pkexec

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

pkexec is the polkit way to run a command with more rights. polkit checks the rules for the action org.freedesktop.policykit.exec; normally an administrator (on RHEL: member of wheel) must type the own password.

Most admins use sudo. pkexec is used by desktop tools and when sudo is not set up. polkit also controls actions of system services (network, power, disks) — systemctl or nmcli ask polkit when you are not root.

طريقة الكتابة

pkexec [--user USER] PROGRAM [ARGUMENTS]...
pkexec --disable-internal-agent PROGRAM
pkexec --version | --help

الخيارات 5

الأكثر استخدامًا

--user USER: Run the program as this user (default root).
--keep-cwd: Keep the current folder (newer versions).
--disable-internal-agent: Do not use the text agent to ask the password.
--help: Show help.
--version: Show the version.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Run a command as root
```
$pkexec systemctl restart chronyd
```
polkit asks the password of an admin user.
2Run as another user
```
$pkexec --user apache whoami
```
polkit decides if you may.
3See what polkit allows you in NetworkManager
```
$nmcli general permissions
```
yes / auth / no per action.
4List all polkit actions
```
$pkaction | head
```
Every action a service checks with polkit.
5Show details of one action
```
$pkaction --verbose --action-id org.freedesktop.policykit.exec
```
Shows who may do it (implicit any/inactive/active).

6Check one action for your session

$pkcheck --action-id org.freedesktop.NetworkManager.network-control --process $$ -u

Tests the rule without doing the action.

7Find the rule that makes wheel admin
```
$grep -r wheel /usr/share/polkit-1/rules.d/
```
polkit.addAdminRule returns unix-group:wheel.
8Restart a service as a normal user
```
$systemctl restart httpd
```
Without sudo, systemctl asks polkit, which asks an admin password.
9Check that the polkit service runs
```
$systemctl status polkit
```
Without it, polkit checks fail.
10Check the version after a security fix (PwnKit)
```
$rpm -q polkit
```
CVE-2021-4034 (PwnKit) was a root hole in old pkexec versions; keep polkit updated.

انتبه

pkexec is setuid root. Keep polkit updated.
Own rules go in /etc/polkit-1/rules.d/, not in /usr/share/polkit-1/.

الملفات

/usr/share/polkit-1/actions/: Actions of the services.
/usr/share/polkit-1/rules.d/: Rules from packages.
/etc/polkit-1/rules.d/: Your own rules.

رموز الخروج

`0`	The program ran (or its exit code).
`126`	Not authorized, or the dialog was closed.
`127`	polkit not available or the program was not found.

`pkexec`

ماذا يفعل

طريقة الكتابة

الخيارات 5

أمثلة 10

1Run a command as root

2Run as another user

3See what polkit allows you in NetworkManager

4List all polkit actions

5Show details of one action

6Check one action for your session

7Find the rule that makes wheel admin

8Restart a service as a normal user

9Check that the polkit service runs

10Check the version after a security fix (PwnKit)

انتبه

الملفات

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الخيارات 5

أمثلة 10

1Run a command as root

2Run as another user

3See what polkit allows you in NetworkManager

4List all polkit actions

5Show details of one action

6Check one action for your session

7Find the rule that makes wheel admin

8Restart a service as a normal user

9Check that the polkit service runs

10Check the version after a security fix (PwnKit)

انتبه

الملفات

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`pkexec`