From 536958430fb76614272004429abccb72e7c34c4c Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Wed, 19 Aug 2026 19:54:16 -0400 Subject: [PATCH] Fix the polkit unit's ignored rate limit systemd logged "Unknown key 'StartLimitIntervalSec'" on every start: rate limiting belongs in [Unit], not [Service], so both keys were ignored and the restart limit they were meant to impose did not exist. An agent that failed repeatedly would have flapped rather than stopping. Found while investigating reported prompt failures, which turned out not to be a defect: the trace showed both authentications succeeding on the first attempt. The failures came from testing -- prompts raised by background pkexec runs and then cancelled seconds later, while someone was trying to type into them. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L --- config/dot/quickshell/services/Polkit.qml | 3 +++ .../share/systemd/user/panama-polkit-agent.service | 10 +++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/config/dot/quickshell/services/Polkit.qml b/config/dot/quickshell/services/Polkit.qml index f0355e0..83dc901 100644 --- a/config/dot/quickshell/services/Polkit.qml +++ b/config/dot/quickshell/services/Polkit.qml @@ -43,6 +43,7 @@ Singleton { // Held only between pressing Enter and the helper accepting it on stdin. property string pendingSecret: "" + function begin(path: string): void { // A second request while one is open would leave the first // unanswerable; polkit serializes these in practice, and refusing is @@ -84,6 +85,8 @@ Singleton { helper.running = true; } + // Cancelled by the person at the keyboard, or withdrawn by whatever asked. + // Both close the prompt; only the first is something they did. function cancel(): void { root.dismiss("cancelled"); } diff --git a/config/local/share/systemd/user/panama-polkit-agent.service b/config/local/share/systemd/user/panama-polkit-agent.service index 0c64f0f..734fed5 100644 --- a/config/local/share/systemd/user/panama-polkit-agent.service +++ b/config/local/share/systemd/user/panama-polkit-agent.service @@ -1,5 +1,10 @@ [Unit] Description=Panama polkit authentication agent +# Rate limiting lives in [Unit]. These were in [Service], where systemd ignored +# them with a warning on every start -- so the restart limit they were meant to +# impose was not actually in force. +StartLimitBurst=5 +StartLimitIntervalSec=60 Documentation=https://github.com/gibbyb/Panama # Only one agent may be registered per session, so this must not run alongside # the one it replaces. @@ -14,10 +19,5 @@ ExecStart=%h/.config/quickshell/scripts/panama-polkit-agent # would be registered with nowhere to prompt. Restarting reconnects it. Restart=on-failure RestartSec=2 -# If this fails repeatedly, stop rather than flap: a session with no agent is -# recoverable from a terminal, a session with a broken one is confusing. -StartLimitBurst=5 -StartLimitIntervalSec=60 - [Install] WantedBy=graphical-session.target