Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For years, I've had the following in my sudoers file:


For those who don't know, this prevents sudo and friends (gksudo, etc.) from asking for a password. However, over the years, more and more stuff that once used sudo has been switched to using PolicyKit.

I'm looking for an equivalent configuration for PolicyKit, such that it'll never ask me for my password.

For those who don't like my request, let me say this: I understand the reasons for the default configuration, and they are sound. I also understand the risks inherent in the configuration I want to make. Nevertheless, it's the way I want to set up my system. Those who don't fully understand the above shouldn't attempt what I'm attempting.

share|improve this question
up vote 12 down vote accepted

That's actually not entirely true. You can trick PolicyKit and suppress ALL password prompts by substituting the action with a wildcard.

DISCLAIMER: The following will suppress ALL password prompts globally for everyone belonging to the admin group, with the exception of the login screen. It is EXTREMELY dangerous and should NEVER be implemented because chances are YOU WILL END UP BREAKING YOUR SYSTEM!!

Don't say you weren't warned!

NOTE: If you are running 12.04 or later, substitute "admin" with "sudo"!

Replace "username" with your actual user name:

usermod -aG admin username

Switch to root:

sudo -i

Create a new policy:

gedit /var/lib/polkit-1/localauthority/50-local.d/disable-passwords.pkla

Add the following:

[Do anything you want]

Save, exit, and reboot. Then go try something that usually requires a password. :)

NOTE: It doesn't matter what you use as your .pkla file name. You can name it anything you want. BUT, it DOES matter that you use a legitimate policy. That's why I went with "Install package file". You don't necessarily have to go with what I did, as long as it's in the policy list that Ubuntu recognizes.

And last, this is the ONLY policy you'll need when it comes to suppressing password prompts because again, it does so globally.

share|improve this answer
Thanks. It worked perfectly. – Scott Severance Sep 6 '12 at 23:50
This also works on Fedora when you substitute the admin group with wheel. Thanks! – Kenny Rasschaert Mar 4 '14 at 12:40
Could someone describe how exactly this will "break" the system? – Mehrdad Aug 14 '14 at 20:30
Yes, please. How will this break the system? Not this! Something stupid that you do after this will break the system, but not this! This will allow you to do anything on the host without password. If you do something stupid, you'll break the system. If you have to put the password and you do something stupid, you will break the system. This, per-se, just makes it a bit easier to do something stupid. – jeckyll2hide Jun 25 '15 at 7:27
@jeckyll2hide Read the NOTE - it explains why the OP chose [Install package file]. Either you disagree with this and the NOTE requires a similar edit, or your edit is invalid and should be rolled back. – bcbc Jun 25 '15 at 19:40

You can create a .pkla, either an all in one or a couple based on action groups, doesn't really matter.

For reference look in /usr/share/polkit-1/actions, open interested ones in a text editor to get action id's.

As far as a .pkla or 2 I find the best place to put them is here, it will be protected from any updates


So for example here is my main one, named package-manager.pkla though it extends a bit further than just package management policy's

[Install package file]

[Install package synaptic]

[Change add repo]

[usbcreator format]

[Install bootloader]

[Add users]

Note that starting in 12.04 the group used for "admin" user should be changed to sudo, ie.


Also note that actions can be strung together per section, no spaces, use a ; in between id's

share|improve this answer
It looks like you're making settings for each program individually. That seems rather tedious, especially if I later install some other program that wants to use PolicyKit. I'm looking for a way to make a global configuration change that affects everything. – Scott Severance Jan 24 '12 at 16:31
Have never seen any way to affect 'globally', don't believe that's the way policykit works, there is an policy set per action id – doug Jan 24 '12 at 18:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.