1

I'm trying to execute a process as root from my application that runs with regular privileges using pkexec.

When I invoke pkexec synchronously everything is fine but when I run it asynchronously with the following code :

    private void execute_process_async () {

        if (permission.allowed ) {
            ...

            Pid child_pid;
            var cli = "%s/my_exec".printf (Build.PKGDATADIR);
            try {

                Process.spawn_async (null,
                    {   "pkexec", cli,
                        settings.scrollbar_width.to_string (),
                        settings.scrollbar_button_radius.to_string (),
                        settings.active_tab_underline_color
                    },
                    Environ.get (),
                    SpawnFlags.SEARCH_PATH,
                    null,
                    out child_pid);
            } catch (SpawnError e) {
                report_error ("error while executing '%s'. Message: '%s'.".printf (cli, e.message)) ;
            }
        }
    }

I get an a rather grim error message:

Refusing to render service to dead parents.

Do you know what is happening?

3

It is not allowed to run pkexec in the background by fork and exec and then terminating the parent. The process becomes an orphan and belongs to init (ppid == 1). See https://lists.ubuntu.com/archives/foundations-bugs/2012-July/100103.html.

You're giving control of an application to another user (usually root). The default way is to run the application with pkexec as root from a shell script. This way the parent is a shell and not init.

E. g. GParted (/usr/bin/gparted-pkexec) and GameConqueror (/usr/bin/gameconqueror) do it like this as shown below:

  1. Create a shell script as /usr/local/bin/foo.sh:

    #!/bin/sh
    pkexec "/usr/sbin/foo" "$@"
    
  2. Give executable permission to above script:

    chmod +x /usr/local/bin/foo.sh
    
  3. If you are using .desktop file, change Exec value as:

    Exec=/usr/local/bin/foo.sh
    
  4. Make sure that your policy file in /usr/share/polkit-1/actions/ has following entry to allow GUI:

    <annotate key="org.freedesktop.policykit.exec.allow_gui">TRUE</annotate>
    

That’s it!

0

Check out this link it worked for me.

  • It explains how to install policykit-1 which provides pkexec.
  • explains usage for gui su prompt privilage escalation
  • Bash alias setup for using aliases to run programs with out having to type

    pkexec application-name
    
  • Instead it becomes alias(application-name):

    application-name
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.