Ubuntu – By default, who is allowed to gain root privileges with pkexec

policykitroot

I learned today that one can use pkexec from the command line, in a manner similar to sudo, to execute programs with root privileges. I am curious how pkexec decides who is allowed to do this.

The man page for pkexec(1) says

By default, the org.freedesktop.policykit.exec authorization is required unless an action definition file is present for the program in question.

This is a little challenging to parse for someone unfamiliar with policykit. But with a little guessing, let's have a look at /usr/share/polkit-1/actions/org.freedesktop.policykit.policy. In the org.freedesktop.policykit.exec section we see the string auth_admin.

Referring to polkit(8), we see:

auth_admin

Authentication by an administrative user is required.

Who exactly is an "administrative user" in this sense? What tests are done to determine whether a user is "administrative"? The config files get progressively harder to find and understand.

I am aware this is configurable. I want to know the default for, say, Ubuntu 15.04.

Best Answer

By default, it's the members of the sudo group, and the root user, by virtue of these files in /etc/polkit/localauthority.conf.d/:

$ tail /etc/polkit-1/localauthority.conf.d/*
==> /etc/polkit-1/localauthority.conf.d/50-localauthority.conf <==
# Configuration file for the PolicyKit Local Authority.
#
# DO NOT EDIT THIS FILE, it will be overwritten on update.
#
# See the pklocalauthority(8) man page for more information
# about configuring the Local Authority.
#

[Configuration]
AdminIdentities=unix-user:0

==> /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf <==
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

The first file grants access to UID 0 (root), and the second to the groups sudo and admin. admin isn't really used on Ubuntu, but sudo is, and it's the group used to grant access to sudo as well.

Related Solutions

Ubuntu – How to create a user with root privileges in bash

Haven't tried it but this should create a new user and add them to the sudo group, which if your /etc/sudoers is as default, should mean they're allowed to use sudo with their password (just like the standard first user):

sudo adduser --group sudo newusername

If you've already created the user, you can just run:

sudo adduser existing_user sudo

man adduser will show you some of the other billion permutations and combinations of arguments this tool has.

Note: If you use Ubuntu 11.10 or older, you should use the admin group instead of sudo.

Ubuntu – How to gain root privileges

There are 2 ways to do things with elevated permissions.

sudo lets you run commands in your own user account with root privileges.

su lets you switch user so that you're actually logged in as root. But this options is by default disabled on Ubuntu. Instead you can simply start a root shell with sudo -i.

Read What are the differences between "su", "sudo -s", "sudo -i", "sudo su"? for more information.

Use either method only as and when needed, they can cause your system damage if used without caution.

Best Answer

Related Solutions

Ubuntu – How to create a user with root privileges in bash

Ubuntu – How to gain root privileges

Related Question