s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

pkexec

Run a program as another user (by default root) when polkit allows it.

Level
Extra
Group
Users and groups
Needs root
For changes
Package
polkit

What it does

pkexec is the polkit way to run a command with more rights. polkit checks the rules for the action org.freedesktop.policykit.exec; normally an administrator (on RHEL: member of wheel) must type the own password.

Most admins use sudo. pkexec is used by desktop tools and when sudo is not set up. polkit also controls actions of system services (network, power, disks) — systemctl or nmcli ask polkit when you are not root.

How to write it

pkexec [--user USER] PROGRAM [ARGUMENTS]...
pkexec --disable-internal-agent PROGRAM
pkexec --version | --help

Options 5

Most used

--user USER
Run the program as this user (default root).
--keep-cwd
Keep the current folder (newer versions).
--disable-internal-agent
Do not use the text agent to ask the password.
--help
Show help.
--version
Show the version.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Run a command as root

    pkexec systemctl restart chronyd

    polkit asks the password of an admin user.

  2. 2Run as another user

    pkexec --user apache whoami

    polkit decides if you may.

  3. 3See what polkit allows you in NetworkManager

    nmcli general permissions

    yes / auth / no per action.

  4. 4List all polkit actions

    pkaction | head

    Every action a service checks with polkit.

  5. 5Show details of one action

    pkaction --verbose --action-id org.freedesktop.policykit.exec

    Shows who may do it (implicit any/inactive/active).

  6. 6Check one action for your session

    pkcheck --action-id org.freedesktop.NetworkManager.network-control --process $$ -u

    Tests the rule without doing the action.

  7. 7Find the rule that makes wheel admin

    grep -r wheel /usr/share/polkit-1/rules.d/

    polkit.addAdminRule returns unix-group:wheel.

  8. 8Restart a service as a normal user

    systemctl restart httpd

    Without sudo, systemctl asks polkit, which asks an admin password.

  9. 9Check that the polkit service runs

    systemctl status polkit

    Without it, polkit checks fail.

  10. 10Check the version after a security fix (PwnKit)

    rpm -q polkit

    CVE-2021-4034 (PwnKit) was a root hole in old pkexec versions; keep polkit updated.

Watch out

  • pkexec is setuid root. Keep polkit updated.
  • Own rules go in /etc/polkit-1/rules.d/, not in /usr/share/polkit-1/.

Files

/usr/share/polkit-1/actions/
Actions of the services.
/usr/share/polkit-1/rules.d/
Rules from packages.
/etc/polkit-1/rules.d/
Your own rules.

Exit codes

0The program ran (or its exit code).
126Not authorized, or the dialog was closed.
127polkit not available or the program was not found.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man pkexec

Open the man page (linux.die.net)www.freedesktop.org