Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
pkexec is the polkit way to run a command with more rights. polkit checks the rules for the action org.freedesktop.policykit.exec; normally an administrator (on RHEL: member of wheel) must type the own password.
Most admins use sudo. pkexec is used by desktop tools and when sudo is not set up. polkit also controls actions of system services (network, power, disks) — systemctl or nmcli ask polkit when you are not root.
Zo schrijf je het
pkexec [--user USER] PROGRAM [ARGUMENTS]...
pkexec --disable-internal-agent PROGRAM
pkexec --version | --helpOpties 5
Meest gebruikt
Niets past bij dit filter.
Voorbeelden 10
$ als gewone gebruiker# als root (of met sudo)
1Run a command as root
pkexec systemctl restart chronydpolkit asks the password of an admin user.
2Run as another user
pkexec --user apache whoamipolkit decides if you may.
3See what polkit allows you in NetworkManager
nmcli general permissionsyes / auth / no per action.
4List all polkit actions
pkaction | headEvery action a service checks with polkit.
5Show details of one action
pkaction --verbose --action-id org.freedesktop.policykit.execShows who may do it (implicit any/inactive/active).
6Check one action for your session
pkcheck --action-id org.freedesktop.NetworkManager.network-control --process $$ -uTests the rule without doing the action.
7Find the rule that makes wheel admin
grep -r wheel /usr/share/polkit-1/rules.d/polkit.addAdminRulereturns unix-group:wheel.8Restart a service as a normal user
systemctl restart httpdWithout sudo, systemctl asks polkit, which asks an admin password.
9Check that the polkit service runs
systemctl status polkitWithout it, polkit checks fail.
10Check the version after a security fix (PwnKit)
rpm -q polkitCVE-2021-4034 (PwnKit) was a root hole in old pkexec versions; keep polkit updated.
Niets past bij dit filter.
Let op
- pkexec is setuid root. Keep polkit updated.
- Own rules go in /etc/polkit-1/rules.d/, not in /usr/share/polkit-1/.
Bestanden
/usr/share/polkit-1/actions/- Actions of the services.
/usr/share/polkit-1/rules.d/- Rules from packages.
/etc/polkit-1/rules.d/- Your own rules.
Exitcodes
0 | The program ran (or its exit code). |
126 | Not authorized, or the dialog was closed. |
127 | polkit not available or the program was not found. |