How to allow running notify-send as another user with pkexec?

Question

As continuation of this question (How can I send a notification with polkit 0.106?), I've discovered that I have to execute notify-send as the user who I want to send notification.

But, with my current config, I can't do this, because polkit execute the script as polkitd user, and I can't do su $user without known user password.

By this reason, I need to create a new polkit action, to allow execute notify-send as other user from polkitd.

My polkit rule is this:

polkit.addRule(function(action, subject) {
     if (action.id == "org.freedesktop.consolekit.system.stop" ||
        action.id == "org.freedesktop.login1.power-off" ||
        action.id == "org.freedesktop.login1.power-off-multiple-sessions" || 
        action.id == "org.xfce.session.xfsm-shutdown-helper")  
     {

        try{    
            polkit.spawn(["/usr/bin/pendrive-reminder/check_pendrive.sh", subject.user]);        
            return polkit.Result.YES;

        }catch(error){
            polkit.spawn(["/usr/bin/pendrive-reminder/send_notify.sh", subject.user]);
           return polkit.Result.NO;
        }
    }
});

This polkit rule must lock shutdown option in shutdown menu, and shows a notification with notify-send, with send_notify.sh script, which execute this:

#!/bin/bash

export DISPLAY=":0"

user=$1
pkexec --user $user notify-send  "Pendrive Reminder" "Shutdown lock enabled. Disconnect pendrive to enable shutdown" -u critical

exit 0

I tried to add this polkit policy file:

<policyconfig>
    <action id="org.freedesktop.notify-send">
    <description>Launch notify-send command</description>
    <defaults>
        <allow_any>yes</allow_any>
        <allow_inactive>yes</allow_inactive>
        <allow_active>yes</allow_active>
    </defaults>
   <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/notify-send</annotate>
   <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
   </action>
</policyconfig>

I put this file in /usr/share/polkit-1/actions/org.freedesktop.policykit.notify-send.policy

But, after put policy file in /usr/share/polkit-1/rules.d/ and press shutdown button, the shutdown menu took a long time to be showed, and notification didn't appeared. The shutdown option is locked correctly

How can I get that polkit can call notify-send from my script?

Answer 1

After doing a few test, I got this results:

• polkitd is a nologin user

• If I execute this command, to execute my script with polkitd user, shows an error:

  sudo su polkitd -s /bin/bash -c aux_scripts/send_notify.sh almu

  Error executing command as another user: Not authorized

  This incident has been reported.

So, I think that polkitd user is a limited account, who it can't execute commands as other user

As a conclusion, I determine that this action isn't possible to do without modify system internal. I can't allow this in my application, so I can't launch commands as another user from polkit