package polkitd 124-1 failed to install/upgrade: installed polkitd package post-installation script subprocess returned error exit status 1

Status changed to 'Confirmed' because the bug affects multiple users.

The issue is that the new polkitd installs a file
/usr/lib/tmpfiles.d/polkitd.conf
which creates directories owned by the 'polkitd' user

The polkitd user is created by the polkitd postinst maintainer script

But a newer systemd is installed as a part of the upgrade and configured polkitd, which leads to systemd picking up the tmfiles.d config and trying to create the directories, but it errors out since polkitd wasn't configured yet and the corresponding user doesn't exists at this point.

Unsure what the right fix is there? Should the user creation be moved to be done in a preinst instead?

So the call of:

  systemd-tmpfiles --create || :

in systemd.postinst is an Ubuntu delta from Debian, which was originally introduced in to fix bug 1748147. If a package just lets debhelper generate its systemd-tmpfiles and systemd-sysusers calls (dh_installtmpfiles and dh_installsysusers), then each package's postinst will call systemd-tmpfiles and systemd-sysusers such that *only* configurations shipped by the package are processed.

From a quick investigation, it seems that we might not need the fix for bug 1748147 any longer (calling systemd-tmpfiles --create var.conf after systemd-tmpfiles --create 00rsyslog.conf does not undo the syslog changes). Hence, dropping this call from systemd.postinst might be the right fix.

Actually, while the delta in systemd.postinst is still likely unnecessary, this should not affect polkitd.postinst. The real error looks like:

Setting up polkitd (124-1) ...
Failed to check if group polkitd already exists: Connection refused

So I am looking into that.

After the upgrade, I manually run the systemd-sysusers command and see this.

root@j:~# SYSTEMD_LOG_LEVEL=debug systemd-sysusers polkit.conf
Failed to connect to /run/systemd/userdb/io.systemd.DynamicUser: Connection refused
Unable to connect to /run/systemd/userdb/io.systemd.DynamicUser: Connection refused
Failed to connect to /run/systemd/userdb/io.systemd.DynamicUser: Connection refused
Unable to connect to /run/systemd/userdb/io.systemd.DynamicUser: Connection refused
Failed to check if group polkitd already exists: Connection refused

So, the getgrnam() call in systemd-sysusers results in libnss-systemd attempting to make a varlink call to pid1 to check if the group exists as a dynamic group, but the varlink connection setup fails. This appears to go away after a reboot, but not a `systemctl daemon re-exec`.

I have yet to figure out the root cause on the systemd side. However, as a workaround, we could set SYSTEMD_NSS_BYPASS_DYNAMIC=1 when calling systemd-sysusers in polkitd.postinst. This should be safe because the polkitd package is creating a real user/group for polkitd, so a successful check from io.systemd.DynamicUser is irrelevant.

I have prepared a patch with this proposed workaround, but will continue to look into this from the systemd side.

I came across this after being offered an upgrade prematurely (which appears to be another bug). Please note #9 in https://answers.launchpad.net/ubuntu/+question/709594 if you are fettling the postinst for polkitd.

Nick uploaded a workaround https://launchpad.net/ubuntu/+source/policykit-1/124-1ubuntu1

This bug was fixed in the package policykit-1 - 124-1ubuntu1

---------------
policykit-1 (124-1ubuntu1) noble; urgency=medium

  * polkitd.postinst: call systemd-sysusers with SYSTEMD_NSS_DYNAMIC_BYPASS=1
    This works around an upgrade bug in systemd where nss-systemd cannot
    establish a varlink connection with io.systemd.DynamicUser, hence causing
    the polkitd user/group creation to fail. (LP: #2054716)

 -- Nick Rosbrook <email address hidden> Wed, 13 Mar 2024 14:15:18 -0400