pkexec – execute a command as another user

pkexec is a command-line utility that allows an authorised user to execute a program with another user’s privileges. It forms part of polkit, the system service and policy framework used to manage authorisation for privileged operations.

Unlike sudo, which commonly relies on rules in a sudoers configuration file, pkexec uses polkit authorisation policies. These policies determine whether a caller may perform an operation and whether additional authentication is required.

The application is commonly encountered when a desktop program needs administrative privileges for a particular operation. It can also be invoked directly from a terminal to execute a command as root or another specified user.

Authentication normally takes place through an agent associated with the user’s desktop session. When no suitable agent is available, pkexec can provide a text-based authentication prompt.

The execution environment is deliberately restricted. Potentially dangerous environment variables are removed before starting the privileged process, reducing the risk of unintended code execution through inherited settings.

Applications can define specific polkit actions that control how their privileged operations are authorised. This allows administrators to establish policies appropriate to particular programs rather than granting unrestricted access.

Because pkexec performs privileged operations, the polkit configuration and the programs it launches must be trusted.

This is free and open source software.

Key Features

• Execute authorised programs as root or another specified user.
• Evaluate authorisation requests using polkit policies.
• Use graphical authentication agents associated with desktop sessions.
• Provide a text-based authentication agent when no session agent is available.
• Allow applications to define dedicated authorisation actions.
• Support custom authentication messages and descriptions.
• Display the program being authorised in authentication prompts.
• Sanitise environment variables before privileged execution.
• Record the invoking user’s ID in the PKEXEC_UID environment variable.
• Support the –user option for selecting another user identity.
• Provide –keep-cwd to preserve the current working directory.
• Allow the internal authentication agent to be disabled.
• Return distinct exit codes for dismissed and unsuccessful authorisation requests.

Website: gitlab.freedesktop.org/polkit/polkit
Support:
Developer: Red Hat, Inc.
License: GNU Lesser General Public License v2.0

pkexec is written in C. Learn C with our recommended free books and free tutorials.

Alternatives to sudo

Explore Linux
	Best Free and Open Source Software - A huge collection of recommended free and open source software covering every major category.
	In-depth Linux Software Reviews - Detailed assessments of Linux software covering features, usability and overall quality.
	The Big List of Active Linux Distros - An extensive collection of actively developed Linux distributions.
	Open Source Alternatives - Alternatives to software and services from Google, Microsoft, Apple, Adobe, IBM, Autodesk, Oracle and others.
	Essential Linux System Tools - Indispensable utilities for monitoring, maintaining and managing Linux systems.
	Linux Productivity Tools - Useful utilities for improving productivity and streamlining everyday tasks.
	Alternatives to Popular CLI Tools - Modern alternatives to familiar command-line utilities supplied with Linux systems.
	Awesome Free Linux Game Tools - Tools, utilities and companion software that improve gaming on Linux.
	Machine Learning on Linux - Machine learning and deep learning software, self-hosted applications and practical tools.
	Saving Money with Linux - Practical ways to reduce electricity consumption and lower computing costs with Linux.
	Linux Candy - Fun, entertaining and sometimes delightfully quirky software from the lighter side of Linux.