Polkit
Template:Short description Template:DMCA
Page Module:Infobox/styles.css has no content.
| polkit | |
|---|---|
| Lua error in package.lua at line 80: module 'Module:InfoboxImage/data' not found. KDE Plasma-based front-end | |
| [[Programmer|DeveloperTemplate:Pluralize from text]] | David Zeuthen, Red Hat |
| Initial release | Template:Wikidata |
| Written in | C |
| Operating system | Linux, Unix-like |
| Type | Privilege authorization |
| License | LGPL (free software) |
| Website | github |
Script error: No such module "Check for conflicting parameters".
Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged ones. Polkit allows a level of control of centralized system policy. It is developed and maintained by David Zeuthen from Red Hat and hosted by the freedesktop.org project. It is published as free software under the terms of version 2 of the GNU Lesser General Public License.[1]
Since version 0.105, released in April 2012,[2][3] the name of the project was changed from PolicyKit to polkit to emphasize that the system component was rewritten[4] and that the application programming interface had changed, breaking backward compatibility.[5][dubious – discuss]
Fedora became the first distribution to include PolicyKit, and it has since been used in other distributions, including Ubuntu since version 8.04 and openSUSE since version 10.3. Some distributions, like Fedora,[6] have already switched to the rewritten polkit.
It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission).[7] Systemd provides an alternate interface to polkit called run0.
Implementation
The polkitd daemon implements Polkit functionality.[8]
Security
Template:Infobox bugPolkit improves on the security offered by sudo by avoiding SUID binaries, which are the primary cause of privilege escalation vulnerabilities on Unix-like systems.[9]
Nevertheless, as with sudo, several privilege escalation vulnerabilities have been found in polkit. The memory corruption vulnerability PwnKit (CVE-2021-4034[10]) discovered in the pkexec command (installed on all major Linux distributions) was announced on January 25, 2022.[11][12] The vulnerability dates back to the original distribution from 2009. The vulnerability received a CVSS score of 7.8 ("High severity") reflecting serious factors involved in a possible exploit: unprivileged users can gain full root privileges, regardless of the underlying machine architecture or whether the polkit daemon is running or not. A fix was published on the same day, and later incorporated into the version 121 release[13].
See also
Lua error in mw.title.lua at line 404: bad argument #2 to 'title.new' (unrecognized namespace name 'Portal').
- Pluggable authentication module
- Principle of least privilege
- PackageKit
- User Account Control – a similar feature introduced in Windows Vista and still exists in Windows 11
References
Page Template:Reflist/styles.css has no content.
- ^ Page Module:Citation/CS1/styles.css has no content."polkit Git COPYING". David Zeuthen. Retrieved 15 November 2012.
- ^ Page Module:Citation/CS1/styles.css has no content."polkit Git NEWS". David Zeuthen. Retrieved 15 November 2012.
- ^ Page Module:Citation/CS1/styles.css has no content."Polkit releases". Retrieved 1 September 2018.
- ^ Page Module:Citation/CS1/styles.css has no content."Chapter 9. PolicyKit". openSUSE Security Guide. Novell, Inc. and contributors. Archived from the original on 27 August 2012. Retrieved 15 November 2012.
- ^ Page Module:Citation/CS1/styles.css has no content."Polkit and KDE: let's make the point of the situation". 22 December 2009. Retrieved 15 November 2012.
- ^ Page Module:Citation/CS1/styles.css has no content."Features/PolicyKitOne". Fedora Project Wiki. Retrieved 15 November 2012.
- ^ Page Module:Citation/CS1/styles.css has no content."pkexec". polkit Reference Manual. Retrieved 25 May 2013.
- ^ Page Module:Citation/CS1/styles.css has no content.Команда разработчиков BLFS (5 September 2017). "4: Bezopasnost'". За пределами проекта "Linux® с нуля". Версия 7.4 [Beyond Linux from scratch] (in русский). Vol. 1. Moscow: Litres (published 2017). p. 169. ISBN 9785457831186. Retrieved 5 September 2017.
- ^ Page Module:Citation/CS1/styles.css has no content.Kanner, Andrey M.; Kanner, Tatiana M. (May 2024). "SUID Binaries in GNU/Linux: The Feature or the Bug?". 2024 IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT). pp. 46–48. doi:10.1109/USBEREIT61901.2024.10584001. ISBN 979-8-3503-6289-3.
- ^ Page Module:Citation/CS1/styles.css has no content."CVE listing for CVE-2021-4034". Mitre. Retrieved 25 January 2022.
- ^ Page Module:Citation/CS1/styles.css has no content."PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit's pkexec (CVE-2021-4034)". Qualys. 25 January 2022. Retrieved 25 January 2022.
- ^ Page Module:Citation/CS1/styles.css has no content."Major Linux PolicyKit security vulnerability uncovered: Pwnkit". ZDNet. 25 January 2022. Retrieved 25 January 2022.
- ^ Page Module:Citation/CS1/styles.css has no content."Commits - 827b0ddac5b1ef00a47fca4526fcf057bee5f1db - polkit / polkit". Freedesktop.org GitLab. 11 June 2022. Retrieved 22 May 2026.
External links
Page Module:Side box/styles.css has no content.Page Template:Sister project/styles.css has no content.
- polkit GitHub repository at github.com
- Documentation at freedesktop.org
- Why polkit explaining polkit's role in a modern system
