Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've seen that recent GNU/Linux are using ConsoleKit and PolicyKit. What are they for? How do they work?

The best answer should explain what kind of problem each one tries to solve, and how they manage to solve it.

I'm a long-time GNU/Linux user, from a time when such things didn't exist. I've been using Slackware and recently Gentoo. I'm an advanced user/admin/developer, so the answer can (and should!) be as detailed and as accurate as possible. I want to understand how these things work, so I can use them (as an user or as a developer) the best possible way.

share|improve this question

1 Answer 1

up vote 13 down vote accepted

In short consolekit is service which tracks user sessions (i.e. where user is logged in). It allows switching users without logging out [many user can be logged in on the same hardware at the same time with one user active]. It is also used to check if session is "local" i.e. if user have direct access to hardware (which may be considered more secure then remote access). ConsoleKit documentation.

PolicyKit allows fine-tuned capabilities in desktop enviroment. Traditionally only privilaged user (root) was allowed to configure network. However while in server enviroment it is reasonable assumption it would be too limiting to not allowed to connect to hotspot on laptop. Still however you may not want to give full privilages to this person (like installing programs) or you want to limit options for some people (for example on your children laptops only 'trusted' networks with parential filters can be used). As far as I remember it works like:

  • Program send message to daemon via dbus about action
  • Daemon uses PolicyKit libraries/configuration (in fact PolicyKit daemon) to determine if user is allowed to perform action. It may happen that the certain confition must be fullfilled (like entering password or hardware access).
  • Deamon performs action according to it (returns auth error or perform action)

PolicyKit documentation.

EDIT currently the ConsoleKit is largely replaced by logind, which is part of systemd (although there is standalone version shipped in Ubuntu).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.