20

There are various tools for various desktops that aim to run a graphical application as root. gksudo, kdesudo, empower, etc...

But what if I'm writing a script that could be used on any Linux desktop? Is there an xdg-sudo of some sort..? A standard for getting sudo access in a desktop environment?

Oli
  • 293,335

3 Answers3

18

Following @Tachyons suggestion, I researched a LOT about pkexec and it is awesome!

  • It is part of PolicyKit, a widely used package.
  • Hosted and sponsored by freedesktop.org
  • Default in Gnome, Unity, MATE, Cinnamon, KDE, LXDE and XFCE, and possibly others
  • Works via D-Bus, so it's completely desktop-neutral, with a well-defined protocol.
  • In many DEs it is used in several services like login screen, shutdown/restart, disk management (udisks/automount) and so on.

So yes, it meets all requirements, and I guess it's the closest thing an "universal gksudo" can be.

That said, pkexecis the command-line front-end to PolicyKit. There are 2 basic modes of operation:

  • Simply run it as you would with sudo, and you get a nice GUI prompt:

    $ pkexec rm -rfX /

pkexec GUI prompt

  • Or create a PolicyKit authorization file for you application, drop it in /usr/share/polkit-1/rules.d, and it will allow a great deal of customization and security-related options, for example root access for certain actions only, no need of password for others, access limited to certain paths, etc. You can fine-tune your settings with amazing granularity.
MestreLion
  • 20,086
  • For some reason, in XFCE on Xubuntu 19.04 running pkexec filelight / makes FileLight die due to DISPLAY being unset. I had to explicitly launch it as pkexec env DISPLAY=$DISPLAY filelight, in which case it ran successfully. – Ruslan Mar 20 '20 at 19:42
  • 'pkexec rm ...' is a dangerous command with options to offer as an example – philcolbourn Mar 30 '22 at 02:40
  • 1
    @philcolbourn fair point, tho I believe such wiping is disabled by default in most distros. Still, I've changed it to a safe variation by adding a non-existing flag, it'll avoid copy-and-paste issues by outputting an error. – MestreLion Mar 30 '22 at 05:03
6

A more general way would be to write a "helper program". Such a program would prompt the user for a password; if you are sure that, say, Zenity, is installed, you can use that, otherwise you'll need to write the helper program in Python or something else that can interact with the GUI.

Read the sudo manual for the -A ("askpass") and -S (stdin) options.

And remember that when you run sudo from your script, you need the -H (home) option to simulate gksudo.

This method works well, but you need to test the helper program thoroughly to ensure that it is bug-free.

Paddy Landau
  • 4,548
4

No, there isn't any standard way of getting root (or any other user's) privileges.

If you want to be compatible with as much systems as possible don't assume any way but tell the user that she/he has to run your script as a specific user. Then it's up to the user/admin to configure the system so your script is run in a proper way.

Making some suggestion for how to use the most common authentication systems, like su, sudo and ConsoleKit, would be nice.

Florian Diesch
  • 87,389
  • True for early 2009, but thankfully now polkit (formely PolicyKit) is widespread enough to be considered a standard. – MestreLion May 02 '13 at 22:48