Polkit

Polkit, short for PolicyKit, is a framework for centralizing and defining authorization policies that govern privileged actions on Unix-like systems. It enables applications to request elevated permissions without embedding privileged logic, by separating policy decisions from application code. Polkit runs as a D-Bus service (polkitd) and enforces policies that determine whether a given action by a given user should be allowed.

The typical workflow involves an unprivileged application requesting authorization through the PolicyKit D-Bus API. If the requested action requires authentication, polkitd delegates to an authentication agent (such as polkit-gnome or lxpolkit) to prompt the user for credentials. Upon successful authentication, polkitd issues a temporary authorization that permits the action for a limited period or under defined circumstances. Policies can be cached, reducing repeated prompts for frequent actions.

Policy is defined through action descriptions and rules. Actions are described in XML files under /usr/share/polkit-1/actions, while local overrides and rules live in /etc/polkit-1/rules.d. Rules are written in JavaScript and evaluated by polkitd to decide whether a given subject (user or group) may perform a specific action under the current context. The system administrator can tailor which actions require authentication and which subjects are granted permissions automatically.

Polkit is widely used by desktop environments such as GNOME and KDE, as well as core system services (for example, system components like NetworkManager or login managers) to authorize tasks such as mounting devices, changing system settings, or managing user accounts. It originated in the late 2000s and is maintained as a freedesktop.org project, with continued updates to address security and compatibility concerns.