26

I am using Trisquel GNU/Linux-Libre which comes with Gnome3 Flashback Desktop Environment.

I know that I can run GUI application as root by sudo & gksudo but I want to know that How do I run GUI applications as root with the help of pkexec?

When I tries to run gedit (or any other application like:nautilus) by pkexec gedit then It prompts for password for authentication:-

screenshot

After entering password it exit with error:-

$ pkexec gedit
error: XDG_RUNTIME_DIR not set in the environment.

(gedit:6135): Gtk-WARNING **: cannot open display:

So, It seems something is going wrong with display environment.

I've also tried with DISPLAY=:0 pkexec gedit but doesn't work.


Following information is available from man pkexec:-

The environment that PROGRAM will run it, will be set to a minimal known and safe environment in order to avoid injecting code through LD_LIBRARY_PATH or similar mechanisms. In addition the PKEXEC_UID environment variable is set to the user id of the process invoking pkexec. As a result, pkexec will not allow you to run X11 applications as another user since the $DISPLAY and $XAUTHORITY environment variables are not set. These two variables will be retained if the org.freedesktop.policykit.exec.allow_gui annotation on an action is set to a nonempty value; this is discouraged, though, and should only be used for legacy programs.

Now I don't know What to do in order to accomplish this.

Thus, Help me to find out How to run GUI applications as root by means of pkexec. Or Is this possible or not?


BTW, Inspired by gparted-pkexeccommand which works fine. How gparted use pkexec?

2

3 Answers 3

21

It can be done by adding custom actions to policykit. If you want to run gedit as root with pkexec you have to create new file /usr/share/polkit-1/actions/org.freedesktop.policykit.gedit.policy for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>
    <action id="org.freedesktop.policykit.pkexec.gedit">
    <description>Run gedit program</description>
    <message>Authentication is required to run the gedit</message>
    <icon_name>accessories-text-editor</icon_name>
    <defaults>
        <allow_any>auth_admin</allow_any>
        <allow_inactive>auth_admin</allow_inactive>
        <allow_active>auth_admin</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/gedit</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
    </action>
</policyconfig>

Finally pkexec gedit should work as expected.


Visit manpage or Reference Manual which explains it with EXAMPLE like:-

$ man pkexec | grep -i ^Example -A 60
EXAMPLE
       To specify what kind of authorization is needed to execute the program /usr/bin/pk-example-frobnicate as
       another user, simply write an action definition file like this

           <?xml version="1.0" encoding="UTF-8"?>
           <!DOCTYPE policyconfig PUBLIC
            "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
            "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
           <policyconfig>

             <vendor>Examples for the PolicyKit Project</vendor>
             <vendor_url>http://hal.freedesktop.org/docs/PolicyKit/</vendor_url>

             <action id="org.freedesktop.policykit.example.pkexec.run-frobnicate">
               <description>Run the PolicyKit example program Frobnicate</description>
               <description xml:lang="da">Kør PolicyKit eksemplet Frobnicate</description>
               <message>Authentication is required to run the PolicyKit example program Frobnicate (user=$(user), program=$(program), command_line=$(command_line))</message>
               <message xml:lang="da">Autorisering er påkrævet for at afvikle PolicyKit eksemplet Frobnicate (user=$(user), program=$(program), command_line=$(command_line))</message>
               <icon_name>audio-x-generic</icon_name>
               <defaults>
                 <allow_any>no</allow_any>
                 <allow_inactive>no</allow_inactive>
                 <allow_active>auth_self_keep</allow_active>
               </defaults>
               <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/pk-example-frobnicate</annotate>
             </action>

           </policyconfig>

       and drop it in the /usr/share/polkit-1/actions directory under a suitable name (e.g. matching the namespace of
       the action). Note that in addition to specifying the program, the authentication message, description, icon
       and defaults can be specified. Note that occurences of the strings $(user), $(program) and $(command_line) in
       the message will be replaced with respectively the user (of the form "Real Name (username)" or just "username"
       if there is no real name for the username), the binary to execute (a fully-qualified path, e.g.
       "/usr/bin/pk-example-frobnicate") and the command-line, e.g. "pk-example-frobnicate foo bar". For example, for
       the action defined above, the following authentication dialog will be shown:

           [IMAGE][2]

               +----------------------------------------------------------+
               |                     Authenticate                     [X] |
               +----------------------------------------------------------+
               |                                                          |
               |  [Icon]  Authentication is required to run the PolicyKit |
               |          example program Frobnicate                      |
               |                                                          |
               |          An application is attempting to perform an      |
               |          action that requires privileges. Authentication |
               |          is required to perform this action.             |
               |                                                          |
               |          Password: [__________________________________]  |
               |                                                          |
               | [V] Details:                                             |
               |  Command: /usr/bin/pk-example-frobnicate                 |
               |  Run As:  Super User (root)                              |
               |  Action:  org.fd.pk.example.pkexec.run-frobnicate        |
               |  Vendor:  Examples for the PolicyKit Project             |
               |                                                          |
               |                                  [Cancel] [Authenticate] |
               +----------------------------------------------------------+
3
  • @Pandya, the real error is "Refusing to render service to dead parents", there are some bug reports when i googled for it. For workaround you can create executable file in /usr/local/bin which contains something like: #! /bin/sh "pkexec" "nautilus" and run it with F7. I think it should work.
    – taliezin
    May 22, 2015 at 11:24
  • OK. I've tried by making executable which is working fine with F7.
    – Pandya
    May 23, 2015 at 8:34
  • 4
    I'm really disappointed that such a tool forced me to configure something outside /etc and more worst under /usr/share instead of /usr/local/share.
    – niels
    May 26, 2018 at 9:18
12

For me, with Ubuntu, to run hardinfo as root,

pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY hardinfo

works well. This tips is from nany (french Ubuntu forum).

1
  • Note that this only works on a system which sets $XAUTHORITY for the current user. If $XAUTHORITY is not set (e.g. on Debian), you will set it to an empty value for hardinfo, causing it to fail to access the display. Nov 12, 2021 at 0:40
2

If you only need this for one user, then you can share the cookie for your current $DISPLAY with a given user, e.g. root, without using pam_xauth:

sudo xauth -f /root/.Xauthority add $(xauth list $DISPLAY)

Once you run this command (you should do it only once per session), you can run GUI programs with pkexec by simply sharing your $DISPLAY:

pkexec env DISPLAY=$DISPLAY gparted

Also note that you very rarely need to run an editor as root. If you need to change a file owned by a different user, you can do it on any reasonably modern system using GVfs:

gedit admin:///etc/fstab

This runs the polkit authentication agent (asking for a password) just like pkexec does, but instead of running the editor as root, it gives it unrestricted access to a single file.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .