Authentication required - computer stuck (still)

[hans-fritz-pommes]

Hello again,

In your rule-patch-file you will at least need to add the action "org.freedesktop.flatpak.modify-repo"
(appeared today):

2026-01-17T10:41:16.940708+01:00 mint polkitd[1143]: Operator of unix-session:c2 FAILED to authenticate to gain authorization for action org.freedesktop.Flatpak.modify-repo for system-bus-name::1.211 [<unknown>] (owned by unix-user:hans-fritz)
2026-01-17T10:41:16.949896+01:00 mint polkitd[1143]: Operator of unix-session:c2 FAILED to authenticate to gain authorization for action org.freedesktop.Flatpak.modify-repo for system-bus-name::1.222 [<unknown>] (owned by unix-user:hans-fritz)

But I have more questions:

1. Why is the file located in /etc/polkit-1/rules.d and not in /usr/share/polkit-1/rules.d? (It's just that I'm trying to understand that stuff)
2. Could you look through the file /usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy and search for actions with unattended ('anything else than "yes" will break unattended updates'):
   <allow_active> is always yes - but <allow_inactive> is auth_admin. Why? Does this have a sense?
3. Don't forget to think about the file /usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules

Maybe this problem is a task for those people who made the policy stuff?

[hans-fritz-pommes]

Or maybe there should be no unattended-flatpak-update job running for two users at the same time?

[hans-fritz-pommes]

Or no window should appear at all if the user is not logged in?

[mtwebster]

We don't 'own' that org.freedesktop.Flatpak.policy file, we would have to either package our own 'flatpak' source package and binaries (which we really don't want to be responsible for).

My first thought to resolve our issues was to modify those allow_inactives (there's an issue in the flatpak repository regarding this I think).

I never encountered 'modify-repo' in my testing - are you getting messages about EOL'd runtimes or something?

[hans-fritz-pommes]

No runtimes and stuff, just modify-repo. And waschulte is getting it also - see here: linuxmint/cinnamon#12847

[hans-fritz-pommes]

In the flatpak repo I had opened an issue but closed again, because it was also discussed in cinnamon: flatpak/flatpak#6216.
And another interesting issue was this one: flatpak/flatpak#4611.
But I didn't find more.

[hans-fritz-pommes]

Until it's clear whose task it is (flatpak maybe) I think this patch is a good solution.
If it's bad to allow those actions (return polkit.Result.YES;) for security reasons - return polkit.Result.NO; would also prevent the windows. But then it should return YES for active users to allow unattended upgrades while the user is logged in.