I need an equivalent of gksu in 18.04

I've read a lot of threads about gksu being removed from many Linux flavours, including Ubuntu 18.04. Many state that gksu is an abomination and no user should ever need to use anything like it. I have 2 examples where, as far as I know, I must have something that allows me to run as root (not just for editing files).

First, I have a need to start mysql only after an encrypted folder is opened on (GUI) command. This means having a script run by the encryption system that starts the mysql service. That has to be done as root, so I use gksu in that startup script which asks me for a password. How else can I start a service from a GUI system?

I also run Ubuntu system backups as root, otherwise many system files can't be backed up. So the desktop file uses gksu to start the backup.

pkexec looks complicated, needing policy files. Is that the only alternative, and if so, why is it any safer?

Other answers to similar questions don't seem to address individual issues that people have now that gksu is no more (or harder to find...). I think such questions from non-expert users would benefit from more detailed answers. I now have some, and so would like to answer my own question.

Solution 1:

I found this command

alias gksu='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY'

in this page

After running the alias command:

gksu /path/to/script.sh

It will ask you for a password like normal.

You will need to add the alias to the end of ~/.bashrc in order to keep the gksu command persistent on reboot.

Solution 2:

I know there are said to be answers to this elsewhere, but I have not found any of them clear and simple enough for me to resolve this issue. So I dug around in many places and came up with this. I still don’t understand why the Linux community has decided to make life so hard for us simple desktop users (and I have tried to understand many explanations), but that’s life. I use the GUI for just about everything, only using the terminal window when necessary. As far as I can tell solutions using sudo options don’t help with this. So I have .desktop files and scripts that do all the jobs I use regularly.

There are two basic solutions.

1. Reinstall gksu

This solution may or may not last. Anti-gksu techies may find a way to stop it. But in the mean time, download 2 .deb files from libgksu (x64) and gksu (x64). Install libgksu2 and then gksu using gdebi or whichever installation tool you like to use. This worked for me.

2. Use pkexec

As a (hopefully) longer term solution, I managed to get pkexec to work for the tools I need.

1. To start a service from a script. It turns out that neither gksu or pkexec is needed. Just start service xyz and it will ask for your password.

2. To edit root files, or to open nautilus as root, see How To Run Gedit And Nautilus As Root With pkexec Instead Of gksu - Web Upd8. This provides two ‘polkit’ files for pkexec, that allow you to use a script containing pkexec gedit to edit a root file, and similarly for nautilus. The instructions are all on that web page. I’m now using ‘filemanager-actions’ to provide right-click actions to run gedit or nautilus as root.

3. I run deja-dup as root for backups of the core system. I do this infrequently, excluding /home (for /home I do frequent backups that don’t need root access). To get this to work I took a copy of the file used in step 2 for gedit and edited it for deja-dup. I don’t really understand the contents, but it does work, both for backups and to restore files, using pkexec backup in a script initiated from a .desktop file. I added this new file to /usr/share/polkit-1/actions containing:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD polkit Policy Configuration 1.0//EN" "http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
   
   <policyconfig>
     <icon_name>deja-dup</icon_name>
   
     <action id="org.gnome.DejaDup">
       <description gettext-domain="deja-dup">Backup</description>
       <message gettext-domain="deja-dup">Privileges are required to backup system files</message>
       <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
       <allow_active>auth_admin</allow_active>
        </defaults>
       <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/deja-dup</annotate>
       <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
     </action>
   
   </policyconfig>
   

   Note that there is another deja-dup file in this directory, which claims to help with restoring files, but I couldn’t get it to work. This new file needs to have a unique name, such as org.gnome.DejaDupNew.policy.

I am, for now, running without gksu. I’ll try to carry on…

Solution 3:

Nautilus Admin (nautilus-admin) is a simple Python extension for the Nautilus file manager that adds some administrative actions to the right-click menu:

• Open as Administrator: opens a folder in a new Nautilus window running with administrator (root) privileges.
• Edit as Administrator: opens a file in a Gedit window running with administrator (root) privileges.

To install Nautilus Admin in all currently supported versions of Ubuntu open the terminal and type:

sudo apt install nautilus-admin

I've tested all the alternatives to gksu in 18.04 for other applications besides Files and Gedit, and the one that seems to work the most consistently is:

sudo -H appname &>/dev/null

pkexec is the best replacement for gksu when it works because it provides higher security, but it is very inconsistent across different apps (for example it doesn't work with Gedit) and can cause crashing with some apps. sudo -i is unnecessarily difficult to manage because it elevates your privileges to root for an extended period of time when you only need to be root to run a single command.