19

I've read a lot of threads about gksu being removed from many linux flavours, including ubuntu 18.04. Many state that gksu is an abomination and no user should ever need to use anything like it. I have 2 examples where, as far as I know, I must have something that allows me to run as root (not just for editing files).

First, I have a need to start mysql only after an encrypted folder is opened on (GUI) command. This means having a script run by the encryption system that starts the mysql service. That has to be done as root, so I use gksu in that startup script which asks me for a password. How else can I start a service from a GUI system?

I also run ubuntu system backups as root, otherwise many system files can't be backed up. So the desktop file uses gksu to start the backup.

pkexec looks complicated, needing policy files. Is that the only alternative, and if so, why is it any safer?

Other answers to similar questions don't seem to address individual issues that people have now that gksu is no more (or harder to find...). I think such questions from non-expert users would benefit from more detailed answers. I now have some, and so would like to answer my own question.

  • Does pkexec work for you instead of gksu? – Thomas Ward May 31 '18 at 15:31
  • @karel agreed, though that post doesn't clearly state the 'replacement' is pkexec. (you have to hunt for it) – Thomas Ward May 31 '18 at 15:40
  • 2
    You can also try to use sudo -H GUI-program and if Wayland there is this link, that might be useful, ... there are workarounds, if you have a GUI tool, that works well for you and needs elevated permissions. – sudodus May 31 '18 at 15:47
  • 3
    This is a controversial topic but, in a nut shell, running graphical applications as root is a security risk. Although you, and many others, may not agree with this, running graphical apps as root is discouraged by Ubuntu and many distros. Ubuntu is in process of writing alternate solutions, pkexec and other policies. You can file a bug report and the developers will work on a solution to programs they feel should do so such as package managers. This is complex as it involves X and Wayland. Alternately use non graphical apps or write your own. Encryption does not require a gui – Panther May 31 '18 at 16:09
  • I use gnome-encfs-manager, which provides a gui to mount encrypted folders. It provides for a script to be run when the drive is mounted. In that script I need to start mysql. How else can I do this? As for wayland, not allowing synaptic or gparted guis is ridiculous from the point of view of an ordinary home desktop user. They are invaluable. Systems can be so secure that no one wants to use them - there's a balance, and in this particular case (wayland) the user must be right. – pastim Jun 1 '18 at 7:38
13

I found this command

alias gksu='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY'

in the page below:
https://sites.google.com/site/installationubuntu/home/ubuntu-17-10/alternatives-for-gksu-and-gksudo

6

I know there are said to be answers to this elsewhere, I have not found any of them clear and simple enough for me to resolve this issue. So I dug around in many places and came up with this. I still don’t understand why the linux community has decided to make life so hard for us simple desktop users (and I have tried to understand many explanations), but that’s life. I use the gui for just about everything, only using the terminal window when necessary. As far as I can tell solutions using sudo options don’t help with this. So I have .desktop files and scripts that do all the jobs I use regularly.

There are two basic solutions.

1. Reinstall gksu

This solution may or may not last. Anti-gksu techies may find a way to stop it. But in the mean time, download 2 .deb files from libgksu (x64) and gksu (x64). Install libgksu2 and then gksu using gdebi or whichever installation tool you like to use. This worked for me.

2. Use pkexec

As a (hopefully) longer term solution, I managed to get pkexec to work for the tools I need.

  1. To start a service from a script. It turns out that neither gksu or pkexec is needed. Just start service xyz and it will ask for your password.

  2. To edit root files, or to open nautilus as root, see How To Run Gedit And Nautilus As Root With pkexec Instead Of gksu - Web Upd8. This provides two ‘polkit’ files for pkexec, that allow you to use a script containing pkexec gedit to edit a root file, and similarly for nautilus. The instructions are all on that web page. I’m now using ‘filemanager-actions’ to provide right-click actions to run gedit or nautilus as root.

  3. I run deja-dup as root for backups of the core system. I do this infrequently, excluding /home (for /home I do frequent backups that don’t need root access). To get this to work I took a copy of the file used in step 2 for gedit and edited it for deja-dup. I don’t really understand the contents, but it does work, both for backups and to restore files, using pkexec backup in a script initiated from a .desktop file. I added this new file to /usr/share/polkit-1/actions containing:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD polkit Policy Configuration 1.0//EN" "http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
    
    <policyconfig>
      <icon_name>deja-dup</icon_name>
    
      <action id="org.gnome.DejaDup">
        <description gettext-domain="deja-dup">Backup</description>
        <message gettext-domain="deja-dup">Privileges are required to backup system files</message>
        <defaults>
        <allow_any>no</allow_any>
        <allow_inactive>auth_admin</allow_inactive>
        <allow_active>auth_admin</allow_active>
         </defaults>
        <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/deja-dup</annotate>
        <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
      </action>
    
    </policyconfig>
    

    Note that there is another deja-dup file in this directory, which claims to help with restoring files, but I couldn’t get it to work. This new file needs to have a unique name, such as org.gnome.DejaDupNew.policy.

I am, for now, running without gksu. I’ll try to carry on…

  • The command to start the backup was pkexec deja-dup for me, after adding the file like you described. The dialog does let me choose the settings first, which is great. – wbloos Oct 3 '18 at 16:02
  • Putting a policy file in /usr/share/polkit-1/actions was indeed the way to create a desktop launcher with elevated pkexec permissions. Here is another example. – Serge Stroobandt Apr 23 at 17:25
4

Nautilus Admin (nautilus-admin) is a simple Python extension for the Nautilus file manager that adds some administrative actions to the right-click menu:

  • Open as Administrator: opens a folder in a new Nautilus window running with administrator (root) privileges.
  • Edit as Administrator: opens a file in a Gedit window running with administrator (root) privileges.

To install Nautilus Admin in all currently supported versions of Ubuntu open the terminal and type:

sudo apt install nautilus-admin

I've tested all the alternatives to gksu in 18.04 for other applications besides Files and Gedit, and the one that seems to work the most consistently is:

sudo -H appname &>/dev/null

pkexec is the best replacement for gksu when it works because it provides higher security, but it is very inconsistent across different apps (for example it doesn't work with Gedit) and can cause crashing with some apps. sudo -i is unnecessarily difficult to manage because it elevates your privileges to root for an extended period of time when you only need to be root to run a single command.

3

I use a script called sgedit which inherits user preferences for font, tabs, and extensions. It uses sudo -H gedit instead of gksu gedit for stability in GUI environment. It prompts for a password.

Have sudo inherit your user account gedit settings

sgedit 80 column right slider.gif

In this example the user settings for font name, font size, tab stops, convert tabs to spaces, 80 column highlight, and right side thumbnail slider bar have been inherited by sudo.

With regular sudo -H gedit you cannot make nor save these configuration settings. With the script below sgedit the settings are inherited from your user account.

This script also addresses the "gksu is bad and not installed by default" and "pkexec is hard to setup" problems.


Background

I've been nagged by the same issue for years. This weekend's project was to write the sgedit script:

  • Call using sgedit filename1 filename2...
  • Gets user's gedit settings for tab stops, fonts, line-wrap, etc.
  • Elevates to sudo -H to preserve file ownership whilst getting root powers.
  • Requests password if last sudo has timed out.
  • Gets sudo's gedit settings
  • Compares differences between user and sudo gedit settings
  • Runs gsettings set on the differences only (reduces 174 set commands to a dozen or less. Next time it's run perhaps only one or two changes but often times none.
  • Calls gedit as a background task such that terminal prompt reappears immediately.

Bash script sgedit

#!/bin/bash

# NAME: sgedit
# PATH: /mnt/e/bin
# DESC: Run gedit as sudo using $USER preferences
# DATE: June 17, 2018.

# Must not prefix with sudo when calling script
if [[ $(id -u) == 0 ]]; then
    zenity --error --text "You cannot call this script using sudo. Aborting."
    exit 99
fi

# Get user preferences before elevating to sudo
gsettings list-recursively | grep -i gedit | grep -v history |
    grep -v docinfo |
    grep -v virtual-root | grep -v state.window > /tmp/gedit.gsettings

sudoFunc () {
    # Must be running as sudo
    if [[ $(id -u) != 0 ]]; then
        zenity --error --text "Sudo password authentication failed. Aborting."
        exit 99
    fi

    # Get sudo's gedit preferences
    gsettings list-recursively | grep -i gedit | grep -v history |
        grep -v docinfo |
        grep -v virtual-root | grep -v state.window > /tmp/gedit.gsettings.root
    diff /tmp/gedit.gsettings.root /tmp/gedit.gsettings | grep '>' > /tmp/gedit.gsettings.diff
    sed -i 's/>/gsettings set/g; s/uint32 //g' /tmp/gedit.gsettings.diff
    chmod +x /tmp/gedit.gsettings.diff
    bash -x /tmp/gedit.gsettings.diff  # Display override setting to terminal
    nohup gedit $@ &>/dev/null &
}

FUNC=$(declare -f sudoFunc)
sudo -H bash -c "$FUNC; sudoFunc $*;"

Housekeeping

Copy the bash script above to a new file called sgedit. I recommend placing it in your $HOME/bin directory, i.e. /home/YOURNAME/bin. You may have to create the directory first.

Mark the file as executable using:

chmod a+x ~/sgedit

Note ~ is a shortcut for /home/YOURNAME.

0

Ubuntu 18.04: Some installation programs, etc do need gksudo or gksu to be available with the same name. To make these work:

install gnome version of ssh-askpass. Without this the password dialog may be hidden behind another window: sudo apt-get install ssh-askpass-gnome

Create new file my-gksudo.sh: sudo gedit /etc/profile.d/my-gksudo.sh

file content: export SUDO_ASKPASS=/usr/bin/ssh-askpass

Create new files gksudo and gksu with identical content: sudo gedit /usr/bin/gksudo and sudo gedit /usr/bin/gksu

file content for both: sudo -A $@

Make gksudo and gksu executable: sudo chmod +x /usr/bin/gksudo and sudo chmod +x /usr/bin/gksu

Reboot the computer

New contributor
Pekka Lehtikoski is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.