Summary
The "Noctalia Greeter" sync section in the Noctalia Settings app (reachable by searching "greet" or via **Settings → Security → Noctalia Greeter → Sync Now** is missing. The Noctalia Shell daemon refuses to trust the greeter sync helper because its containing prefixes (`/usr/bin`, `/usr/lib`, `/usr/libexec`) are world-writable (mode `777`). RakuOS's ostree overlay produces these directories with mode `777` instead of the standard `755 root:root`. Restoring `755` fixes the issue.
Environment
- OS: RakuOS (Fedora 44 immutable base, ostree overlay)
- `/usr` is an overlay mount:
- `lowerdir=/sysroot/usr`, `upperdir=/sysroot/ostree/deploy/default/var/lib/rakuos/overlay/upper`
- Session: Niri (Wayland)
- Noctalia Shell: v5.1.0
- Noctalia Greeter: 1.5.0
- Helper: `/usr/bin/noctalia-greeter-apply-appearance`
- Polkit action: `org.noctalia.greeter.sync-appearance` (`/usr/share/polkit-1/actions/org.noctalia.greeter.apply-appearance.policy`)
Steps to reproduce
- Boot RakuOS and log in (Noctalia Shell on Niri).
- Open the Noctalia Settings panel and search for "greet".
- Observe: the greeter sync control does not appear (it did before this regression / on other systems).
Root cause
The overlay upper layer creates these directories as world-writable:
ls -ld /usr/bin /usr/lib /usr/libexec
drwxrwxrwx 1 root root ... /usr/bin
drwxrwxrwx 1 root root ... /usr/lib
drwxrwxrwx 1 root root ... /usr/libexec
(Confirmed directly in the overlay upper dir: `/sysroot/ostree/deploy/default/var/lib/rakuos/overlay/upper/bin` is mode `777`.)
The Noctalia docs state:
"Noctalia rejects a helper in a user-owned checkout or writable prefix; manual builds must be installed into a root-owned, non-user-writable system prefix."
Because `/usr/bin` is world-writable, the daemon refuses the helper and hides the whole Sync/Greeter settings section. Journal/daemon log (`~/.cache/noctalia/noctalia.log`):
[WRN] [greeter-sync] refusing untrusted greeter sync helper '/usr/bin/noctalia-greeter-apply-appearance'
Verification / workaround
Fix the directory modes in the overlay upper layer (survives the current boot; will need to be applied again after any repack/layering step that resets them):
sudo chmod 755 /usr/bin /usr/lib /usr/libexec
Then restart the Noctalia daemon (or log out and back in). After the fix:
- `ls -ld /usr/bin` reports `drwxr-xr-x root root` (755).
- The `[WRN] refusing untrusted greeter sync helper` line no longer appears in `~/.cache/noctalia/noctalia.log`.
- The "greet" search in Noctalia Settings finds **Security → Noctalia Greeter → Sync Now** again.
- `noctalia-greeter-apply-appearance --supports secure-sync-v1` returns `0`.
Requested upstream action
Ensure the overlay packaging creates `/usr/bin`, `/usr/lib`, `/usr/libexec` (and any other system binary/library prefixes) with mode `0755` owned by `root:root`, not `0777`. A world-writable system prefix is both a Noctalia-compat break and a general privilege-injection hazard (any local user could plant a binary that shadows a system one).
Privacy
No privacy-sensitive data included; all paths and outputs above are system-level and reproducible on any affected install.