38

Reading these questions and answers:

brought me another one that will create problems for new users of that command:

  • How to configure pkexec for easy usage?

For example when doing the following:

(Opening a file in terminal)

pkexec nano /etc/mysql/my.cnf  

(Opening a file in GUI)

pkexec gedit /etc/mysql/my.cnf  

The last one gets the following error:

 pkexec must be setuid root

Now this brought me the following questions:

  1. How to configure pkexec to avoid getting this? Similar to how sudo/gksu behave when doing the same thing (they only ask for the password).

  2. If applicable, how to tell it to not ask for a password after the first time applying it to a command (or including the first command if configurable)?

  3. Where to save the configuration file if not yet existing?

  4. Is there a GUI app to configure pkexec usage (Policy Kit)?

2
  • 1
    In leiu of Ubuntu taking care of business in this regard in 13.04 this is what I do for gedit & nautilus. Works fine here but will not post as an answer as it's just my solution until such time as Ubuntu takes care of. ubuntuforums.org/…
    – doug
    Apr 30, 2013 at 14:03
  • Hmm, can't add a comment - so have to resort to an answer... Using: alias pkexec='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY' Means that the login gui returns the path of env rather than the command ultimately being executed. Is there a way to arrange the use of "env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY" so that pkexec gui returns path to the command ultimately being executed? See pic here: polkit auth dialogue box
    – user266008
    Apr 6, 2014 at 19:18

3 Answers 3

56

How to configure pkexec to avoid getting errors when run GUI applications?

I found two possible ways:

  1. As you can see, using the following:

    pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY gedit
    

    will not get you any error. And this is normal because man pkexec is very clear in this matter:

           [...] pkexec will not allow you to run X11 applications
           as another user since the $DISPLAY and $XAUTHORITY environment
           variables are not set.[...]
    

    As result you can create an (permanent) alias (this is the simpliest way):

    alias pkexec='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY'
    
  2. Or, (again) as man pkexec says:

           [...] These two variables will be retained if the
           org.freedesktop.policykit.exec.allow_gui annotation on an action is set
           to a nonempty value; this is discouraged, though, and should only be
           used for legacy programs.[...]
    

    you can create a new policy file in /usr/share/polkit-1/actions named com.ubuntu.pkexec.gedit.policy with the following xml code inside where the most important thing is to set org.freedesktop.policykit.exec.allow_gui to a nonempty value:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE policyconfig PUBLIC
      "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
      "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
    <policyconfig>
    
      <action id="com.ubuntu.pkexec.gedit">
        <message gettext-domain="gparted">Authentication is required to run gedit</message>
        <icon_name>gedit</icon_name>
        <defaults>
          <allow_any>auth_admin</allow_any>
          <allow_inactive>auth_admin</allow_inactive>
          <allow_active>auth_admin</allow_active>
        </defaults>
        <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/gedit</annotate>
        <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
      </action>
    
    </policyconfig>
    

How to tell it to not ask for a password after the first time applying it to a command?

For these three setting tags: allow_any, allow_inactive and allow_active from the policy file, the following options are available:

  • no: The user is not authorized to carry out the action. There is therefore no need for authentication.
  • yes: The user is authorized to carry out the action without any authentication.
  • auth_self: Authentication is required but the user need not be an administrative user.
  • auth_admin: Authentication as an administrative user is require.
  • auth_self_keep: The same as auth_self but, like sudo, the authorization lasts a few minutes.
  • auth_admin_keep: The same as auth_admin but, like sudo, the authorization lasts a few minutes.

     Source: Polkit - Structure - Actions

So, if you use auth_admin_keep option (or, as applicable, auth_self_keep), pkexec will not ask for a password again for some time (by default this time is set to 5 minutes as I checked). The disadvantage here is that this thing is applicable only for one - the same - command / application and valid for all users (unless if it is overruled in later configuration).

Where to save the configuration file if not yet existing?

Configuration files or polkit definitions can be divided into two kinds:

  • Actions are defined in XML .policy files located in /usr/share/polkit-1/actions. Each action has a set of default permissions attached to it (e.g. you need to identify as an administrator to use the GParted action). The defaults can be overruled but editing the actions files is NOT the correct way. The name of this policy file should have this format:

    com.ubuntu.pkexec.app_name.policy
  • Authorization rules are defined in JavaScript .rules files. They are found in two places: 3rd party packages can use /usr/share/polkit-1/rules.d (though few if any do) and /etc/polkit-1/rules.d is for local configuration. The .rules files designate a subset of users, refer to one (or more) of the actions specified in the actions files and determine with what restrictions these actions can be taken by that/those user(s). As an example, a rules file could overrule the default requirement for all users to authenticate as an admin when using GParted, determining that some specific user doesn't need to. Or isn't allowed to use GParted at all.

     Source: Polkit - Structure

Is there a GUI application to configure pkexec usage?

From what I know, until now (18.01.2014) doesn't exist something like this. If in the future I will find something, I will not forget to update this answer too.

8
  • 5
    what a beautiful answer!! Thank you a lot. Now I understand why I couldn't run doublecmd with ROOT PRIVELEGES, as I needed to export environments with DISPLAY & XAUTHORITY!! Just small questions: Is there any difference in writing policy or just running a program with command as pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY doublecmd all the time?
    – Ilia Ross
    Dec 30, 2013 at 7:51
  • @IliaRostovtsev this I am thinking, will pkexec become as unsafe as gksudo if run thru such alias? may be, instead of an alias it could be a script with root privileges, could be safer? Jun 22, 2014 at 20:54
  • @AquariusPower In what way you see it could become unsafe? You could try around of course, but I'm not sure. The problem arises when you need to use GUI (X Server) that runs under 'you' and another GUI program that needs to be run as root. Play around and post-back please, in case you find something.
    – Ilia Ross
    Jun 23, 2014 at 8:13
  • @radu-rădeanu On Utopic auth_admin_keep doesn't seem to work. If I start synaptic from gui (which is equivalent to pkexec synaptic) it asks for password for each time. Any idea why? Oct 26, 2014 at 9:10
  • Can you help at pkexec command is not working by means of keyboard short-cut?
    – Pandya
    May 22, 2015 at 9:20
1

In addition to Radu's answer: I would not use the alias pkexec, but gksudo.

Why? You don't need to rewrite your script.

I use the following configuration:

  • open a terminal
  • cd /usr/local/bin
  • sudo gedit gksudo (create new file called "gksudo"
  • write the following content:

    • pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY $@

    • (don't forget the $@ at the end. This is for redirecting all parameters)

  • save and quit

  • make the file executable: chmod 755 gksudo
  • Now you should have a fully functional gksudo command available on your system - permanently.

For documentation reasons, I will write, what I tried and didn't work out:

  • alias pkexec='pkexec env [...]'
  • alias gksudo='pkexec [...]'
    • Was not permanent and did only stay in one single terminal
  • adding the alias to ~/.bash_aliases
    • Works if you first open a terminal. Does not work, if you doubleclick scripts
  • Create a link to pkexec with parameters ( ln -s pkexec [...])
    • After a quick googleing, it seems like linux doesn't support parameters in links
1

As opposed to @Radu Rădeanu answer, mine explains how to create the pkexec command and configure it in order to work as gksu!

So, the main alternative for the GUI version of sudo is to use the pkexec command, but for that you need to export certain environment variables at the moment of execution, which can be done by adding the following aliase to your ~/.bashrc file:

alias gksu='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY DBUS_SESSION_BUS_ADDRESS=$DBUS_SESSION_BUS_ADDRESS'

Now in order to use it, you can run something like the following command:

# structure: gksu <cmd>
$ gksu /usr/bin/my_app

References:

1
  • What is DBUS_SESSION_BUS_ADDRESS needed for? Nov 5, 2021 at 9:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .