![systemctl 挂起,调用挂起失败:访问被拒绝](https://linux22.com/image/221716/systemctl%20%E6%8C%82%E8%B5%B7%EF%BC%8C%E8%B0%83%E7%94%A8%E6%8C%82%E8%B5%B7%E5%A4%B1%E8%B4%A5%EF%BC%9A%E8%AE%BF%E9%97%AE%E8%A2%AB%E6%8B%92%E7%BB%9D.png)
Ubuntu 20.04 最近更新后:
$ systemctl suspend
Call to Suspend failed: Access denied
几周前这样工作得很好,没有任何 root 权限。
日记上:
dbus-daemon[1310]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.991" (uid=1000 pid=683426 comm="systemctl suspend " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")
“拒绝发送消息”在 dbus 中相当于“权限被拒绝”。权限被拒绝的原因取决于发送者、目的地、接口和成员。
简单的搜索返回的主要是与休眠相关的问题。单程 (1,2)可能是将 NOPASSWD 添加到 sudoers 文件(不是相同),但似乎波尔基特问题。
哪些软件包更新会导致此行为?除了编辑 sudoer 文件之外,还有其他(也许更优雅)的解决方案吗?
编辑:
$ grep -ri org.freedesktop.login1.suspend /usr/share/polkit-1/
/usr/share/polkit-1/actions/org.freedesktop.login1.policy: <action id="org.freedesktop.login1.suspend">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy: <action id="org.freedesktop.login1.suspend-multiple-sessions">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy: <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>
/usr/share/polkit-1/actions/org.freedesktop.login1.policy: <action id="org.freedesktop.login1.suspend-ignore-inhibit">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy: <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>
$ grep -i suspend /usr/share/dbus-1/system.d/org.freedesktop.login1.conf
send_member="Suspend"/>
send_member="SuspendThenHibernate"/>
send_member="CanSuspend"/>
send_member="CanSuspendThenHibernate"/>
由于某种原因,使用其他类似的普通用户systemctl suspend -i
可以完美地工作。
也尝试过这和Result.YES
。
使用busctl monitor
:
‣ Type=error ... Sender=org.freedesktop.DBus Destination=:1.4594
ErrorName=org.freedesktop.DBus.Error.AccessDenied ErrorMessage="Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"
MESSAGE "s" { STRING "Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"; };
systemctl reboot
我对/也有同样的问题RebootWithFlags
。相同的解决方案,添加到/usr/share/dbus-1/system.d/org.freedesktop.login1.conf
(包的一部分systemd
)。
答案1
D总线
检查是否有 dbus 策略/usr/share/dbus-1/system.d
或/etc/dbus-1/system.d
明确拒绝与org.freedesktop.login1
系统暂停相关的成员的非特权访问。
您可以使用以下策略来允许非特权用户调用org.freedesktop.login1.Manager.Suspend
和org.freedesktop.login1.Manager.SuspendWithFlags
<?xml version="1.0"?> <!--*-nxml-*-->
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
"https://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
<policy context="default">
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="Suspend"/>
<allow send_destination="org.freedesktop.login1"
send_interface="org.freedesktop.login1.Manager"
send_member="SuspendWithFlags"/>
</policy>
</busconfig>
将此策略文件另存为/etc/dbus-1/system.d/org.freedesktop.login1.conf
并使用 重新加载 dbus 守护程序systemctl reload dbus
。
波尔基特
您可以添加以下规则以允许普通用户无需身份验证即可暂停系统。
// vi: ft=javascript
Array.prototype.includes = function (variable) {
for (var i = 0; i < this.length; i++) { if (this[i] === variable) return true; }
return false;
}
polkit.addRule(function (action, subject) {
if (
[
"org.freedesktop.login1.suspend",
"org.freedesktop.login1.suspend-ignore-inhibit",
"org.freedesktop.login1.suspend-multiple-sessions"
].includes(action.id) &&
// Allow user named "user_name" or users in group "wheel" to suspend this system,
// Modify accordingly to suit your system
(subject.user == "user_name" || subject.isInGroup("wheel"))
) {
return polkit.Result.YES;
}
});
将“user_name”更改为您的用户名
将此规则保存为/etc/polkit-1/rules.d/01-suspend.rules
,立即生效。
答案2
尝试一下sudo systemctl suspend
,因为您可能需要 root 权限。
答案3
如果您不想一直编写 sudo,请在 shell 配置中添加一个别名alias "systemctl suspend"="sudo systemctl suspend"