Ubuntu – use pkexec in a python script or a .desktop file

desktopgksupkexecpython

From the following questions

we see that gksu will no longer be supported in the long term, and it will not be installed by default from >= 13.04. Instead we should use pkexec which does its job fine for non-graphical applications but not for apllications on the GUI:

pkexec gedit

when replacing gksu in a .desktop file

EXEC=pkexec /usr/bin/gedit

or when I run a python script to run a graphical application with root permissions I get the following error:

>>>subprocess.Popen(['pkexec','gedit'])
** (gedit:3203): WARNING **: Could not open X display

How would I have to re-write my scripts or my .desktop files to support an authentication dialog and run an application as root if I should not have it depend on gksu?

Best Answer

First create a .policy action file in /usr/share/polkit-1/actions/. It's conventional to name action files in a "vendor hierarchical" way, such as com.ubuntu.pkexec.gparted.policy or org.debian.apt.policy

Then paste the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">

<policyconfig>

  <action id="org.freedesktop.policykit.pkexec.run-[Short Program Name]">
    <description>Run [Full Program Name]</description>
    <message>Authentication is required to run [Full Program Name]</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">[Full Program Path]</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">TRUE</annotate>
  </action>

</policyconfig>

Replace [Short/Full Program Name/Path] with appropriate values, for example gedit, gedit Text Editor and /usr/bin/gedit. <action id> value does not need to match the chosen filename (and a single file can contain multiple actions), but conventionally filename is the prefix for all its actions.

After saving the file the specific program would run with X and GUI and such.

Another fix seems to be: Add the following line in /etc/pam.d/polkit-1:

session optional pam_xauth.so