Gnome-control-center unable to unlock

pietbarber · August 6, 2026, 2:47am

Ubuntu Support Template

Ubuntu Version:
Ubuntu 26.04 LTS

Desktop Environment (if applicable):
GNOME

Problem Description:
When I’m a regular user on the system, and I run the gnome-control-center, there are some situations where some settings need to be unlocked. There is an orange button in the upper right that says “unlock…” I click it. Nothing happens.
When I run gnome-control-center from the command line, the behavior is the same.

When I run sudo gnome-control-center, I don’t have the unlock button (this makes sense) and everything works fine.

TL;DR The “some settings are locked” dialog has an “unlock” button, which does nothing.

Relevant System Information:
I’m running this on a Frame.work desktop. Not that this has anything to do with anything, I just wanted to brag. the original installation on USB thumb drive didn’t work with 26.04, so I did the initial install with 24.04, then did an upgrade to 25.04, then finally did an upgrade to 26.04.

Screenshots or Error Messages:

See that “unlock” button? It’s impotent.

Here’s me with the sudo superpowers. No need to click the impotent ‘unlock’ button, everything is great.

What I’ve Tried:
strace didn’t show anything interesting when i clicked the “unlock” button.

avb66 · August 6, 2026, 4:10am

Check with sudo busctl --system monitor - you should see requests to polkit:

> Type=method_call  Endian=l  Flags=0  Version=1 Cookie=45  Timestamp="Thu 2026-08-06 03:54:42.636182 UTC"
  Sender=:1.154  Destination=:1.10  Path=/org/freedesktop/PolicyKit1/Authority  Interface=org.freedesktop.PolicyKit1.Authority  Member=CheckAuthorization
  UniqueName=:1.154
  MESSAGE "(sa{sv})sa{ss}us" {
          STRUCT "sa{sv}" {
                  STRING "unix-process";
                  ARRAY "{sv}" {
                          DICT_ENTRY "sv" {
                                  STRING "pid";
                                  VARIANT "u" {
                                          UINT32 7214;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "start-time";
                                  VARIANT "t" {
                                          UINT64 12286;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "uid";
                                  VARIANT "i" {
                                          INT32 1000;
                                  };
                          };
                  };
          STRING "org.gnome.controlcenter.remote-session-helper";
          ARRAY "{ss}" {
          };
          UINT32 1;
          STRING "cancellation-id-1";
  };

Here the D-Bus endpoint :1.154 and PID 7214 is gnome-control-center:

busctl
...
:1.154                                          7214 gnome-control-c
...

polkitd should now contact a registered user agent which would present the authentication dialogue:

> Type=method_call  Endian=l  Flags=0  Version=1 Cookie=729  Timestamp="Thu 2026-08-06 03:54:42.650397 UTC"
  Sender=:1.10  Destination=:1.90  Path=/org/freedesktop/PolicyKit1/AuthenticationAgent  Interface=org.freedesktop.PolicyKit1.AuthenticationAgent  Member=BeginAuthentication
  UniqueName=:1.10
  MESSAGE "sssa{ss}sa(sa{sv})" {
          STRING "org.gnome.controlcenter.remote-session-helper";
          STRING "Authentication is required to enable or disable remote sessions";

Do you see both calls?

pietbarber · August 6, 2026, 9:41pm

I captured the system bus while clicking Unlock.

sudo busctl --system monitor org.freedesktop.PolicyKit1 | tee busctl3.txt

Grinding through the busctl3.txt file, I came to a conclusion that:

When I click unlock, GNOME Control Center does call Polkit for the correct action

Member=CheckAuthorization
STRING "org.gnome.controlcenter.remote-session-helper"

‣ Type=method_call  Endian=l  Flags=0  Version=1 Cookie=37  Timestamp="Thu 2026-08-06 21:27:20.356470 UTC"
  Sender=:1.518205  Destination=:1.10  Path=/org/freedesktop/PolicyKit1/Authority  Interface=org.freedesktop.PolicyKit1.Authority  Member=CheckAuthorization
  UniqueName=:1.518205
  MESSAGE "(sa{sv})sa{ss}us" {
          STRUCT "sa{sv}" {
                  STRING "unix-process";
                  ARRAY "{sv}" {
                          DICT_ENTRY "sv" {
                                  STRING "pid";
                                  VARIANT "u" {
                                          UINT32 1741950;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "start-time";
                                  VARIANT "t" {
                                          UINT64 15484032;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "uid";
                                  VARIANT "i" {
                                          INT32 1000;
                                  };
                          };
                  };
          };
          STRING "org.gnome.controlcenter.remote-session-helper";
          ARRAY "{ss}" {
          };
          UINT32 0;
          STRING "cancellation-id-0";
  };

gnome-control-center does issue CheckAuthorization for:

org.gnome.controlcenter.remote-session-helper

However, the CheckAuthorization flags argument is UINT32 0, meaning
POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION is not set.

Polkit therefore returns (false, false), and no BeginAuthentication call
occurs. This appears to be why no authentication dialog is displayed: the
caller requests a non-interactive authorization check despite the user
clicking Unlock.

The button is wired up.
The policy action exists.
polkitd is responding.
The request is associated with the correct user and process.
A missing GNOME Shell authentication agent does not explain this capture.
Polkit cannot show a dialog because the caller told it not to.

This looks like a GNOME Control Center / remote-session-helper bug, likely a regression in the version packaged by Ubuntu 26.04. It may be in the helper’s authorization call rather than the visible control-center process itself.

So… how do I make the unlock button do something?

pietbarber · August 6, 2026, 9:41pm

The user account and general Polkit authentication appear healthy.

The account is in sudo and has an active GDM/Wayland session. Interactive
pkcheck succeeds for all three actions implied by
org.gnome.controlcenter.remote-session-helper:

org.freedesktop.systemd1.manage-units: exit 0
org.freedesktop.systemd1.manage-unit-files: exit 0
org.gnome.remotedesktop.configure-system-daemon: exit 0

Interactive pkcheck for the umbrella action itself returns “Not authorized”
with exit 1:

pkcheck --action-id org.gnome.controlcenter.remote-session-helper
–process $$ --allow-user-interaction

The policy for the umbrella action specifies allow_active=auth_admin_keep
and implies the three actions above. This suggests the failure is specific
to the Control Center umbrella action/unlock implementation, rather than
the user account, administrator status, Polkit agent, or underlying
permissions.

Installed versions:
gnome-control-center 1:50.0-0ubuntu6.1
gnome-control-center-data 1:50.0-0ubuntu6.1
polkitd 127-2ubuntu1

avb66 · August 8, 2026, 6:22pm

This comes from the glib implementation when permissions class is initialized. You should see the second invocation with flags set to 1.

> Type=method_call  Endian=l  Flags=0  Version=1 Cookie=36  Timestamp="Sat 2026-08-08 18:12:32.256685 UTC"
  Sender=:1.123  Destination=:1.11  Path=/org/freedesktop/PolicyKit1/Authority  Interface=org.freedesktop.PolicyKit1.Authority  Member=CheckAuthorization
  UniqueName=:1.123
  MESSAGE "(sa{sv})sa{ss}us" {
          STRUCT "sa{sv}" {
                  STRING "unix-process";
                  ARRAY "{sv}" {
                          DICT_ENTRY "sv" {
                                  STRING "pid";
                                  VARIANT "u" {
                                          UINT32 4196;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "start-time";
                                  VARIANT "t" {
                                          UINT64 6625;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "uid";
                                  VARIANT "i" {
                                          INT32 1000;
                                  };
                          };
                  };            
          };
          STRING "org.gnome.controlcenter.remote-session-helper";
          ARRAY "{ss}" {
          };
          UINT32 0;
          STRING "cancellation-id-0";
  };
...
> Type=method_call  Endian=l  Flags=0  Version=1 Cookie=45  Timestamp="Sat 2026-08-08 18:12:34.800431 UTC"
  Sender=:1.123  Destination=:1.11  Path=/org/freedesktop/PolicyKit1/Authority  Interface=org.freedesktop.PolicyKit1.Authority  Member=CheckAuthorization
  UniqueName=:1.123
  MESSAGE "(sa{sv})sa{ss}us" {
          STRUCT "sa{sv}" {
                  STRING "unix-process";
                  ARRAY "{sv}" {
                          DICT_ENTRY "sv" {
                                  STRING "pid";
                                  VARIANT "u" {
                                          UINT32 4196;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "start-time";
                                  VARIANT "t" { 
                                          UINT64 6625;
                                  };
                          };
                          DICT_ENTRY "sv" {
                                  STRING "uid";
                                  VARIANT "i" {
                                          INT32 1000;
                                  };
                          };
                  };
          STRING "org.gnome.controlcenter.remote-session-helper";
          ARRAY "{ss}" {
          };
          UINT32 1;
          STRING "cancellation-id-1";
  };

Do you see this second call?

I do not see it on 26.04, so it does not look like a common problem.