12

I am doing a fresh install of a minimal Ubuntu system with MATE desktop environment. When I click on NetworkManager's icon and then a wireless network to connect to, I receive a dialog box that says:

Connection failure

Failed to add/activate connection

(32) Insufficient privileges.

I am doing a clean reinstallation of Ubuntu 14.04 with Lubuntu 14.04.1 alternate installer and choose F4 -> "Install a basic command-line system", then install X, MATE and NetworkManager manually like this:

sudo apt-get install software-properties-common -y
sudo apt-add-repository ppa:ubuntu-mate-dev/ppa -y
sudo apt-add-repository ppa:ubuntu-mate-dev/trusty-mate -y
sudo apt-get install xorg mate-core --no-install-recommends -y
sudo apt-get install network-manager network-manager-gnome --no-install-recommends -y

If that helps, when I install Ubuntu that way, it asks for password upon attaching and unmounting a USB flash drive. Also, when I am creating a shortcut for shutdown command, to be able to shut down my computer with a click on an icon, I have to alter permissions for /sbin/shutdown:

chmod u+s /sbin/shutdown

Maybe something similar is going on with Wi-Fi and I need to alter some permissions for it to work properly?

Nickolai Leschov
  • 8,400

3 Answers3

20

Step 1

This can be cured by fixing PolicyKit rule for the NetworkManager. First of all check whether .pkla file with [nm-applet] section already exists in /etc/polkit-1/localauthority/10-vendor.d. If yes, make a backup of it and alter ResultAny=no value to yes in [nm-applet] section of this file.

The structure of these policy rule files is described here.

If this file is absent in 10-vendor.d folder, we will create PolicyKit rule manually. Create the file with the name org.freedesktop.NetworkManager.pkla containing the next lines:

[nm-applet]
Identity=unix-user:your_username
Action=org.freedesktop.NetworkManager.*
ResultAny=yes
ResultInactive=no
ResultActive=yes

Replace your_username in this file with your real login name. If you wish to add several users, change the Identity entry like this (and replace usernames with the desired ones):

Identity=unix-user:username1;unix-user:username2

If you wish to add even more users, then you should consider adding all of them to netdev group with useradd and change the rule to:

Identity=unix-group:netdev

Now copy this .pkla file to the PolicyKit directory:

sudo cp org.freedesktop.NetworkManager.pkla /etc/polkit-1/localauthority/50-local.d/

Step 2

You should also check whether PolicyKit Authentication Agent is running - this rule won't work without it. If ps -ef | grep kit | grep agent returns nothing, then it isn't running.
Check whether this binary exists. For GNOME this file can be found here:

/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1

For MATE it is located here (for 32-bit and 64-bit respectively):

/usr/lib/i386-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1
/usr/lib/x86_64-linux-gnu/polkit-mate/polkit-mate-authentication-agent-1

Its location may vary in different DE. If it was not found there, seek for it:

locate agent | grep -v -E '^/var|doc|so|helper' | grep pol

If you found nothing, then PolicyKit Agent isn't installed at all. Search for the package name in APT database with apt-cache search PolicyKit Authentication Agent command and install appropriate package for your DE. For MATE it will be mate-polkit.

It doesn't start automatically for some reason. You can search /etc/xdg/autostart for the PolKit Agent .desktop launcher and analyze why it fails to start. Or you can create your own launcher using "Startup Applications" of your DE and add the Polkit Authentication Agent command to start it properly.

If you are interested, there's an extensive and nice article about PolicyKit privileges.

whtyger
  • 5,900
  • How do I write the file org.freedesktop.NetworkManager.pkla if I want two of the users to be able to connect to WiFi? Writing into files such as /etc/polkit-1/localauthority/50-local.d/org.freedesktop.NetworkManager.pkla feels hack-ish (e.g. I'm afraid whether it will break with system updates, upgrades and new software versions) but I'll check if this works - and if it indeed is, then it's a solution, I guess...? – Nickolai Leschov Mar 31 '16 at 17:37
  • I tried creating and copying the file as said here, but to no effect. – Nickolai Leschov Mar 31 '16 at 18:48
  • There's nothing hackish in such approach - we just restoring the missing policy. The similar file should have exist already in /etc/polkit-1/localauthority/10-vendor.d (BTW, check this - if it exists, better to use the existing file). This file alters permissions for the NetworkManager only, so it won't break anything related to updates and so on and so forth. There also may be an issue with PolicyKit Authentication Agent autostart. Please check my update to the answer. – whtyger Apr 01 '16 at 09:05
  • ps -ef | grep [p]olkit-gnome produces nothing, but ps -ef | grep [p]olkit shows /usr/lib/policykit-1/polkitd --no-debug (see this pastebin), so the PolicyKit is running. There are no files in 10-vendor.d, nor 50-local.d, but the directories themselves are there. When I add said files to the appropriate directories and reboot, message "(32) Insufficient privileges." changes to "(32) Not authorized to control networking." – Nickolai Leschov Apr 03 '16 at 00:13
  • 1
    This policy won't work without PolicyKit Agent. In this Debian bugreport there's discussion about issues when using NetworkManager without full gnome stack installed. As you use MATE there's its own Polkit Agent, from mate-polkit package. Here's some info. Check, whether it is installed, install if not, run Agent and check. The mentioned bugreport explains how to fix the issue, if it doesn't run on autostart. BTW, you shouldn't duplicate files, add only one copy into 50-local.d. – whtyger Apr 03 '16 at 07:30
  • Contrary to Arch PolKit wiki, /usr/lib/mate-polkit/polkit-mate-authentication-agent-1 is not present, even though mate-polkit is already installed. – Nickolai Leschov Apr 03 '16 at 11:10
  • Yep. In Arch this binary is placed in another folder. For Ubuntu search it here or here for 32- and 64-bit distros respectively. The rest is the same - if it doesn't run automatically, add it to the list of Startup Applications and reboot. (Or check /etc/xdg/autostart - PolicyKit Agent .desktop launcher may be there, but doesn't work for some reason - maybe MATE isn't among DE, where it is shown?). I'll update my answer with these details, specific to MATE. – whtyger Apr 03 '16 at 13:29
  • Ok, I'm awarding my bounty for your thorough and clearly well researched reply, even though it remains to be seen whether it actually helps me. That's why I don't upvote or accept the answer, yet. Will re-check the solution ASAP. – Nickolai Leschov Apr 05 '16 at 18:49
  • @NickolaiLeschov And then you never did ;) – Zimano May 23 '18 at 13:30
  • This also applies to Ubuntu 20.04 with XFCE4. I needed to add the polkit file to enable connecting to VPN via terminal, and after creating the file it worked without issue. This should be accepted as the answer. – Antony Hutchison Feb 01 '21 at 19:44
  • Thanks, ResultAny=yes is the key to allow my user service application to manipulate NM settings via dbus. – Ben Oct 10 '22 at 01:32
0

on Ubuntu 20.04 works by adding following content:

[nm-applet]
Identity=unix-user:*
Action=org.freedesktop.NetworkManager.*
ResultAny=yes
ResultInactive=no
ResultActive=yes

to the file:

/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla

Oleg Kokorin
  • 177
0

@whtyger answer works perfectly on Ubuntu 16.04. I don't know what MATE is but I was trying to run bash/python script via php exec. (long story, trying to run these commands from php.) Ubuntu wasn't allowing me to control the network setting from the terminal. Followed these instructions and now I'm really happy! Hope this helps! 

echo exec('python3 pypia/pypia.py -s -r us  2>&1',$out);
var_dump($out);
Kristopher Ives
  • 5,709
Chad
  • 139