Ubuntu – How to create new “gksu” command based on pkexec

command linegeditgksudonautiluspolicykit

When I google “gksu gedit” one of the top entries (How to run gedit and nautilus as root) advises that gksu usage is frowned upon:

gksu hasn't been updated since 2009 and is not recommendedany more. In
fact, Ubuntu no longer ships with gksu by default (though it may be
installed for many of you, because some apps still depend on it) and
it may even be completely removed at some point.

A link to AskUbuntu (Why is gksu no longer installed by default?) suggests pkexec should be used instead but doesn't provide clear and concise steps to do this.

How can I use pkexec within a new wrapper shell script called gsu that supports both gedit and nautilus?

I feel a wrapper script called gsu is most appropriate because my "muscle memory" is to type gksu all the time and I don't want to have to type pkexec instead.

Additionally I would like those pesky gtk warning messages to disappear. Also I would like the terminal prompt back right away instead of waiting for editor or file manager to end.

AU Duplicates: I've searched many Q&A but none are asking (or offering how to) give a complete solution for gsu wrapper script to call pkexec AND install all necessary policy kits AND get rid of pesky gtk warnings AND get terminal prompt back right away… All in one answer.

Best Answer

Before you can use pkexec with gedit and nautilus you need to copy the polkit rules to support them. This will automatically be done in Ubuntu 17.04 but in the mean time you need to wget them.

Nautilus Policy Kit

wget https://raw.githubusercontent.com/hotice/webupd8/master/org.gnome.nautilus.policy -O /tmp/org.gnome.nautilus.policy
sudo cp /tmp/org.gnome.nautilus.policy /usr/share/polkit-1/actions/

Gedit Policy Kit

wget https://raw.githubusercontent.com/hotice/webupd8/master/org.gnome.gedit.policy -O /tmp/org.gnome.gedit.policy
sudo cp /tmp/org.gnome.gedit.policy /usr/share/polkit-1/actions/

"gsu" bash script to replace "gksu"

Creating a bash script is one of two ways to call pxexec using the somewhat familiar term of gsu. Create this file in one of your paths:

#!/bin/bash

# Usage: gsu gedit file1 file2...
#  -OR-  gsu natuilus /dirname

# & is used to spawn process and get prompt back ASAP
# > /dev/null is used to send gtk warnings into dumpster

COMMAND=$1 # extract gedit or nautilus

pkexec "$COMMAND" "${@:2}" &> /dev/null&

Save the file and mark it as executable with chmod +x gsu

Now instead of typing gksu to edit grub configuration you can use:

gsu gedit /etc/default/grub

"gsu" as an alias of "pkexec" to replace "gksu"

Creating an alias is the second option to call pxexec using the somewhat familiar term of gsu. Open the file ~/.bashrc and search for alias. You will see this:

# some more ls aliases
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'

After the last line add this:

alias gsu='pkexec'

Save the file and exit.

Related Solutions

Ubuntu – How to create a new file

In larger context: what you want to do?

In answer to question: most probably you are missing directory /etc/xinetd.d. Try installing xinetd first (sudo apt-get install xinetd).

Ubuntu – When to use pkexec vs. gksu/gksudo

PolicyKit is more configurable, though pkexec doesn't make use of this configurability. Also, pkexec show the user the full path of the program that will be started, to that the user is a bit more sure what will happen. The so-called 'policies` of PolicyKit can be used to set more advances settings. For example, whether the password should be remembered.

Something I got from the pkexec manual:

The environment that PROGRAM will run it, will be set to a minimal known and safe environment in order to avoid injecting code through LD_LIBRARY_PATH or similar mechanisms. In addition the PKEXEC_UID environment variable is set to the user id of the process invoking pkexec. As a result, pkexec will not allow you to run e.g. X11 applications as another user since the $DISPLAY environment variable is not set.

More information on policies or action definitions from the pkexec manual:

   To specify what kind of authorization is needed to execute the program
   /usr/bin/pk-example-frobnicate as another user, simply write an action
   definition file like this

       <?xml version="1.0" encoding="UTF-8"?>
       <!DOCTYPE policyconfig PUBLIC
        "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
        "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
       <policyconfig>

         <vendor>Examples for the PolicyKit Project</vendor>
         <vendor_url>http://hal.freedesktop.org/docs/PolicyKit/</vendor_url>

         <action id="org.freedesktop.policykit.example.pkexec.run-frobnicate">
           <description>Run the PolicyKit example program Frobnicate</description>
           <description xml:lang="da">Kør PolicyKit eksemplet Frobnicate</description>
           <message>Authentication is required to run the PolicyKit example program Frobnicate</message>
           <message xml:lang="da">Autorisering er påkrævet for at afvikle PolicyKit eksemplet Frobnicate</message>
           <icon_name>audio-x-generic</icon_name>
           <defaults>
             <allow_any>no</allow_any>
             <allow_inactive>no</allow_inactive>
             <allow_active>auth_self_keep</allow_active>
           </defaults>
           <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/pk-example-frobnicate</annotate>
         </action>

       </policyconfig>

   and drop it in the /usr/share/polkit-1/actions directory under a
   suitable name (e.g. matching the namespace of the action). Note that in
   addition to specifying the program, the authentication message,
   description, icon and defaults can be specified. For example, for the
   action defined above, the following authentication dialog will be
   shown:

       [IMAGE][2]

           +----------------------------------------------------------+
           |                     Authenticate                     [X] |
           +----------------------------------------------------------+
           |                                                          |
           |  [Icon]  Authentication is required to run the PolicyKit |
           |          example program Frobnicate                      |
           |                                                          |
           |          An application is attempting to perform an      |
           |          action that requires privileges. Authentication |
           |          is required to perform this action.             |
           |                                                          |
           |          Password: [__________________________________]  |
           |                                                          |
           | [V] Details:                                             |
           |  Command: /usr/bin/pk-example-frobnicate                 |
           |  Run As:  Super User (root)                              |
           |  Action:  org.fd.pk.example.pkexec.run-frobnicate        |
           |  Vendor:  Examples for the PolicyKit Project             |
           |                                                          |
           |                                  [Cancel] [Authenticate] |
           +----------------------------------------------------------+

   If the user is using the da_DK locale, the dialog looks like this:

       [IMAGE][3]

           +----------------------------------------------------------+
           |                     Autorisering                     [X] |
           +----------------------------------------------------------+
           |                                                          |
           |  [Icon]  Autorisering er påkrævet for at afvikle         |
           |          PolicyKit eksemplet Frobnicate                  |
           |                                                          |
           |          Et program forsøger at udføre en handling der   |
           |          kræver privilegier. Autorisering er påkrævet.   |
           |                                                          |
           |          Kodeord: [___________________________________]  |
           |                                                          |
           | [V] Detaljer:                                            |
           |  Bruger:   Super User (root)                             |
           |  Program:  /usr/bin/pk-example-frobnicate                |
           |  Handling: org.fd.pk.example.pkexec.run-frobnicate       |
           |  Vendor:   Examples for the PolicyKit Project            |
           |                                                          |
           |                                [Annullér] [Autorisering] |
           +----------------------------------------------------------+

   Note that pkexec does no validation of the ARGUMENTS passed to PROGRAM.
   In the normal case (where administrator authentication is required
   every time pkexec is used), this is not a problem since if the user is
   an administrator he might as well just run pkexec bash to get root.

   However, if an action is used for which the user can retain
   authorization (or if the user is implicitly authorized), such as with
   pk-example-frobnicate above, this could be a security hole. Therefore,
   as a rule of thumb, programs for which the default required
   authorization is changed, should never implicitly trust user input
   (e.g. like any other well-written suid program).