATCH 2/5] networkmanager: introduce polkit package config

[Stefan Agner]

From: Stefan Agner <stefan.agner@toradex.com>

Currently polkit is enabled if systemd is in package config. Those
two things are orthogonal: NetworkManager can be used with systemd
and without polkit just fine.

Introduce a new polkit package config and enable it depending on
whether polkit is in DISTRO_FEATURES.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
---
 .../recipes-connectivity/networkmanager/networkmanager_1.14.4.bb   | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.14.4.bb b/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.14.4.bb
index 870a52814..f1826c68e 100644
--- a/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.14.4.bb
+++ b/meta-networking/recipes-connectivity/networkmanager/networkmanager_1.14.4.bb
@@ -16,7 +16,6 @@ DEPENDS = " \
     util-linux \
     libndp \
     libnewt \
-    polkit \
     jansson \
     curl \
 "
@@ -69,13 +68,13 @@ do_compile_prepend() {
 PACKAGECONFIG ??= "nss ifupdown dhclient dnsmasq \
     ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', bb.utils.contains('DISTRO_FEATURES', 'x11', 'consolekit', '', d), d)} \
     ${@bb.utils.contains('DISTRO_FEATURES', 'bluetooth', '${BLUEZ}', '', d)} \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'wifi', d)} \
+    ${@bb.utils.filter('DISTRO_FEATURES', 'wifi polkit', d)} \
 "
 PACKAGECONFIG[systemd] = " \
-    --with-systemdsystemunitdir=${systemd_unitdir}/system --with-session-tracking=systemd --enable-polkit, \
+    --with-systemdsystemunitdir=${systemd_unitdir}/system --with-session-tracking=systemd, \
     --without-systemdsystemunitdir, \
-    polkit \
 "
+PACKAGECONFIG[polkit] = "--enable-polkit --enable-polkit-agent,--disable-polkit --disable-polkit-agent,polkit"
 PACKAGECONFIG[bluez5] = "--enable-bluez5-dun,--disable-bluez5-dun,bluez5"
 # consolekit is not picked by shlibs, so add it to RDEPENDS too
 PACKAGECONFIG[consolekit] = "--with-session-tracking=consolekit,,consolekit,consolekit"
-- 
2.13.6

[PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Stefan Agner]

From: Stefan Agner <stefan.agner@toradex.com>

systemd and polkit are not directly related. It is just fine to build
with systemd but without polkit. Rename the systemd package config
to polkit and enable it depending on whether polkit is enabled in
DISTRO_FEATURES.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
---
 .../recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
index ed117b0a6..1cdcb4160 100644
--- a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
+++ b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
@@ -20,8 +20,8 @@ EXTRA_OECONF = " \
     --enable-panel-plugins \
 "
 
-PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
-PACKAGECONFIG[systemd] = "--enable-polkit, --disable-polkit, polkit"
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'polkit', d)}"
+PACKAGECONFIG[polkit] = "--enable-polkit, --disable-polkit, polkit"
 
 PACKAGES += "xfce4-powermanager-plugin"
 
-- 
2.13.6

[PATCH 4/5] packagegroup-meta-oe: add polkit depending on distro feature

[Stefan Agner]

From: Stefan Agner <stefan.agner@toradex.com>

Add polkit and related packages depending on whether polkit is
enabled in DISTRO_FEATURES.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
---
 meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
index 62f1c7759..1ec649355 100644
--- a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
+++ b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
@@ -136,8 +136,7 @@ RDEPENDS_packagegroup-meta-oe-extended ="\
     libpwquality libqb libuio \
     lockfile-progs logwatch lprng mailx md5deep \
     mozjs mraa nana nicstat \
-    p7zip p8platform libfile-fnmatch-perl polkit \
-    polkit-group-rule-datetime polkit-group-rule-network \
+    p7zip p8platform libfile-fnmatch-perl \
     rarpd redis rrdtool libfastjson librelp rsyslog sanlock \
     sblim-cmpi-devel sblim-sfc-common sblim-sfcc \
     scsirastools sgpio smartmontools snappy can-isotp \
@@ -148,6 +147,8 @@ RDEPENDS_packagegroup-meta-oe-extended ="\
     ${@bb.utils.contains("DISTRO_FEATURES", "bluez", "collectd", "", d)} \
     ${@bb.utils.contains("DISTRO_FEATURES", "pam", "pam-plugin-ccreds pam-plugin-ldapdb", "", d)} \
     ${@bb.utils.contains("DISTRO_FEATURES", "pam", "pam-ssh-agent-auth openwsman sblim-sfcb ", "", d)} \
+    ${@bb.utils.contains("DISTRO_FEATURES", "polkit", "polkit polkit-group-rule-datetime ", "", d)} \
+    ${@bb.utils.contains("DISTRO_FEATURES", "polkit", "polkit-group-rule-network ", "", d)} \
     ${@bb.utils.contains("BBPATH", "meta-python", "openlmi-tools", "", d)} \
     "
 RDEPENDS_packagegroup-meta-oe-extended_remove_mipsarch = "upm mraa tiptop"
-- 
2.13.6

[PATCH 5/5] modemmanager: enable polkit depending on distro feature

[Stefan Agner]

From: Stefan Agner <stefan.agner@toradex.com>

Enable the polkit package config depending on whether polkit is
enabled in DISTRO_FEATURES.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
---
 meta-oe/recipes-connectivity/modemmanager/modemmanager_1.8.2.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta-oe/recipes-connectivity/modemmanager/modemmanager_1.8.2.bb b/meta-oe/recipes-connectivity/modemmanager/modemmanager_1.8.2.bb
index b374cb77a..f9b302a3d 100644
--- a/meta-oe/recipes-connectivity/modemmanager/modemmanager_1.8.2.bb
+++ b/meta-oe/recipes-connectivity/modemmanager/modemmanager_1.8.2.bb
@@ -21,8 +21,8 @@ SRC_URI[sha256sum] = "96f2a5f0ed15532b4c4c185b756fdc0326e7c2027cea26a1264f91e098
 
 S = "${WORKDIR}/ModemManager-${PV}"
 
-PACKAGECONFIG ??= "mbim qmi polkit \
-    ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
+PACKAGECONFIG ??= "mbim qmi \
+    ${@bb.utils.filter('DISTRO_FEATURES', 'systemd polkit', d)} \
 "
 
 PACKAGECONFIG[systemd] = "--with-systemdsystemunitdir=${systemd_unitdir}/system/,,"
-- 
2.13.6

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Andreas Müller]

On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
Hi Stefan,

sorry but don't like this patch as is:
>
> From: Stefan Agner <stefan.agner@toradex.com>
>
> Currently polkit is enabled if systemd is in package config. Those
> two things are orthogonal: NetworkManager can be used with systemd
> and without polkit just fine.
Did you test this (=change networkmanager connections settings) as an
unpriviledged user?
>
> Introduce a new polkit package config and enable it depending on
> whether polkit is in DISTRO_FEATURES.

* it changes the current behaviour and the default suggested by
configure.ac: 'we usually compile with polkit support.' and
meson.build sets polkit by default.
* as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.

I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
- if you don't want polkit you can add a PACKAGECONFIG_remove =
"polkit" somewhere.

Andreas

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Andreas Müller]

On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>
> From: Stefan Agner <stefan.agner@toradex.com>
>
> systemd and polkit are not directly related. It is just fine to build
> with systemd but without polkit.
Surely it builds but is it still usable as unpriviledged user?

Andreas
> Rename the systemd package config
> to polkit and enable it depending on whether polkit is enabled in
> DISTRO_FEATURES.
>
> Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
> ---
>  .../recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb     | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
> index ed117b0a6..1cdcb4160 100644
> --- a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
> +++ b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
> @@ -20,8 +20,8 @@ EXTRA_OECONF = " \
>      --enable-panel-plugins \
>  "
>
> -PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
> -PACKAGECONFIG[systemd] = "--enable-polkit, --disable-polkit, polkit"
> +PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'polkit', d)}"
> +PACKAGECONFIG[polkit] = "--enable-polkit, --disable-polkit, polkit"
>
>  PACKAGES += "xfce4-powermanager-plugin"
>
> --
> 2.13.6
>
> --
> _______________________________________________
> Openembedded-devel mailing list
> Openembedded-devel@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-devel

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Stefan Agner]

On 17.01.2019 18:53, Andreas Müller wrote:
> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>>
>> From: Stefan Agner <stefan.agner@toradex.com>
>>
>> systemd and polkit are not directly related. It is just fine to build
>> with systemd but without polkit.
> Surely it builds but is it still usable as unpriviledged user?

TBH, I don't know, did not run XFCE.

If it is unusable, we probably should not make it an option anyway? Just
enable it always and make polkit a fixed dependency?

--
Stefan

> 
> Andreas
>> Rename the systemd package config
>> to polkit and enable it depending on whether polkit is enabled in
>> DISTRO_FEATURES.
>>
>> Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
>> ---
>>  .../recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb     | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>> index ed117b0a6..1cdcb4160 100644
>> --- a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>> +++ b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>> @@ -20,8 +20,8 @@ EXTRA_OECONF = " \
>>      --enable-panel-plugins \
>>  "
>>
>> -PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
>> -PACKAGECONFIG[systemd] = "--enable-polkit, --disable-polkit, polkit"
>> +PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'polkit', d)}"
>> +PACKAGECONFIG[polkit] = "--enable-polkit, --disable-polkit, polkit"
>>
>>  PACKAGES += "xfce4-powermanager-plugin"
>>
>> --
>> 2.13.6
>>
>> --
>> _______________________________________________
>> Openembedded-devel mailing list
>> Openembedded-devel@lists.openembedded.org
>> http://lists.openembedded.org/mailman/listinfo/openembedded-devel

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Stefan Agner]

On 17.01.2019 18:50, Andreas Müller wrote:
> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
> Hi Stefan,
> 
> sorry but don't like this patch as is:
>>
>> From: Stefan Agner <stefan.agner@toradex.com>
>>
>> Currently polkit is enabled if systemd is in package config. Those
>> two things are orthogonal: NetworkManager can be used with systemd
>> and without polkit just fine.
> Did you test this (=change networkmanager connections settings) as an
> unpriviledged user?

Works as expected: need to be root to change connection settings :-)

We plan to use D-Bus and D-Bus policies (<policy> tags) to allow some
settings to unpriviledged users/groups.

>>
>> Introduce a new polkit package config and enable it depending on
>> whether polkit is in DISTRO_FEATURES.
> 
> * it changes the current behaviour and the default suggested by
> configure.ac: 'we usually compile with polkit support.' and
> meson.build sets polkit by default.

Yes, this changes default behavior. I did not do that lightly, but I
think it is sensible to have a global policy on polkit, and also let
NetworkManager follow it. I guess the change in default behavior needs
to be pointed out in the documentation e.g. in the chapter "Moving to
the Yocto Project 2.7 Release".

Throughout OpenEmbedded we had vastly different behavior wrt polkit.
ConnMan disables it by default without any option to enable it. Quite
some packages make it dependent on systemd, some have just a local
package config polkit etc...

We have a WiFi capable headless device with restricted flash and would
like to use NetworkManager. Using polkit pulls in mozjs, which is rather
large. We do not need interactive authentication capabilities, since our
device does not allow direct user interaction...


> * as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.

Hm, yes, we definitely should add polkit. How can I do this?

> 
> I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
> - if you don't want polkit you can add a PACKAGECONFIG_remove =
> "polkit" somewhere.

Yes, I know that. We had this in place so far.

However, rather than having a bunch of PACKAGECONFIG, I'd rather have a
distro wide policy on polkit. I did send an email to oe-core with a
cover letter, and since that patch got merged, I was assuming that
polkit as a distro policy is the way to go.
http://lists.openembedded.org/pipermail/openembedded-core/2019-January/278021.html

--
Stefan

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Andreas Müller]

On Thu, Jan 17, 2019 at 8:09 PM Stefan Agner <stefan@agner.ch> wrote:
>
> On 17.01.2019 18:50, Andreas Müller wrote:
> > On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
> > Hi Stefan,
> >
> > sorry but don't like this patch as is:
> >>
> >> From: Stefan Agner <stefan.agner@toradex.com>
> >>
> >> Currently polkit is enabled if systemd is in package config. Those
> >> two things are orthogonal: NetworkManager can be used with systemd
> >> and without polkit just fine.
> > Did you test this (=change networkmanager connections settings) as an
> > unpriviledged user?
>
> Works as expected: need to be root to change connection settings :-)
>
> We plan to use D-Bus and D-Bus policies (<policy> tags) to allow some
> settings to unpriviledged users/groups.
>
> >>
> >> Introduce a new polkit package config and enable it depending on
> >> whether polkit is in DISTRO_FEATURES.
> >
> > * it changes the current behaviour and the default suggested by
> > configure.ac: 'we usually compile with polkit support.' and
> > meson.build sets polkit by default.
>
> Yes, this changes default behavior. I did not do that lightly, but I
> think it is sensible to have a global policy on polkit, and also let
> NetworkManager follow it. I guess the change in default behavior needs
> to be pointed out in the documentation e.g. in the chapter "Moving to
> the Yocto Project 2.7 Release".
>
> Throughout OpenEmbedded we had vastly different behavior wrt polkit.
> ConnMan disables it by default without any option to enable it. Quite
> some packages make it dependent on systemd, some have just a local
> package config polkit etc...
>
> We have a WiFi capable headless device with restricted flash and would
> like to use NetworkManager. Using polkit pulls in mozjs, which is rather
> large. We do not need interactive authentication capabilities, since our
> device does not allow direct user interaction...
>
>
> > * as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.
>
> Hm, yes, we definitely should add polkit. How can I do this?
>
> >
> > I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
> > - if you don't want polkit you can add a PACKAGECONFIG_remove =
> > "polkit" somewhere.
>
> Yes, I know that. We had this in place so far.
>
> However, rather than having a bunch of PACKAGECONFIG, I'd rather have a
> distro wide policy on polkit. I did send an email to oe-core with a
> cover letter, and since that patch got merged, I was assuming that
> polkit as a distro policy is the way to go.
> http://lists.openembedded.org/pipermail/openembedded-core/2019-January/278021.html
>
Am aware of what you want: Reduce image size.
Still don't like changing defaults because settings cannot be changed
by unprivileged users (and machines connected to network should not
run as root and this is what might be the consequence for lazy
people). And this would be another OE/Yocto default many other distros
don't have. BTW: The connection to systemd DISTRO_FEATURE was
introduced by me and there was a reason for it - but I don't remember
- it is long time ago and maybe it is not necessary any more.

How about inverting the logic: As long as no 'extra-setting' is done,
polkit is enabled by default (as suggested by the packets). Would a
DISTRO feature 'no-polkit' be something you could reach your target?

Andreas

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Andreas Müller]

On Thu, Jan 17, 2019 at 8:09 PM Stefan Agner <stefan@agner.ch> wrote:
>
> On 17.01.2019 18:50, Andreas Müller wrote:
> > On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
> > Hi Stefan,
> >
> > sorry but don't like this patch as is:
> >>
> >> From: Stefan Agner <stefan.agner@toradex.com>
> >>
> >> Currently polkit is enabled if systemd is in package config. Those
> >> two things are orthogonal: NetworkManager can be used with systemd
> >> and without polkit just fine.
> > Did you test this (=change networkmanager connections settings) as an
> > unpriviledged user?
>
> Works as expected: need to be root to change connection settings :-)
>
> We plan to use D-Bus and D-Bus policies (<policy> tags) to allow some
> settings to unpriviledged users/groups.
>
> >>
> >> Introduce a new polkit package config and enable it depending on
> >> whether polkit is in DISTRO_FEATURES.
> >
> > * it changes the current behaviour and the default suggested by
> > configure.ac: 'we usually compile with polkit support.' and
> > meson.build sets polkit by default.
>
> Yes, this changes default behavior. I did not do that lightly, but I
> think it is sensible to have a global policy on polkit, and also let
> NetworkManager follow it. I guess the change in default behavior needs
> to be pointed out in the documentation e.g. in the chapter "Moving to
> the Yocto Project 2.7 Release".
>
> Throughout OpenEmbedded we had vastly different behavior wrt polkit.
> ConnMan disables it by default without any option to enable it. Quite
> some packages make it dependent on systemd, some have just a local
> package config polkit etc...
>
> We have a WiFi capable headless device with restricted flash and would
> like to use NetworkManager. Using polkit pulls in mozjs, which is rather
> large. We do not need interactive authentication capabilities, since our
> device does not allow direct user interaction...
>
>
> > * as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.
>
> Hm, yes, we definitely should add polkit. How can I do this?
>
> >
> > I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
> > - if you don't want polkit you can add a PACKAGECONFIG_remove =
> > "polkit" somewhere.
>
> Yes, I know that. We had this in place so far.
>
> However, rather than having a bunch of PACKAGECONFIG, I'd rather have a
> distro wide policy on polkit. I did send an email to oe-core with a
> cover letter, and since that patch got merged, I was assuming that
> polkit as a distro policy is the way to go.
> http://lists.openembedded.org/pipermail/openembedded-core/2019-January/278021.html
>
Ahh - I see am too late in the game - decision was already made - go
on and forget my last email.

Andreas

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Stefan Agner]

On 17.01.2019 21:01, Andreas Müller wrote:
> On Thu, Jan 17, 2019 at 8:09 PM Stefan Agner <stefan@agner.ch> wrote:
>>
>> On 17.01.2019 18:50, Andreas Müller wrote:
>> > On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>> > Hi Stefan,
>> >
>> > sorry but don't like this patch as is:
>> >>
>> >> From: Stefan Agner <stefan.agner@toradex.com>
>> >>
>> >> Currently polkit is enabled if systemd is in package config. Those
>> >> two things are orthogonal: NetworkManager can be used with systemd
>> >> and without polkit just fine.
>> > Did you test this (=change networkmanager connections settings) as an
>> > unpriviledged user?
>>
>> Works as expected: need to be root to change connection settings :-)
>>
>> We plan to use D-Bus and D-Bus policies (<policy> tags) to allow some
>> settings to unpriviledged users/groups.
>>
>> >>
>> >> Introduce a new polkit package config and enable it depending on
>> >> whether polkit is in DISTRO_FEATURES.
>> >
>> > * it changes the current behaviour and the default suggested by
>> > configure.ac: 'we usually compile with polkit support.' and
>> > meson.build sets polkit by default.
>>
>> Yes, this changes default behavior. I did not do that lightly, but I
>> think it is sensible to have a global policy on polkit, and also let
>> NetworkManager follow it. I guess the change in default behavior needs
>> to be pointed out in the documentation e.g. in the chapter "Moving to
>> the Yocto Project 2.7 Release".
>>
>> Throughout OpenEmbedded we had vastly different behavior wrt polkit.
>> ConnMan disables it by default without any option to enable it. Quite
>> some packages make it dependent on systemd, some have just a local
>> package config polkit etc...
>>
>> We have a WiFi capable headless device with restricted flash and would
>> like to use NetworkManager. Using polkit pulls in mozjs, which is rather
>> large. We do not need interactive authentication capabilities, since our
>> device does not allow direct user interaction...
>>
>>
>> > * as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.
>>
>> Hm, yes, we definitely should add polkit. How can I do this?
>>
>> >
>> > I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
>> > - if you don't want polkit you can add a PACKAGECONFIG_remove =
>> > "polkit" somewhere.
>>
>> Yes, I know that. We had this in place so far.
>>
>> However, rather than having a bunch of PACKAGECONFIG, I'd rather have a
>> distro wide policy on polkit. I did send an email to oe-core with a
>> cover letter, and since that patch got merged, I was assuming that
>> polkit as a distro policy is the way to go.
>> http://lists.openembedded.org/pipermail/openembedded-core/2019-January/278021.html
>>
> Ahh - I see am too late in the game - decision was already made - go
> on and forget my last email.

Probably should have sent out this patch set changing meta-oe stuff at
the same time to get the broader overview, sorry about that.

NetworkManager is really the most drastic change here, since this is a
prominent package where the change changes the current default. So if
you have any suggestion to ease the transition, I am happy to look into
it.

--
Stefan

Re: [PATCH 2/5] networkmanager: introduce polkit package config

[Andreas Müller]

On Thu, Jan 17, 2019 at 9:18 PM Stefan Agner <stefan@agner.ch> wrote:
>
> On 17.01.2019 21:01, Andreas Müller wrote:
> > On Thu, Jan 17, 2019 at 8:09 PM Stefan Agner <stefan@agner.ch> wrote:
> >>
> >> On 17.01.2019 18:50, Andreas Müller wrote:
> >> > On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
> >> > Hi Stefan,
> >> >
> >> > sorry but don't like this patch as is:
> >> >>
> >> >> From: Stefan Agner <stefan.agner@toradex.com>
> >> >>
> >> >> Currently polkit is enabled if systemd is in package config. Those
> >> >> two things are orthogonal: NetworkManager can be used with systemd
> >> >> and without polkit just fine.
> >> > Did you test this (=change networkmanager connections settings) as an
> >> > unpriviledged user?
> >>
> >> Works as expected: need to be root to change connection settings :-)
> >>
> >> We plan to use D-Bus and D-Bus policies (<policy> tags) to allow some
> >> settings to unpriviledged users/groups.
> >>
> >> >>
> >> >> Introduce a new polkit package config and enable it depending on
> >> >> whether polkit is in DISTRO_FEATURES.
> >> >
> >> > * it changes the current behaviour and the default suggested by
> >> > configure.ac: 'we usually compile with polkit support.' and
> >> > meson.build sets polkit by default.
> >>
> >> Yes, this changes default behavior. I did not do that lightly, but I
> >> think it is sensible to have a global policy on polkit, and also let
> >> NetworkManager follow it. I guess the change in default behavior needs
> >> to be pointed out in the documentation e.g. in the chapter "Moving to
> >> the Yocto Project 2.7 Release".
> >>
> >> Throughout OpenEmbedded we had vastly different behavior wrt polkit.
> >> ConnMan disables it by default without any option to enable it. Quite
> >> some packages make it dependent on systemd, some have just a local
> >> package config polkit etc...
> >>
> >> We have a WiFi capable headless device with restricted flash and would
> >> like to use NetworkManager. Using polkit pulls in mozjs, which is rather
> >> large. We do not need interactive authentication capabilities, since our
> >> device does not allow direct user interaction...
> >>
> >>
> >> > * as far as I know there is no polkit DISTRO_FEATURE in metaverse yet.
> >>
> >> Hm, yes, we definitely should add polkit. How can I do this?
> >>
> >> >
> >> > I suggest to add polkit PACKAGECONFIG if systemd is in DISTRO_FEATURES
> >> > - if you don't want polkit you can add a PACKAGECONFIG_remove =
> >> > "polkit" somewhere.
> >>
> >> Yes, I know that. We had this in place so far.
> >>
> >> However, rather than having a bunch of PACKAGECONFIG, I'd rather have a
> >> distro wide policy on polkit. I did send an email to oe-core with a
> >> cover letter, and since that patch got merged, I was assuming that
> >> polkit as a distro policy is the way to go.
> >> http://lists.openembedded.org/pipermail/openembedded-core/2019-January/278021.html
> >>
> > Ahh - I see am too late in the game - decision was already made - go
> > on and forget my last email.
>
> Probably should have sent out this patch set changing meta-oe stuff at
> the same time to get the broader overview, sorry about that.
>
> NetworkManager is really the most drastic change here, since this is a
> prominent package where the change changes the current default. So if
> you have any suggestion to ease the transition, I am happy to look into
> it.
>
TBH: I haven't the time to take care for a use case I never had until
now. I'll just add polkit to my DISTRO_FEATURES and hope to get same
as before.

Andreas

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Randy MacLeod]

On 1/17/19 1:39 PM, Stefan Agner wrote:
> On 17.01.2019 18:53, Andreas Müller wrote:
>> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>>>
>>> From: Stefan Agner <stefan.agner@toradex.com>
>>>
>>> systemd and polkit are not directly related. It is just fine to build
>>> with systemd but without polkit.
>> Surely it builds but is it still usable as unpriviledged user?
> 
> TBH, I don't know, did not run XFCE.

We do! :)

> 
> If it is unusable, we probably should not make it an option anyway? Just
> enable it always and make polkit a fixed dependency?

Grace,
Please apply this series of patches and check if
xfce4-power-manager is usable as an unprivileged user?

../Randy

> 
> --
> Stefan
> 
>>
>> Andreas
>>> Rename the systemd package config
>>> to polkit and enable it depending on whether polkit is enabled in
>>> DISTRO_FEATURES.
>>>
>>> Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
>>> ---
>>>   .../recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb     | 4 ++--
>>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>>> index ed117b0a6..1cdcb4160 100644
>>> --- a/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>>> +++ b/meta-xfce/recipes-xfce/xfce4-power-manager/xfce4-power-manager_1.6.1.bb
>>> @@ -20,8 +20,8 @@ EXTRA_OECONF = " \
>>>       --enable-panel-plugins \
>>>   "
>>>
>>> -PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
>>> -PACKAGECONFIG[systemd] = "--enable-polkit, --disable-polkit, polkit"
>>> +PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'polkit', d)}"
>>> +PACKAGECONFIG[polkit] = "--enable-polkit, --disable-polkit, polkit"
>>>
>>>   PACKAGES += "xfce4-powermanager-plugin"
>>>
>>> --
>>> 2.13.6
>>>
>>> --
>>> _______________________________________________
>>> Openembedded-devel mailing list
>>> Openembedded-devel@lists.openembedded.org
>>> http://lists.openembedded.org/mailman/listinfo/openembedded-devel


-- 
# Randy MacLeod
# Wind River Linux

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Khem Raj]

On Thu, Jan 17, 2019 at 4:30 PM Randy MacLeod
<randy.macleod@windriver.com> wrote:
>
> On 1/17/19 1:39 PM, Stefan Agner wrote:
> > On 17.01.2019 18:53, Andreas Müller wrote:
> >> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
> >>>
> >>> From: Stefan Agner <stefan.agner@toradex.com>
> >>>
> >>> systemd and polkit are not directly related. It is just fine to build
> >>> with systemd but without polkit.
> >> Surely it builds but is it still usable as unpriviledged user?
> >
> > TBH, I don't know, did not run XFCE.
>
> We do! :)
>
> >
> > If it is unusable, we probably should not make it an option anyway? Just
> > enable it always and make polkit a fixed dependency?
>
> Grace,
> Please apply this series of patches and check if
> xfce4-power-manager is usable as an unprivileged user?

Thanks for testing it out, I will wait to hear from you

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Yu, Mingli]

On 2019年01月21日 02:07, Khem Raj wrote:
> On Thu, Jan 17, 2019 at 4:30 PM Randy MacLeod
> <randy.macleod@windriver.com> wrote:
>>
>> On 1/17/19 1:39 PM, Stefan Agner wrote:
>>> On 17.01.2019 18:53, Andreas Müller wrote:
>>>> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>>>>>
>>>>> From: Stefan Agner <stefan.agner@toradex.com>
>>>>>
>>>>> systemd and polkit are not directly related. It is just fine to build
>>>>> with systemd but without polkit.
>>>> Surely it builds but is it still usable as unpriviledged user?
>>>
>>> TBH, I don't know, did not run XFCE.
>>
>> We do! :)
>>
>>>
>>> If it is unusable, we probably should not make it an option anyway? Just
>>> enable it always and make polkit a fixed dependency?
>>
>> Grace,
>> Please apply this series of patches and check if
>> xfce4-power-manager is usable as an unprivileged user?
>
> Thanks for testing it out, I will wait to hear from you

Hi Randy and Khem:

It's usable as an unprivileged user when project configured with below 
items altogether:
1, with systemd DISTRO_FEATURES
2, without polkit DISTRO_FEATURES
3, polkit package installed.
BTW, if we don't install polkit, there comes below error:
Missing or unbuildable dependency chain was: ['packagegroup-xfce-base', 
'xfce4-session', 'polkit']

And there also comes a question about
"[oe] [PATCH 1/5] polkit: add polkit as a required distro feature" as 
there is a logic as REQUIRED_DISTRO_FEATURES = "polkit" added, but why 
does it inherit distro_features_check?

Thanks,

>

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Stefan Agner]

On 23.01.2019 04:02, Yu, Mingli wrote:
> On 2019年01月21日 02:07, Khem Raj wrote:
>> On Thu, Jan 17, 2019 at 4:30 PM Randy MacLeod
>> <randy.macleod@windriver.com> wrote:
>>>
>>> On 1/17/19 1:39 PM, Stefan Agner wrote:
>>>> On 17.01.2019 18:53, Andreas Müller wrote:
>>>>> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>>>>>>
>>>>>> From: Stefan Agner <stefan.agner@toradex.com>
>>>>>>
>>>>>> systemd and polkit are not directly related. It is just fine to build
>>>>>> with systemd but without polkit.
>>>>> Surely it builds but is it still usable as unpriviledged user?
>>>>
>>>> TBH, I don't know, did not run XFCE.
>>>
>>> We do! :)
>>>
>>>>
>>>> If it is unusable, we probably should not make it an option anyway? Just
>>>> enable it always and make polkit a fixed dependency?
>>>
>>> Grace,
>>> Please apply this series of patches and check if
>>> xfce4-power-manager is usable as an unprivileged user?
>>
>> Thanks for testing it out, I will wait to hear from you
> 
> Hi Randy and Khem:
> 
> It's usable as an unprivileged user when project configured with below
> items altogether:
> 1, with systemd DISTRO_FEATURES
> 2, without polkit DISTRO_FEATURES
> 3, polkit package installed.
> BTW, if we don't install polkit, there comes below error:
> Missing or unbuildable dependency chain was:
> ['packagegroup-xfce-base', 'xfce4-session', 'polkit']

I don't understand this. In this case, you have polkit *not* in
DISTRO_FEATURES and this patch applied?

In that case, packageconfig polkit should not be enabled, and hence
polkit should not be a dependency.


> 
> And there also comes a question about
> "[oe] [PATCH 1/5] polkit: add polkit as a required distro feature" as
> there is a logic as REQUIRED_DISTRO_FEATURES = "polkit" added, but why
> does it inherit distro_features_check?

polkit does not inherit distro_features_check, but should I guess?

You probably meant to ask "why does it *not* inherit
distro_features_check?"

Good catch, will send a patch to add distro_features_check.

--
Stefan

Re: [PATCH 3/5] xfce4-power-manager: enable polkit depending on distro feature

[Yu, Mingli]

On 2019年01月24日 20:24, Stefan Agner wrote:
> On 23.01.2019 04:02, Yu, Mingli wrote:
>> On 2019年01月21日 02:07, Khem Raj wrote:
>>> On Thu, Jan 17, 2019 at 4:30 PM Randy MacLeod
>>> <randy.macleod@windriver.com> wrote:
>>>>
>>>> On 1/17/19 1:39 PM, Stefan Agner wrote:
>>>>> On 17.01.2019 18:53, Andreas Müller wrote:
>>>>>> On Thu, Jan 17, 2019 at 5:27 PM Stefan Agner <stefan@agner.ch> wrote:
>>>>>>>
>>>>>>> From: Stefan Agner <stefan.agner@toradex.com>
>>>>>>>
>>>>>>> systemd and polkit are not directly related. It is just fine to build
>>>>>>> with systemd but without polkit.
>>>>>> Surely it builds but is it still usable as unpriviledged user?
>>>>>
>>>>> TBH, I don't know, did not run XFCE.
>>>>
>>>> We do! :)
>>>>
>>>>>
>>>>> If it is unusable, we probably should not make it an option anyway? Just
>>>>> enable it always and make polkit a fixed dependency?
>>>>
>>>> Grace,
>>>> Please apply this series of patches and check if
>>>> xfce4-power-manager is usable as an unprivileged user?
>>>
>>> Thanks for testing it out, I will wait to hear from you
>>
>> Hi Randy and Khem:
>>
>> It's usable as an unprivileged user when project configured with below
>> items altogether:
>> 1, with systemd DISTRO_FEATURES
>> 2, without polkit DISTRO_FEATURES
>> 3, polkit package installed.
>> BTW, if we don't install polkit, there comes below error:
>> Missing or unbuildable dependency chain was:
>> ['packagegroup-xfce-base', 'xfce4-session', 'polkit']
>
> I don't understand this. In this case, you have polkit *not* in
> DISTRO_FEATURES and this patch applied?

Hi Stefan,

Yes, I apply these series patch successfully without polkit in 
DISTRO_FEATURES.
I guess you forget to inherit distro_features_check in your "[oe] [PATCH 
1/5] polkit: add polkit as a required distro feature" make it possible?

Thanks,

>
> In that case, packageconfig polkit should not be enabled, and hence
> polkit should not be a dependency.
>
>
>>
>> And there also comes a question about
>> "[oe] [PATCH 1/5] polkit: add polkit as a required distro feature" as
>> there is a logic as REQUIRED_DISTRO_FEATURES = "polkit" added, but why
>> does it inherit distro_features_check?
>
> polkit does not inherit distro_features_check, but should I guess?
>
> You probably meant to ask "why does it *not* inherit
> distro_features_check?"
>
> Good catch, will send a patch to add distro_features_check.
>
> --
> Stefan
>