I installed Ubuntu 17.10. Now I am having trouble with gksu:

$ gksu -dg synaptic
No ask_pass set, using default!
xauth: /tmp/libgksu-HgUjgQ/.Xauthority
STARTUP_ID: gksu/synaptic/8760-0-alex-XPS-15-9530_TIME4974977
cmd[0]: /usr/bin/sudo
cmd[1]: -H
cmd[2]: -S
cmd[3]: -p
cmd[5]: -u
cmd[6]: root
cmd[7]: --
cmd[8]: synaptic
brute force GNOME_SUDO_PASS ended...
Yeah, we're in...
Unable to init server: Could not connect: Connection refused
(synaptic:8767): Gtk-WARNING **: cannot open display: :1
xauth: /tmp/libgksu-HgUjgQ/.Xauthority
xauth_env: (null)
dir: /tmp/libgksu-HgUjgQ

If I don't use -g, the password dialog is disabled. So looks like a problem with creating a tty for root.

Any advice?

  • 1
    gksudo won't work in a Wayland session, you may switch to an Xorg session and try.
    – pomsky
    Oct 4, 2017 at 13:59
  • 2
    The error itself if an X error "cannot open display: :1". Wayland is designed this way and, in the opinion of the developers, you should not be running graphical applications as root from the command line. You can work around with xhost.
    – Panther
    Oct 4, 2017 at 14:47
  • 1
    gksu -dg synaptic You never should be doing that anyways.
    – Rinzwind
    Oct 21, 2017 at 14:22
  • 3
    @N0rbert stop adding the 17.10 to questions which mention 17.10. Version tags are to be used if the question is specific to that release. Most of these questions are generally applicable wherever Wayland, GNOME Shell, etc. are available, and that includes past and future versions.
    – muru
    Oct 30, 2017 at 0:38
  • @maru. 16.04 LTS is current, 17.04 is near EOL, so normal 17.10 means Wayland and default GNOME Shell, so 17.10 tag is useful, I think. It is difficult to find questions, where users have problems with 17.10, but have no answers and comments here. They need answers, but forgot to add 17.10 tag when asked. I can stop adding tag. It was a goodwill.
    – N0rbert
    Oct 30, 2017 at 17:37

8 Answers 8


Note this answer is specific to versions of Ubuntu using Wayland, 17.10 being the first release to use Wayland by default.

It is a feature not a bug! It is a design feature of Wayland that you can not start graphical applications as root from the terminal.

The main discussions are of course on the Fedora sites. See Fedora bug #1274451 and Graphical applications can't be run as root in wayland (e.g. gedit, beesu, gparted, nautilus) on Ask Fedora. But there is some discussion on the Ubuntu sites as well (Ubuntu Devs Uncertain about Using Wayland by Default in 17.10 - OMG! Ubuntu).

Ubuntu bug report: Unable to launch pkexec'ed applications on Wayland session

Potential work around - If you are editing system files with a graphical editor (such as gedit) use a command line tool such as nano or vim or emacs. nano is typically easier for new users, vim is more powerful and has more features, see this Vim Tutorial or similar.

At any rate , if you really want or need to run graphical apps as root, set xhost first which forces fallback to Xserver.

To set permissions run:

xhost si:localuser:root 

When you are finished, to remove permissions

xhost -si:localuser:root 

You can add a graphical / desktop option to do this as per this synaptic bug report

pkexec'ed applications may be healed with xhost +si:localuser:root placed in XDG autostart as follows (N0rbert's idea):

cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
[Desktop Entry]
Comment=Fix graphical root applications
Exec="xhost +si:localuser:root"

You could add this xhost command to .bashrc, but I would advise a pair of aliases

alias gsuon='xhost si:localuser:root'

alias gsuoff='xhost -si:localuser:root'

You can name the aliases whatever you wish.

For details see:

Switch back to Xorg

If you prefer Xorg for any reason, you can select to run on Xorg at login

See How do you switch from Wayland back to Xorg in Ubuntu 17.10?

  • Does this workaround work with Mir as well? Oct 4, 2017 at 14:59
  • 1
    Or just xhost +local:
    – chaskes
    Oct 4, 2017 at 16:25
  • 20
    "It is a feature not a bug !"... sigh. These kind of things is exactly reason I cannot convince my friend and colleagues to switch to linux. Using VIM and Nano is not an alternatives to GEdit. Gedit works like notepad, while you need to learn CRTL-code for those others. And take for instance Nano using the terms like "Write Out" instead of "Save".... Very user unfriendly.
    – JHBonarius
    Oct 30, 2017 at 7:43
  • 10
    This also completely breaks gparted, which is kinda an important thing to have access to. What ever happened to "Do not try to prevent stupid people from doing stupid things; you will only succeed in preventing clever people from doing clever things."? Feb 23, 2018 at 18:32
  • 1
    It is better to just type sudo -EH application instead of nasty xhost hack. xhost is opening X wrapper for root access and this is insecure. If an application is written against Wayland API, like gedit for example, it would be better to run it as sudo -EH gedit. The switch -E preserves the env variables (like WAYLAND_DISPLAY) and this is the trick
    – ZAB
    May 3, 2018 at 18:55

enter image description here Solutions

In Wayland it is often difficult to run GUI application programs with elevated (sudo -H, gksu ...) permissions. It is a good idea to do such tasks with command line tools.

But there are workarounds, if you have a GUI tool, that works well for you and needs elevated permissions. (I use two such standard tools: the Synaptic Package Manager, synaptic and the partitioning tool Gparted, gparted. I use MakeUSB to create USB boot drives, mkusb, too, but it can run the parts that need elevated permissions without graphics.)

gvfs admin backend

The gvfs admin backend is a good tool for elevated permissions with GUI tools. In Ubuntu 17.10 (gvfs >= 1.29.4) and newer versions you can use the gvfs admin backend. Notice that you need the full path, for example

thunar admin:///path/to/directory
gedit admin:///path/to/file

In theory, the gvfs admin backend method (which uses polkit) is better and safer (than xhost and sudo -H), regardless of the UI you use.

You don't run the whole application as root. Privilege escalation happens only when strictly necessary. See the following link and links from it,

xhost and sudo -H

  1. There is a workaround to allow graphical application programs owned by other users than the logged in user in Wayland,

     xhost +si:localuser:root
  2. gksu and gksudo are not bundled with standard Ubuntu and do not work here, but they work in Xorg.

    Instead you can use

     sudo -H


    -H is no longer necessary (in 20.04 LTS and newer versions)

    Prior to 20.04 (or maybe 19.10, I can't remember when) using sudo for a GUI application, particularly the file manager, could change ownership of files and folders in your home to root, completely removing your ability to login to the system as user. Changes to the way the system uses sudo means that the danger of that happening has now gone so it should be safe as far as that problem is concerned.

    end of edit

  3. It is a good idea to prevent graphical application programs owned by other users than the logged in user afterwards,

     xhost -si:localuser:root


It is also possible to use nautilus-admin for file operations with elevated permissions and to use gedit with elevated permissions. This is described in the following AskUbuntu answer,

Temporary access for root to the Wayland desktop via function gks

Please avoid sudo GUI-program. It can cause the system to overwrite the configuration files for your regular user ID with root's configuration and set ownership and permissions to fit root and lock out your regular user ID. You should run GUI applications with sudo -H, which writes the configuration files in root's home directory /root. Example:

sudo -H gedit myfile.txt

But there is a risk that you forget -H. Instead you can create a function, for example gks

gks () { xhost +si:localuser:root; sudo -H "$@"; xhost -si:localuser:root; }

and store it in your ~/.bashrc near the aliases. Then you can run

gks gedit myfile.txt

in a way similar to how you used gksudo before.


You can check how sudo, sudo -H and gks work with the following commands

sudodus@xenial32 ~ $ sudo bash -c "echo ~"
sudodus@xenial32 ~ $ sudo -H bash -c "echo ~"
sudodus@xenial32 ~ $ gks () { xhost +si:localuser:root; sudo -H "$@"; xhost -si:localuser:root; }
sudodus@xenial32 ~ $ gks bash -c "echo ~"
localuser:root being added to access control list
localuser:root being removed from access control list
sudodus@xenial32 ~ $ 

and of course

gks gedit myfile.txt

according to the example in the previous section.

Method that works via Alt-F2 and Gnome Shell menu

Instead of adding a simple one-line function to ~/.bashrc, you can make a system, that works also without bash. It may be convenient to use, but is more complicated to set up. Please notice that you should install only one of the alternatives, because the one-line function will disturb using this more complicated system.

Three files

The shellscript gks:


xhost +si:localuser:root

if [ $# -eq 0 ]
  xterm -T "gks console - enter command and password" \
  -fa default -fs 14 -geometry 60x4 \
  -e bash -c 'echo "gks lets you run command lines with GUI programs
with temporary elevated permissions in Wayland."; \
read -p "Enter command: " cmd; \
cmdfile=$(mktemp); echo "$cmd" > "$cmdfile"; \
sudo -H bash "$cmdfile"; rm "$cmdfile"'
 xterm -T "gks console - enter password" -fa default -fs 14 -geometry 60x4 -e sudo -H "$@"

xhost -si:localuser:root;

The desktop file gks.desktop:

[Desktop Entry]
Description=Run program with temporary elevated permissions in Wayland
Comment=Run program with temporary elevated permissions in Wayland
Exec=gks %f
GenericName[en_US.UTF-8]=Run program with temporary elevated permissions in Wayland

The icon file gks.svg looks like this:

enter image description here

You can download the icon file or a tarball with all three files from this link,


Copy the [extracted or copied & pasted] files to the following locations,

sudo cp gks /usr/bin
sudo cp gks.desktop /usr/share/applications/
sudo cp gks.svg /usr/share/icons

Logout/login or reboot, and there should be a working desktop icon. It will work from a terminal window like with the simple solution with the function.

Alt F2 box:

enter image description here

Gnome Shell menu:

enter image description here

gks console and gparted:

enter image description here

Custom script and desktop file

If you have only a few GUI applications, that need elevated permissions, you could make custom scripts and desktop files for them and avoid entering the command (application name). You would only enter the password, which is not more difficult compared to the previous versions of Ubuntu (you should enter the password anyway).

Example with the simple GUI program xlogo that comes with the program package x11-apps:

The shellscript gkslogo (simplified compared to gks),


xhost +si:localuser:root

xterm -T "gks console - enter password" -fa default -fs 14 -geometry 60x4 -e sudo -H xlogo

xhost -si:localuser:root;

The desktop file gkslogo.desktop:

[Desktop Entry]
Description=Run program with temporary elevated permissions in Wayland
Comment=Run program with temporary elevated permissions in Wayland
GenericName[en_US.UTF-8]=Run program with temporary elevated permissions in Wayland

I was lazy and used the same icon file gks.svg

Copy the [copied & pasted] files to the following locations,

sudo cp gkslogo /usr/bin
sudo cp gkslogo.desktop /usr/share/applications/

gks[logo] console and xlogo:

enter image description here

  • 1
    Is the "Temporary access for root to the Wayland desktop via function gks" a safer method (e.g. than adding a file like /etc/xdg/autostart/xhost.destop as also suggested) because it ends by restoring the original environment? And can we safely replace sudo -H with gksu in the alias so as to use insert into .desktop files, etc.?
    – Sadi
    Oct 30, 2017 at 19:09
  • 1
    Yes, I would think it is safer to allow root access to the desktop only when necessary. And yes, you can replace sudo -H with gksu in the function, it may work better for your applications.
    – sudodus
    Oct 30, 2017 at 19:15
  • 1
    +1 for extremely thorough answer. Similar to your gks abbreviation I had setup gsu to use policy kits (the new future for 16.04) for gedit and nautilus. When 18.04 comes out though I think I'll just name the xhost +si... wrapper script gksu which I'll never install from packages starting with 18.04. Dec 24, 2017 at 23:22
  • 2
    "Wayland is designed to not allow elevated (sudo -H, gksu ...) permissions with GUI application programs." -- false. Wayland allows root applications just fine. You can see this by running sudo -E gedit. There is currently a bug in gdm where it configures the Xwayland X11 compatibility server to not support XAUTHORITY, which is required for X11 applications running as root to work. Native wayland applications running as root work just fine.
    – psusi
    Feb 21, 2018 at 2:53
  • 1
    @psusi, I modified the answer to avoid statements about the design and intentions of Wayland.
    – sudodus
    Feb 21, 2018 at 7:01

Better check whether wayland is really running first before granting root right

if [ $XDG_SESSION_TYPE = "wayland" ]; then
    xhost +si:localuser:root

If you are using Ubuntu 17.04 or higher, it is recommended to use the gvfs admin backend. Simply add admin:// to the front of the full filepath you want to open in an app like the Text Editor or the Files apps.

For instance, to change boot settings, open


This method uses PolicyKit and will still work with Ubuntu 17.10's Wayland default, while sudo and gksu for GUI apps won't.

  • 1
    Thanks. For me this worked best with gedit (except a strange behavior when used simply as gedit admin:), very oddly with nautilus (almost useless), and totally failed with synaptic. Any ideas?
    – Sadi
    Oct 30, 2017 at 18:52
  • It's not going to work with synaptic. It should work fine in nautilus though, but you need to pick a directory not a file like admin:///etc/ Oct 31, 2017 at 20:28
  • 1
    It kind-of works with nautilus but you'll see what I mean ("very oddly", "almost useless") even when you directly open a directory, and start trying to do this and that ;-)
    – Sadi
    Nov 1, 2017 at 10:46
  • @Sadi I have no idea what "this and that" is. You could file a bug if it doesn't work right. Nov 16, 2017 at 19:13

For applications which use su-to-root and pkexec you may want to add this code to /etc/xdg/autostart (see my comment at launchpad) at your own risk:

cat <<EOF | sudo tee /etc/xdg/autostart/xhost.desktop
[Desktop Entry]
Comment=Fix graphical root applications
Exec="xhost +si:localuser:root"

Other root applications are broken on Wayland too (see bug 1713313 and bug 1713311 ).

If you do not want permanent solution, you may use @ravery's method:

just type xhost +si:localuser:root in the terminal before launching privileged application


If an application support Wayland API you can run it as root using sudo -EH application command.

The -E switch tells sudo to preserve environment variables (as well as WAYLAND_SOCKET and XDG_RUNTIME_DIR) needed to wayland applications. It is always better to use this option over nasty xhost hack proposed in other answers. xhost allows the application to run from under X wrapper which is less secure than using Wayland (shared clipboard, keylogging etc). The sudo -EH trick wont work with an application that hadn't been rewritten for wayland, like gparted for example, but would work with gedit etc.


Actually the following code almost works:

#! /bin/bash
set -e 
if [ -z "$1" ] ; then
    echo "Application is not specified" ;  exit
if [ $XDG_SESSION_TYPE = "wayland" ]; then
    if [[ -t 1 ]]; then
       xhost +si:localuser:root
       sudo -u root "$@"
       xhost  -  
       exit 0
gksu "$@"

(please excuse me for naive style of bash coding- I'm a sort of newbie with this subject). T doesn't work stable from Alt-F2, if last selection was not a terminal; in this case we just cannot set focus to password dialog Looks like it works from Gnome menu. Anyway< 1. It is not a 100% solution. 2. It seems to me that Ubuntu architects think that we are not supposed to search any work arounds..

  • 1
    I think you want "$@" (instead of "$1" "$2" ...).
    – muru
    Oct 26, 2017 at 2:12
  • Yes of course :-) These are just traces of my experiments Oct 26, 2017 at 3:58

This is based on Thomas Guyot-Sionnest's answer.

I feel like this deserves its own answer, since it very simple and cleaned up so many issues for me. Create a shell script called wlsudo with the following contents:

#!/usr/bin/env bash
socat UNIX-LISTEN:/tmp/.X11-unix/X1 UNIX-CONNECT:/tmp/.X11-unix/X0 & sudo DISPLAY=:1 "$@"

Save it in a directory on your $PATH, and give it executable permissions (chmod +x ./wlsudo). You should then be able to launch GUI apps using wlsudo in place of sudo in Wayland, e.g. wlsudo synaptic just works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .