Peppermint OS Community Forum

General => Development => Topic started by: ralphy on March 14, 2018, 12:12:17 pm

Title: Please avoid switching pkexec back to gksu whenever possible
Post by: ralphy on March 14, 2018, 12:12:17 pm
Hi Devs,

This is a recommendation for your consideration. As the title says, avoid switching pkexec back to gksu whenever possible, please. This is one of the things that frustrates me the most in Linux Mint (and I generally like Linux Mint, I'm not a hater).

gksu becomes increasingly uncomfortable when running under a non-sudoer account. As you know, gksu does not allow one to authenticate as a different user unless you manually execute gksu asking twice for the password...

Here is a way to see this more clearly:

Login to an account in Peppermint that's not part of the sudoers group. Now try launching the Login Window application to make any modification whatsoever - You're stuck!

The reason I kindly ask for such consideration is because I personally do not run under sudoers account on daily basis and many more users I know don't do it either for sanity. That's linux power at its best after all, to elevate when needed - and pkexec does it way better than the unmaintained gksu!

Bash script sample:

File /usr/bin/lightdm-settings

Code: [Select]
#!/bin/bash
#
# By Ralphy
# use pkexec instead of gksu
# Generic Polkit policy for '/usr/bin/env' executions added for cosmetics in:
# /usr/share/polkit-1/actions/org.peppermint.usr.bin.env.policy

pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY bash -c "/usr/lib/lightdm-settings/lightdm-settings disown &"

File /usr/share/polkit-1/actions/org.peppermint.usr.bin.env.policy

Code: [Select]
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

 <vendor>Peppermint Project</vendor>
 <vendor_url>https://peppermintos.com</vendor_url>

 <action id="org.peppermint.usr.bin.env">
   <description>Run application with elevated privileges</description>
   <message>Authentication required to execute application as super user</message>
   <message xml:lang="es">Autenticación requerida para ejecutar aplicación con permisos administrativos</message>
   <icon_name>stock_person</icon_name>
   <defaults>
     <allow_any>no</allow_any>
     <allow_inactive>no</allow_inactive>
     <allow_active>auth_admin_keep</allow_active>
   </defaults>
   <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/env</annotate>
   <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
 </action>

</policyconfig>
Title: Re: Please avoid switching pkexec back to gksu whenever possible
Post by: PCNetSpec on March 14, 2018, 06:54:04 pm
So where have Mint switched to gksu where Ubuntu use pkexec ?
Title: Re: Please avoid switching pkexec back to gksu whenever possible
Post by: ralphy on March 14, 2018, 07:31:39 pm
At least /usr/bin/lightdm-settings - it executes via gksu instead of pkexec.

Code: [Select]
...
xapp.os.run_with_admin_privs("/usr/lib/lightdm-settings/lightdm-settings", message=message, icon=icon, support_pkexec=False)
...

Maybe my post title didn't really help to get the message across.   :(