How can I repair PolKit?

Question

First let me describe my system. It's Mint 19.0 (Tara). Mint itself isn't the problem, but it's upgrade mechanism seem to have triggered the issue. It came after upgrading from Mint 18.3 to 19.0. I did post a question on Mint's forums, but then I did not know what was broken, and in the process of finding that out I kind of "overloaded" my issue report there. So I try to be concise here.

PolicyKit has some problem authorizing priviledge escalation. I am the owner of the system, and previously there were only my account and a guest account. After upgrading, I could no longer launch Synaptic via the menu (which calls synaptic-pkexec) and all other programs that need priviledge escalation also won't start, leaving a fail message in auth.log. No dialog pops up asking for my password.

Launching synaptic-pkexec from command line simply yields

Error executing command as another user: Not authorized
This incident has been reported.

Quote from auth.log:

Jul 15 12:07:42 MYMACHINE polkit-agent-helper-1[9867]: pam_unix(polkit-1:auth): conversation failed
Jul 15 12:07:42 MYMACHINE polkitd(authority=local): Unregistered Authentication Agent for unix-session:c2 (system bus name :1.61, object path /org/gnome/PolicyKit1/AuthenticationAgent, locale de_DE.UTF-8) (disconnected from bus)
Jul 15 12:07:42 MYMACHINE polkitd(authority=local): Operator of unix-session:c2 FAILED to authenticate to gain authorization for action com.ubuntu.pkexec.synaptic for unix-process:9863:4513929 [/bin/sh /usr/bin/synaptic-pkexec] (owned by unix-user:MYUSERACCOUNT)
Jul 15 12:07:42 MYMACHINE pkexec[9864]: MYUSERACCOUNT: Error executing command as another user: Not authorized [USER=root] [TTY=/dev/pts/0] [CWD=/home/MYHOMEDIR] [COMMAND=/usr/sbin/synaptic]
Jul 15 12:07:42 MYMACHINE polkit-agent-helper-1[9867]: pam_unix(polkit-1:auth): auth could not identify password for [MYUSERACCOUNT]
Jul 15 12:07:42 MYMACHINE polkitd(authority=local): Registered Authentication Agent for unix-session:c2 (system bus name :1.220 [/usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1], object path /org/gnome/PolicyKit1/AuthenticationAgent, locale de_DE.UTF-8)

My guest account, however, can do everything. It is asked for the password, and then Synaptic, Upgrade Manager, just everything works as intended. Also, when I create new users (regardless whether they are created as admins or as users, and added to sudo group) they also can to everything. So I figure it is somehow connected to the user ID.

Another observation: I know GUI programs shouldn't be launched via sudo. But when I issue sudo synaptic-pkexec - Synaptic starts...

I have already checked that

1. PolKit Daemon is running via Autostart
2. PolKit Agent for Gnome is running via Autostart
3. file permissions for the user home directory are set correctly

I also did

apt-get install --reinstall

on everything PolKit related. Everything else besides PolKit runs just fine...

I can add inxi statement, if that helps.

Answer 1

As I have posted on the Mint Forum:

I solved it. On my own...

I made sure I had the latest polkit, polkitd and polkit agent for gnome. These I updated not through Synaptic dirctly, but through Update Manager (which calls Synaptic as a backend). I de-selected everything in Update Manager and re-selected only those few, observing how many dependencies would follow. To this point, Tara still would not fly. I updated Firefox and Thunderbird and everything related to dbus. Still Tara would not fly.

I realized that I had several differing versions of gtk and gtk-sub-packages installed at the same time. Some of them obviously being on Sylvia level. So in fact I did have a mix of Sylvia and Tara (without the upgrade process warning about that). Of course such a state could by no means be called healthy.

I then made another Timeshift backup (in addition to the daily backups done since the failed upgrade to Tara).

With this backup safe and sound, I ran Update Manager and had it run on the full set of then only 244 updates. I only got two dialogs that asked for my consent on some config changes. I checked them, seemed reasonable, so I ok'd them.

After ten minutes, it was done. I started Synaptic and checked that all things that I worried about getting deleted were still there, or handled by different packages now. So reassured I rebooted.

And Tara flies! I can launch Synaptic from Menu. At the moment I cannot tell Update Manager, because it signals it has nothing to do: 0 packets outstanding. So my Tara is up-to-date and fully functional. I'll give it another couple of days of use and observation, and if no problem emerges, I will go for Tricia...