2

Since gksu has been deprecated, I'm using the following script which emulates it using pkexec:

#!/bin/bash

PKEXEC_USER="root"
while [[ $# -gt 0 ]]; do
  key="$1"

  case $key in
    -u)
    PKEXEC_USER="$2"
    shift
    ;;
    -D|-description|-m|--message)
    shift # ignore unsupported options with params
    ;;
    -*)
    ;; # ignore unsupported options with no params
    *)
    break # no more options
    ;;
  esac
  shift
done

pkexec --user "$PKEXEC_USER" env DISPLAY="$DISPLAY" $@

This works great locally, and I was expecting it to work in the ssh -Y session as well (given that DISPLAYvariable is set), but it doesn't:

pi@raspberrypi:~ $ gksu bash
==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/usr/bin/env' as the super user
Multiple identities can be used for authentication:
 1.  ,,, (pi)
 2.  root
Choose identity to authenticate as (1-2): 1
Password:
polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

Why does pkexec fail, and (less importantly) why isn't it opening a GUI password prompt? Is there any other option I could use, aside from lxqt-sudo, which would install 150 MB worth of Qt libraries that I don't use otherwise, and is supposedly just as insecure as the original gksudo.

1
  • Interesting question! You might improve yr chances of an answer posting this on U&L SE.
    – Seamus
    Nov 6, 2021 at 19:42

1 Answer 1

2

I found out that a separate copy of /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 must be running in the background within the current session for pkexec to work. If I run it before gksudo bash, then my scrip works fine via SSH as well:

enter image description here

Note that pkexec will not share the xauth cookie for you by default: you need to either configure it to do so by setting org.freedesktop.policykit.exec.allow_gui option to true, or share the cookie manually before you run pkexec:

sudo xauth add $(xauth list $DISPLAY)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.