3

After a recent update on an Ubuntu 20.04:

$ systemctl suspend
Call to Suspend failed: Access denied

Some weeks ago worked fine this way, without any root privileges.

On journal:

dbus-daemon[1310]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.991" (uid=1000 pid=683426 comm="systemctl suspend " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")

From

The "rejected send message" is the dbus equivalent of "permission denied". And the reason why the permission is denied depend on the sender, the destination, the interface and the member.

A simple search return mostly issues related with hibernate. One way (1, 2) could be to add NOPASSWD to sudoers file (not the same), but seems a polkit issue.

What package update cause this behavior? There is other (maybe more elegant) solution other than editing sudoer file?

Edit:

$ grep -ri org.freedesktop.login1.suspend /usr/share/polkit-1/
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend-multiple-sessions">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:                <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:        <action id="org.freedesktop.login1.suspend-ignore-inhibit">
/usr/share/polkit-1/actions/org.freedesktop.login1.policy:                <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.suspend</annotate>
$ grep -i suspend /usr/share/dbus-1/system.d/org.freedesktop.login1.conf
                       send_member="Suspend"/>
                       send_member="SuspendThenHibernate"/>
                       send_member="CanSuspend"/>
                       send_member="CanSuspendThenHibernate"/>

For some reason, using other similar regular user systemctl suspend -i works flawlessly.

Tried also this with Result.YES.

Using busctl monitor:

‣ Type=error ...  Sender=org.freedesktop.DBus  Destination=:1.4594
  ErrorName=org.freedesktop.DBus.Error.AccessDenied  ErrorMessage="Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"
  MESSAGE "s" { STRING "Rejected send message, 2 matched rules; type="method_call", sender=":1.4594" (uid=1000 pid=636652 comm="systemctl suspend -i " label="unconfined") interface="org.freedesktop.login1.Manager" member="SuspendWithFlags" error name="(unset)" requested_reply="0" destination="org.freedesktop.login1" (uid=0 pid=1512 comm="/lib/systemd/systemd-logind " label="unconfined")"; };

I had the same issue with systemctl reboot/RebootWithFlags. Same solution, added to /usr/share/dbus-1/system.d/org.freedesktop.login1.conf (part of systemd package).

2
  • Did it work before within the same installation? If not, permissions or group membership assignments may have been different.
    – pell
    Jul 10, 2023 at 17:40
  • @pell systemctl suspend/reboot were working without root. It was a D-BUS Bus Configuration issue.
    – Pablo A
    Jul 10, 2023 at 18:55

3 Answers 3

4
+50

D-Bus

Check that there are no dbus policies in /usr/share/dbus-1/system.d or /etc/dbus-1/system.d that explicitly deny unprivileged access to members of org.freedesktop.login1 related to the system suspension.

You can use the following policy to allow unprivileged users to invoke org.freedesktop.login1.Manager.Suspend and org.freedesktop.login1.Manager.SuspendWithFlags

<?xml version="1.0"?> <!--*-nxml-*-->
<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
        "https://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>
        <policy context="default">
                <allow send_destination="org.freedesktop.login1"
                       send_interface="org.freedesktop.login1.Manager"
                       send_member="Suspend"/>
 
                <allow send_destination="org.freedesktop.login1"
                       send_interface="org.freedesktop.login1.Manager"
                       send_member="SuspendWithFlags"/>
        </policy>
</busconfig>

Save this policy file as /etc/dbus-1/system.d/org.freedesktop.login1.conf and reload the dbus daemon with systemctl reload dbus.

Polkit

You can add the following rule to allow regular users to suspend the system without authentication.

// vi: ft=javascript
Array.prototype.includes = function (variable) {
  for (var i = 0; i < this.length; i++) { if (this[i] === variable) return true; }
  return false;
}

polkit.addRule(function (action, subject) {
  if (
    [
      "org.freedesktop.login1.suspend",
      "org.freedesktop.login1.suspend-ignore-inhibit",
      "org.freedesktop.login1.suspend-multiple-sessions"
    ].includes(action.id) &&
    // Allow user named "user_name" or users in group "wheel" to suspend this system, 
    // Modify accordingly to suit your system    
    (subject.user == "user_name" || subject.isInGroup("wheel"))
  ) {
    return polkit.Result.YES;
  }
});

Change "user_name" to your username

Save this rule as /etc/polkit-1/rules.d/01-suspend.rules, it will take effect immediately.

11
  • I've found some mentions to suspend, add to my post. Tried moving login1.suspend-ignore-inhibit, <allow_active>auth_admin_keep</allow_active> to yes. I also your code, but stills return access denied without root rights. Also restarting polkit service. The issue seems to happen only with one user. Only found ~/.local/share/polkit-1/ without nothing interesting
    – Pablo A
    Jul 1, 2023 at 5:38
  • what is output from grep -R -C 10 SuspendWithFlags /usr/share/dbus-1/system.d /etc/dbus-1/system.d
    – memchr
    Jul 1, 2023 at 11:01
  • No output, nor with -i
    – Pablo A
    Jul 1, 2023 at 18:35
  • I've updated the answer with a D-Bus policy file, does it work for you?
    – memchr
    Jul 1, 2023 at 19:18
  • Also, the dbus policy file, which contains SuspendWithFlags, is part of systemd. If it's missing, your system may be corrupted. In this case, run debsums.
    – memchr
    Jul 1, 2023 at 19:23
1

Try sudo systemctl suspend because you might need to be root.

1
  • 1
    That undoubtedly will work, but I had always suspended as a regular user. I used with a shortcut and stop working.
    – Pablo A
    Jun 30, 2023 at 17:27
-3

if you dont want to write sudo all the time make a alias in your shell config by adding alias "systemctl suspend"="sudo systemctl suspend"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .