sysupdate within ParticleOS deployment fails: polkit-agent-helper-1: needs to be setuid root

[martinpitt]

Yesterday I created a standard mkosi image locally in a Fedora 43 toolbox, according to the README.md:

mkosi.local.conf:

[Distribution]
Distribution=fedora

[Config]
Profiles=

This worked fine. I booted it with mkosi vm (qemu runner, as --vmm vmspawn fails in toolbx). Now I wanted to test upgrades, as per README.md: I cloned mkosi and particleos inside the VM, scp'ed in mkosi.{key,crt,mkosi.local.conf}, and ran

~/mkosi/bin/mkosi -B -ff sysupdate -- update --reboot

This built the image alright, but then failed on the deployment part:

[...]
‣ [main]  Extracting partitions
Automatically determined minimal disk image size as 1.8G, current block device/image size is 1.8G.
File '/work/home/particleos/.cache/mkosi/mkosi-workspace-mxfid8aj/staging/ParticleOS_20260514060621_x86-64.raw' already is of requested size or larger, not growing. (1.8G >= 1.8G)
No changes.
‣ [main]  Saving manifest ParticleOS_20260514060621_x86-64.manifest
‣ [main]  /home/particleos/particleos/mkosi.output/ParticleOS_20260514060621_x86-64.raw size is 1.9G, consumes 572.7M.
‣ [main] Wrote new version 20260514060621 to /home/particleos/particleos/mkosi.version
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ====
Authentication is required to start transient unit 'run-p13046-i7829.service'.
Authenticating as: particleos
polkit-agent-helper-1: needs to be setuid root
Error: Incorrect permissions on /usr/lib/polkit-1/polkit-agent-helper-1 (needs to be setuid root)
==== AUTHENTICATION FAILED ====
Failed to start transient service unit: Access denied

This isn't immediately obvious. The suid root bit is there:

$ ls -l /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-xr-x. 1 root root 19872 Mar 27 01:00 /usr/lib/polkit-1/polkit-agent-helper-1

and run0 whoami works just fine:

==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ====
Authentication is required to start transient unit 'run-p13069-i11470.service'.
Authenticating as: particleos
Password: 
==== AUTHENTICATION COMPLETE ====
root

Perhaps the update is running in some restricted namespace or mount that has nosuid or so?

It's not the --reboot part, running without that also fails.

This is a blocker for running POS on a laptop. AFAIUI, updating from a http source does not work yet, and the only supported upgrade path is through rebuilding the image on the same host?

I don't currently have time to investigate this in depth. I'll have a closer look next week, but maybe someone already has an idea what's wrong here?

[martinpitt]

I also tried to run run0 ../mkosi/bin/mkosi sysupdate to circumvent the polkit issue, but that also fails:

‣ Default tools tree requested but it is out-of-date or has not been built yet
‣ (Make sure to (re)build the tools tree first with 'mkosi build' or use '--force')

And run0 ../mkosi/bin/mkosi build fails with

PermissionError: [Errno 13] Permission denied: '/home/particleos/mkosi/mkosi'

And running everything (git clone of mkosi and particleos, ../mkosi/bin/mkosi build) in a run0 root shell fails with

[11/12] Installing setup-0:2.15.0-29.fc45.noarch                                                100% |  44.6 MiB/s | 730.6 KiB |  00m00s
[12/12] Installing filesystem-0:3.18-56.fc45.x86_64                                             100% |   1.5 MiB/s | 289.4 KiB |  00m00s
>>> [RPM] unpacking of archive failed on file /var/spool/mail: cpio: chown failed - Device or resource busy
>>> Unpack error: filesystem-0:3.18-56.fc45.x86_64
Transaction failed: Rpm transaction failed.
‣ [tools] "dnf5 --assumeyes --best --releasever=rawhide --installroot=/buildroot --setopt=keepcache=1 --setopt=logdir=/var/log --setopt=cachedir=/var/cache/libdnf5 --setopt=install_weak_deps=0 --setopt=check_config_file_age=0 --setopt=persistdir=/buildroot/var/lib/dnf --setopt=metadata_expire=never --setopt=cacheonly=metadata --use-host-config --setopt=proxy_sslcacert=/proxy.cacert install basesystem" returned non-zero exit code 1.

So this all needs some polishing still. I suppose I better not yet put this on a production laptop 😅

[daandemeyer]

So this all needs some polishing still. I suppose I better not yet put this on a production laptop 😅

I am running it on the company laptop :p. But yeah it needs work. Strangely enough I've never seen this particular issue before.

I guess I've always been getting graphical polkit prompts since I didn't run it inside a container?

[martinpitt]

@daandemeyer I'm not running this inside a container. The second build and mkosi sysupdate is running inside the VM spawned by mkosi qemu on my host. I wanted to test that I can update an installed system after installing it. How do you do this at the moment?

[daandemeyer]

@daandemeyer I'm not running this inside a container. The second build and mkosi sysupdate is running inside the VM spawned by mkosi qemu on my host. I wanted to test that I can update an installed system after installing it. How do you do this at the moment?

Same as you but I've always had a graphical desktop available when doing updates, I've never gone via the terminal polkit prompt. I suspect that's the difference.

Before I dive into this, maybe @bluca can save the day and tell me the setuid thing for the polkit prompt is gone in a newer version?

[bluca]

Before I dive into this, maybe @bluca can save the day and tell me the setuid thing for the polkit prompt is gone in a newer version?

It is, in the latest version, so update to F44 and it will work

[martinpitt]

@bluca the "fedora" profile is rawhide by default, so systemd-260.1-2.fc45.x86_64.

@daandemeyer I rebuilt with Profiles=desktop,gnome, started with mkosi qemu --console=gui, inside systemctl start gdm. Then I went through the "clone mkosi+particleos → copy in my cert/key/local.conf → mkosi -B -ff sysupdate -- update --reboot dance, and it mostly works 👍 (It just ran out of disk space when trying to log in after boot, but details..)

So this is indeed something strange when using the terminal polkit agent. But not a blocker any more.