Cannot install the privileged script

Hi,

I am using secureblue which is a security focused Linux distribution based on fedora atomic images

My system is up to date

I have a DELL laptop

I cannot install the privileged script and it is saying "Encountered an unexpected error" when clicking on the install button

secureblue removed the sudo command along other ones that gives the user root privileges, I think this is where the issue is coming from, first i thought it is a Silverblue issue not a secureblue one due to the immutable nature of the system but I found another user who could install normally (He was complaining about another issue)

I tried removing and installing the extension again, also installing the script using run0 from the terminal and it does not give any output, but I checked the directories /etc/polkit-1/rules.d/ and /usr/local/bin but I did not see any changes

What I hope is some way so we can use it without sudo command or pkexec even if we have to type the password every time

[maniacx]

You are correct. Seems like they have removed sudo and pkexec as well.
I am not familiar with run0, but if you are using it.

But before we begin, looking at extension and setguid binaries, first check if you can set threshold using command line. The extension only provides GUI. And when GUI is used to set threshold, extension will simply execute the command using root privileges through sudo/pkexec

So let focus first of you can set threshold using command line.

Check your kernel version.

If it is 6.12.XX and higher, you will be able to se the threshold usin command line, as the kernel exposes charging threshold on sysfs. Note that not all Dell laptop work though. Some model still do face issues with kernel module.
If it charging threshold cannot be set or read using sysfs, you might have to use libsmbios or Dell command center.

If the kernel older than 6.12.xx , then you will have no option but to use libsmbios or Dell command center(dcc)

Note that some laptops work with libsmbios, but does work will dcc. While newer models has problems with libsmbios, but work well with dcc.

In all cases, you need root privileges to set threshold, which i think can be achieved by run0

Read this. All information regarding commands are available here.

https://macs18max.github.io//Battery-Health-Charging/device-compatibility/dell

If you can successfully read and write threshold or change charging modes, then we can focus on the extension.

But if you still want to try the extension?

To install polkit rules and extensionmodule use the following command to install.

sudo ~/.local/share/gnome-shell/extensions/Battery-Health-Charging@maniacx.github.com/tool/installer.sh  --tool-user $USER install

Replace sudo with run0

And in extension folder replace text pkexec with run0 in file /lib/helper.js and /lib/driver.js

Then logout and login

I am sure I can control the threshold because I used the command line before and it is still working until now (my limit is 80%)

And I just tested it as you told me and used run0 and it worked just fine, I used Dell command configure and SYSFS and both of them worked

But if you still want to try the extension?

To install polkit rules and extensionmodule use the following command to install.

sudo ~/.local/share/gnome-shell/extensions/Battery-Health-Charging@maniacx.github.com/tool/installer.sh  --tool-user $USER install

Replace sudo with run0

And in extension folder replace text pkexec with run0 in file /lib/helper.js and /lib/driver.js

Then logout and login

I did as you told me but it did not work, I told you previously that I tried this method and did not work, the installation in the terminal does not give any output to see what happened, but it seems like nothing changed because no files were added to /etc/polkit-1/rules.d or usr/local/bin

And I want to use your wonderful extension because it makes things faster and pretty

[maniacx]

Ok. Let me install secureblue on a VM (boxes) tomorrow and see how it goes.

It does not support extensions out of the box, so you have to enable it first, just run this

ujust toggle-gnome-extensions

source

And I am sorry for making you go through this, thank you for your dedication

[maniacx]

I did ran secureblue on a VM.

Problem is there is no much docs on run0.
Seems like polkit rules should apply to run0 , but not sure why it does not.
I tried to debug it but everything is readonly so cannot remove no-debug flags, to debug polkit rules.

As for using with a password dialog, it will be problem.

Let me explain. Every time you login after lockscreen, poweroff, or reboot, the extension will ask for password twice. First time for checking installation and second time for applying threshold. So you will have to enter password twice. If you still want to move forward. you can use run0 bash instead of pkexec.

example.
/lib/helper.js

export async function runCommandCtl(ctlPath, command, ...args) {
    const argv = ['pkexec', ctlPath, command, ...args.filter(arg => arg)];
    const result = await execCheck(argv);
    return result;
}

Should be replaced with

export async function runCommandCtl(ctlPath, command, ...args) {
    const argv = ['run0', 'bash', ctlPath, command, ...args.filter(arg => arg)];
    const result = await execCheck(argv);
    return result;
}

Also set enableTimeout to false

export async function execCheck(argv, enableTimeout = true) {

Let me know if you find any documents add rules for run0.

I found this discussion and the guy provided a rule that I applied and it made everything work without asking for password
https://discussion.fedoraproject.org/t/is-it-possible-to-use-run0-without-the-popup-authentication-window/136993/11

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.user == "username") {
        return polkit.Result.YES;
    } });

The thing is that it is system-wide so it will come with a huge security risk since anyone can gain privileged access without being asked, so we need a way to apply this rule only for the extension

I noticed that every time it runs it will start a new service to execute commands, this service is usually named run-number, so it is hard to track in the rules

The idea is to make it start a service with the same name so we can give it the permission in the rules to control it, something like this

I also tried this but with no luck

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.user == "username" &&
        action.lookup("program") == "/usr/local/bin/batteryhealthchargingctl-user") {
        return polkit.Result.YES;
    }
});

[RoyalOughtness]

If you run run0 on its own, it opens a root shell. secureblue/secureblue#924 (comment)

Feel free to close this issue if you find time consuming, I wrote a simple script to handle changing mode, until I find a workaround when sufficient documentation is provided and the run0 is more mature, but you can leave it open if it had your attention on how to use run0 instead of sudo (not specifically for secureblue) in the future

The script I am using if anyone in future will find it useful

#!/bin/bash

echo "Choose the mode you want to apply :"
echo "1) Maximum capacity (100%)"
echo "2) Balanced mode (75% - 80%)"
echo "3) Maximum lifespan (55% - 60%)"
echo -n "Choice [1 - 3]: "

read choice

case $choice in
    1)
        echo "Setting to Maximum capacity (100%)"
        echo 'Standard' | run0 tee /sys/class/power_supply/BAT0/charge_types
        ;;
    2)
        echo "Setting to Balanced mode (75% - 80%)"
        run0 bash -c 'echo "Custom" | tee /sys/class/power_supply/BAT0/charge_types &&
                      echo "75" | tee /sys/class/power_supply/BAT0/charge_control_start_threshold &&
                      echo "80" | tee /sys/class/power_supply/BAT0/charge_control_end_threshold'
        ;;
    3)
        echo "Setting to Maximum lifespan (55% - 60%)"
        run0 bash -c 'echo "Custom" | tee /sys/class/power_supply/BAT0/charge_types &&
                      echo "55" | tee /sys/class/power_supply/BAT0/charge_control_start_threshold &&
                      echo "60" | tee /sys/class/power_supply/BAT0/charge_control_end_threshold'
        ;;
    *)
        echo "Invalid choice. Please select 1, 2, or 3."
        ;;
esac

Thank you for your time again

[maniacx]

Lol. I didn't know run0 was part of systemd and is probably usable every linux systemd system. I have Ubunut 24.10 and was able to use run0 and debug the polkit rules issues. You were correct. run0 uses action.id "org.freedesktop.systemd1.manage-units" and there is no safe way to add rules to run it passwordless. Had to find out the hard way.

But it was not a waste of time. I learnt something new about run0.
Since you just want to GUI to click, execute and forget, and do not want to verify anything, you can make a simple extension. I have already, made a simple one, but I am not interested in maintaining/publishing it..

Just correct the icons , cmds, title as per how you like it. Let me know if you have any question.

test-dell.zip

Tutorial is here.
https://gjs.guide/extensions/topics/quick-settings.html#toggle-menu

Thank you so much, I did not expect you were going to do something like this, there are some things that definitely can be better for this extension you just created like highlighting the current mode for example, but I won't be bothering you with it, maybe I should learn some JavaScript and make my own changes, yours will serve as a good base

[francoism90]

I had the same issue, needed this as workaround: #139 (comment)

Thanks for this extension and updating it for GS48. :)