pkexec does not launch graphical authentication

Bug #1288786 reported by Ralph Green
68
This bug affects 14 people
Affects Status Importance Assigned to Milestone
policykit-1 (Ubuntu)
Won't Fix
Undecided
Unassigned

Bug Description

Installed Trusty Tahr Lubuntu Beta1 version and added xubuntu desktop. In buth desktops, I tried to launch synaptic to install some packages. If I try to launch from menu, nothing seems to happen. From a terminal, I ran
  pkexec "/usr/sbin/synaptic"
 and saw that it asks for password in the terminal window, instead of popping up an authentication window like previous Ubuntu version did. That was why I saw no authentication request when launching from menu.. I have a workaround)launching from Terminal window), but this should be fixed before release.

ralph@minnie:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=14.04
DISTRIB_CODENAME=trusty
DISTRIB_DESCRIPTION="Ubuntu Trusty Tahr (development branch)"
ralph@minnie:~$ pkexec --version
pkexec version 0.105

Thanks

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in policykit-1 (Ubuntu):
status: New → Confirmed
Revision history for this message
ajgreeny (ajg-charlbury) wrote :

I first saw this after the updates to Lubuntu 14.04 yesterday morning March 13 10:15GMT. In my case it is only the Lubuntu 32bit system that is affected, not Xubuntu or Ubuntu both of which are 64 bit.

I posted the problem to Ubuntuforums http://ubuntuforums.org/showthread.php?t=2210892&p=12956114#post12956114 and gave my workaround for the problem, ie changing the line
   Exec=synaptic-pkexec
in /usr/share/applications/synaptic.desktop to
   Exec=gksudo synaptic
but this very much a workaround which should not be needed.

Revision history for this message
ajgreeny (ajg-charlbury) wrote :

Here is the crash report file from/var/crash which was created earlier today.

Revision history for this message
bapoumba (bapoumba) wrote :

Please see here too : https://bugs.launchpad.net/ubuntu/+source/policykit-1/+bug/1292722
The report is private for now.

Revision history for this message
Fabien Lusseau (fabien-beosfrance) wrote :

Same problem here on a fresh install ! (Lubuntu daily build from 14/03/2014 DD/MM/YY)

I hope this will be fixed before release.

Revision history for this message
Jason (jprokopowich) wrote :

I am seeing a similar problem with an ubuntu upgrade from 15.04 15.10

Revision history for this message
Hubert (pvc-meheha-deactivatedaccount) wrote :

I have exactly the same problem after upgrading from 14.04 to 15.10. I have two users (referred here as X and Y) in sudo group. When I run 'pkexec bash' from terminal I get following message. It doesn't make any difference if I try to authenticate as X or Y.

==== AUTHENTICATING FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/bin/bash' as the super user
Multiple identities can be used for authentication:
 1. X,,, (X)
 2. ,,, (Y)
Choose identity to authenticate as (1-2): 1
Password:
polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie
==== AUTHENTICATION FAILED ===
Error executing command as another user: Not authorized

This incident has been reported.

Revision history for this message
MrTux (mrtux) wrote :

I have same problem in Ubuntu 16.04 when I try to start Synaptic Package Manager.

Revision history for this message
pintubigfoot (pintubigfoot) wrote :

Same happening to me too after today's update

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.1 LTS"

Revision history for this message
Tom Seewald (tseewald) wrote :

What can be done to assist in troubleshooting this issue?

Revision history for this message
Thomas (teclab-at) wrote :

The issue still is open in Ubuntu 18 LTS.

pkexec normally opens a graphical login, but when doing a "su -l <differentuser>" it prints a selection in the terminal. No matter what user is then selected, the authentication will fail.

Revision history for this message
apt-ghetto (apt-ghetto) wrote :

No, pkexec per default does not start a graphical application for security reasons.
If you want to start a graphical application with pkexec, you need a policy in /usr/share/polkit-1/actions.

But, nowadays, it mostly isn't necessary to start a graphical application with elevated privileges, because there are better alternatives.

On *buntu 18.04, synaptic does have a policy => https://packages.ubuntu.com/bionic/amd64/synaptic/filelist
You can start it with synaptic-pkexec. The same command is used in /usr/share/applications/synaptic.desktop

If it does not work and you have a policy, please check, that the PolicyKit Authentication Agent is running (lxsession-default-apps in section autostart) and logout/login.

I don't understand, how "su -l $other_user" is related to this bug report?

Revision history for this message
ԜаӀtеr Ⅼарсһуnѕkі (wxl) wrote :

That last comment is correct and can be further verified in the docs:
https://help.ubuntu.com/community/RootSudo

"gksu has been replaced by pkexec, but even pkexec is being deprecated by the mainline Ubuntu developers. They have taken the position that file manipulation and editing under root should be restricted to the command line.

We can only surmise what the motives were behind this decision: perhaps there are just too many users who run into problems running graphical apps as root. In any case, running graphical apps as root now requires workarounds and additional steps."

Changed in policykit-1 (Ubuntu):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.