Wifi scanned but failed to connect "see logs for details"
Steps to Reproduce
Scan for wifi networks.
Select
Type Password
"Connect"
Expected Behavior
Should connect to wifi
Actual Behavior
Error: see logs for details
Archipelago Version
1.7.104-alpha
Hardware
x86_64 (Intel/AMD)
Relevant Logs
## Symptom
WiFi wouldn't configure/connect through the Archipelago kiosk UI. WiFi hardware itself was fine — `nmcli device wifi list` found dozens of nearby networks (including an SSID literally named `archipelago`), radio was enabled, no rfkill block.
## Root cause
Two-part failure in NetworkManager's polkit authorization:
1. **`polkitd` wasn't installed at all** (`dpkg -l | grep polkit` → nothing). Without polkit running, every NetworkManager authorization check resolves to `unknown`/denied by default. Confirmed in `journalctl -u NetworkManager`:
```
audit: op="connection-add" pid=22817 uid=1000 result="fail" reason="Insufficient privileges"
```
2. **Even with polkit installed, the default shipped rule only grants access to local interactive sessions:**
```js
// /usr/share/polkit-1/rules.d/org.freedesktop.NetworkManager.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
subject.local && subject.active &&
(subject.isInGroup("sudo") || subject.isInGroup("netdev"))) {
return polkit.Result.YES;
}
});
```
The actual caller is `archipelago.service`, a **system-level** systemd unit (`User=archipelago`, cgroup `system.slice/archipelago.service`, started directly by PID 1) — not tied to any logind session. `subject.local` is never true for it, so it would keep failing even after installing polkit.
## Fix
1. Installed `polkitd`:
```
sudo apt-get install -y polkitd
```
2. Added a scoped rule granting the `archipelago` user NetworkManager control regardless of session locality, since this device is managed by a headless daemon rather than an interactive desktop session:
```
/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
```
```js
polkit.addRule(function(action, subject) {
if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 &&
subject.user == "archipelago") {
return polkit.Result.YES;
}
});
```
(Dir is `root:polkitd`, `750`; file is `root:root`, `644` — created automatically correct by the `polkitd` package install.)
## Verification
```
$ nmcli general permissions | grep -E 'network-control|settings.modify'
org.freedesktop.NetworkManager.network-control yes
org.freedesktop.NetworkManager.settings.modify.own yes
org.freedesktop.NetworkManager.settings.modify.system yes
$ nmcli connection add type wifi ifname wlp3s0 con-name test-wifi-perm ssid test-permission-check
Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully added.
$ nmcli connection delete test-wifi-perm
Connection 'test-wifi-perm'(02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully deleted.
```
Reproduced the exact previously-failing action (`connection-add`) and confirmed it now succeeds and cleans up correctly.
Screenshots
No response
### Description
Wifi scanned but failed to connect "see logs for details"
### Steps to Reproduce
Scan for wifi networks.
Select
Type Password
"Connect"
### Expected Behavior
Should connect to wifi
### Actual Behavior
Error: see logs for details
### Archipelago Version
1.7.104-alpha
### Hardware
x86_64 (Intel/AMD)
### Relevant Logs
````shell
## Symptom
WiFi wouldn't configure/connect through the Archipelago kiosk UI. WiFi hardware itself was fine — `nmcli device wifi list` found dozens of nearby networks (including an SSID literally named `archipelago`), radio was enabled, no rfkill block.
## Root cause
Two-part failure in NetworkManager's polkit authorization:
1. **`polkitd` wasn't installed at all** (`dpkg -l | grep polkit` → nothing). Without polkit running, every NetworkManager authorization check resolves to `unknown`/denied by default. Confirmed in `journalctl -u NetworkManager`:
```
audit: op="connection-add" pid=22817 uid=1000 result="fail" reason="Insufficient privileges"
```
2. **Even with polkit installed, the default shipped rule only grants access to local interactive sessions:**
```js
// /usr/share/polkit-1/rules.d/org.freedesktop.NetworkManager.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
subject.local && subject.active &&
(subject.isInGroup("sudo") || subject.isInGroup("netdev"))) {
return polkit.Result.YES;
}
});
```
The actual caller is `archipelago.service`, a **system-level** systemd unit (`User=archipelago`, cgroup `system.slice/archipelago.service`, started directly by PID 1) — not tied to any logind session. `subject.local` is never true for it, so it would keep failing even after installing polkit.
## Fix
1. Installed `polkitd`:
```
sudo apt-get install -y polkitd
```
2. Added a scoped rule granting the `archipelago` user NetworkManager control regardless of session locality, since this device is managed by a headless daemon rather than an interactive desktop session:
```
/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
```
```js
polkit.addRule(function(action, subject) {
if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 &&
subject.user == "archipelago") {
return polkit.Result.YES;
}
});
```
(Dir is `root:polkitd`, `750`; file is `root:root`, `644` — created automatically correct by the `polkitd` package install.)
## Verification
```
$ nmcli general permissions | grep -E 'network-control|settings.modify'
org.freedesktop.NetworkManager.network-control yes
org.freedesktop.NetworkManager.settings.modify.own yes
org.freedesktop.NetworkManager.settings.modify.system yes
$ nmcli connection add type wifi ifname wlp3s0 con-name test-wifi-perm ssid test-permission-check
Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully added.
$ nmcli connection delete test-wifi-perm
Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully deleted.
```
Reproduced the exact previously-failing action (`connection-add`) and confirmed it now succeeds and cleans up correctly.
````
### Screenshots
_No response_
Fixed in the installer: install-to-disk.sh now installs polkitd, enables it, and ships /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules granting the archipelago user NetworkManager control — exactly the fix documented in this issue. Any node (re)installed from a current ISO gets it automatically. Note: OTA does not retrofit polkitd onto nodes installed from old ISOs — those need the manual fix from the issue body once.
Fixed in the installer: `install-to-disk.sh` now installs polkitd, enables it, and ships `/etc/polkit-1/rules.d/49-archipelago-networkmanager.rules` granting the archipelago user NetworkManager control — exactly the fix documented in this issue. Any node (re)installed from a current ISO gets it automatically. Note: OTA does not retrofit polkitd onto nodes installed from old ISOs — those need the manual fix from the issue body once.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
Wifi scanned but failed to connect "see logs for details"
Steps to Reproduce
Scan for wifi networks.
Select
Type Password
"Connect"
Expected Behavior
Should connect to wifi
Actual Behavior
Error: see logs for details
Archipelago Version
1.7.104-alpha
Hardware
x86_64 (Intel/AMD)
Relevant Logs
Screenshots
No response
Fixed in the installer:
install-to-disk.shnow installs polkitd, enables it, and ships/etc/polkit-1/rules.d/49-archipelago-networkmanager.rulesgranting the archipelago user NetworkManager control — exactly the fix documented in this issue. Any node (re)installed from a current ISO gets it automatically. Note: OTA does not retrofit polkitd onto nodes installed from old ISOs — those need the manual fix from the issue body once.