lfg2025/archy
1
0
Fork 0
Code Issues 20 Pull Requests Actions Packages Projects Releases 61 Wiki Activity

[Bug]: Wifi fails to connect after scan #99

New Issue
Open
opened 2026-07-20 19:51:41 +00:00 by ssmithx · 0 comments
ssmithx commented 2026-07-20 19:51:41 +00:00
Collaborator
Copy Link

Description

Wifi scanned but failed to connect "see logs for details"

Steps to Reproduce

Scan for wifi networks.
Select
Type Password
"Connect"

Expected Behavior

Should connect to wifi

Actual Behavior

Error: see logs for details

Archipelago Version

1.7.104-alpha

Hardware

x86_64 (Intel/AMD)

Relevant Logs

## Symptom

WiFi wouldn't configure/connect through the Archipelago kiosk UI. WiFi hardware itself was fine — `nmcli device wifi list` found dozens of nearby networks (including an SSID literally named `archipelago`), radio was enabled, no rfkill block.

## Root cause

Two-part failure in NetworkManager's polkit authorization:

1. **`polkitd` wasn't installed at all** (`dpkg -l | grep polkit` → nothing). Without polkit running, every NetworkManager authorization check resolves to `unknown`/denied by default. Confirmed in `journalctl -u NetworkManager`:
   ```
   audit: op="connection-add" pid=22817 uid=1000 result="fail" reason="Insufficient privileges"
   ```

2. **Even with polkit installed, the default shipped rule only grants access to local interactive sessions:**
   ```js
   // /usr/share/polkit-1/rules.d/org.freedesktop.NetworkManager.rules
   polkit.addRule(function(action, subject) {
       if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
           subject.local && subject.active &&
           (subject.isInGroup("sudo") || subject.isInGroup("netdev"))) {
           return polkit.Result.YES;
       }
   });
   ```
   The actual caller is `archipelago.service`, a **system-level** systemd unit (`User=archipelago`, cgroup `system.slice/archipelago.service`, started directly by PID 1) — not tied to any logind session. `subject.local` is never true for it, so it would keep failing even after installing polkit.

## Fix

1. Installed `polkitd`:
   ```
   sudo apt-get install -y polkitd
   ```

2. Added a scoped rule granting the `archipelago` user NetworkManager control regardless of session locality, since this device is managed by a headless daemon rather than an interactive desktop session:
   ```
   /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules
   ```
   ```js
   polkit.addRule(function(action, subject) {
       if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 &&
           subject.user == "archipelago") {
           return polkit.Result.YES;
       }
   });
   ```
   (Dir is `root:polkitd`, `750`; file is `root:root`, `644` — created automatically correct by the `polkitd` package install.)

## Verification

```
$ nmcli general permissions | grep -E 'network-control|settings.modify'
org.freedesktop.NetworkManager.network-control        yes
org.freedesktop.NetworkManager.settings.modify.own     yes
org.freedesktop.NetworkManager.settings.modify.system  yes

$ nmcli connection add type wifi ifname wlp3s0 con-name test-wifi-perm ssid test-permission-check
Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully added.
$ nmcli connection delete test-wifi-perm
Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully deleted.
```

Reproduced the exact previously-failing action (`connection-add`) and confirmed it now succeeds and cleans up correctly.

Screenshots

No response

### Description Wifi scanned but failed to connect "see logs for details" ### Steps to Reproduce Scan for wifi networks. Select Type Password "Connect" ### Expected Behavior Should connect to wifi ### Actual Behavior Error: see logs for details ### Archipelago Version 1.7.104-alpha ### Hardware x86_64 (Intel/AMD) ### Relevant Logs ````shell ## Symptom WiFi wouldn't configure/connect through the Archipelago kiosk UI. WiFi hardware itself was fine — `nmcli device wifi list` found dozens of nearby networks (including an SSID literally named `archipelago`), radio was enabled, no rfkill block. ## Root cause Two-part failure in NetworkManager's polkit authorization: 1. **`polkitd` wasn't installed at all** (`dpkg -l | grep polkit` → nothing). Without polkit running, every NetworkManager authorization check resolves to `unknown`/denied by default. Confirmed in `journalctl -u NetworkManager`: ``` audit: op="connection-add" pid=22817 uid=1000 result="fail" reason="Insufficient privileges" ``` 2. **Even with polkit installed, the default shipped rule only grants access to local interactive sessions:** ```js // /usr/share/polkit-1/rules.d/org.freedesktop.NetworkManager.rules polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" && subject.local && subject.active && (subject.isInGroup("sudo") || subject.isInGroup("netdev"))) { return polkit.Result.YES; } }); ``` The actual caller is `archipelago.service`, a **system-level** systemd unit (`User=archipelago`, cgroup `system.slice/archipelago.service`, started directly by PID 1) — not tied to any logind session. `subject.local` is never true for it, so it would keep failing even after installing polkit. ## Fix 1. Installed `polkitd`: ``` sudo apt-get install -y polkitd ``` 2. Added a scoped rule granting the `archipelago` user NetworkManager control regardless of session locality, since this device is managed by a headless daemon rather than an interactive desktop session: ``` /etc/polkit-1/rules.d/49-archipelago-networkmanager.rules ``` ```js polkit.addRule(function(action, subject) { if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 && subject.user == "archipelago") { return polkit.Result.YES; } }); ``` (Dir is `root:polkitd`, `750`; file is `root:root`, `644` — created automatically correct by the `polkitd` package install.) ## Verification ``` $ nmcli general permissions | grep -E 'network-control|settings.modify' org.freedesktop.NetworkManager.network-control yes org.freedesktop.NetworkManager.settings.modify.own yes org.freedesktop.NetworkManager.settings.modify.system yes $ nmcli connection add type wifi ifname wlp3s0 con-name test-wifi-perm ssid test-permission-check Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully added. $ nmcli connection delete test-wifi-perm Connection 'test-wifi-perm' (02be257b-cf1d-43d1-bbb4-11a938f12b75) successfully deleted. ``` Reproduced the exact previously-failing action (`connection-add`) and confirmed it now succeeds and cleans up correctly. ```` ### Screenshots _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai ssmithx lfg2025
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: lfg2025/archy#99
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?