Polkit

{{Short description|Component of UNIX systems}}

{{Use dmy dates|date=July 2021}}

{{Infobox software

| name = Polkit

| title = polkit

| logo =

| screenshot = PolicyKit-KDEPlasma5.png

| screenshot size = 300px

| caption = KDE Plasma-based front-end

| collapsible =

| author =

| developer = David Zeuthen, Red Hat

| released = {{wikidata|property|edit|reference|P348|P548=Q56514665}}

| latest release version = {{wikidata|property|edit|reference|P348}}

| latest release date = {{start date and age|{{wikidata|qualifier|P348|P577}}}}

| programming language = C

| operating system = Linux, Unix-like

| platform =

| size =

| language =

| status =

| genre = Privilege authorization

| license = LGPL (free software)

| website = {{URL|https://github.com/polkit-org/polkit}}

}}

Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems. It provides an organized way for non-privileged processes to communicate with privileged ones. Polkit allows a level of control of centralized system policy. It is developed and maintained by David Zeuthen from Red Hat and hosted by the freedesktop.org project. It is published as free software under the terms of version 2 of the GNU Lesser General Public License.{{cite web

| url = https://cgit.freedesktop.org/polkit/tree/COPYING

| title = polkit Git COPYING

| publisher = David Zeuthen

| access-date = 15 November 2012}}

Since version 0.105, released in April 2012,{{cite web |url= https://cgit.freedesktop.org/polkit/tree/NEWS.md |title= polkit Git NEWS |publisher= David Zeuthen |access-date= 15 November 2012}}{{cite web |url= https://www.freedesktop.org/software/polkit/releases/ |title= Polkit releases |access-date= 1 September 2018}} the name of the project was changed from PolicyKit to polkit to emphasize that the system component was rewritten{{cite web |url= http://doc.opensuse.org/documentation/html/openSUSE_113/opensuse-security/cha.security.policykit.html |title= Chapter 9. PolicyKit |work= openSUSE Security Guide |publisher= Novell, Inc. and contributors |access-date= 15 November 2012 |archive-url= https://web.archive.org/web/20120827183819/http://doc.opensuse.org/documentation/html/openSUSE_113/opensuse-security/cha.security.policykit.html |archive-date= 27 August 2012 |url-status= dead }} and that the API had changed, breaking backward compatibility.{{cite web |url= https://drfav.wordpress.com/2009/12/22/polkit-and-kde-lets-make-the-point-of-the-situation/ |title= Polkit and KDE: let's make the point of the situation |date= 22 December 2009 |access-date= 15 November 2012}}{{Dubious |reason=Has been referred to as "polkit" a long time before 0.105. Needs an actual quote, not just circumstantial evidence. |date= September 2013}}

Fedora became the first distribution to include PolicyKit, and it has since been used in other distributions, including Ubuntu since version 8.04 and openSUSE since version 10.3. Some distributions, like Fedora,{{cite web |url= https://fedoraproject.org/w/index.php?title=Features/PolicyKitOne&oldid=126848 |title= Features/PolicyKitOne |work= Fedora Project Wiki |access-date= 15 November 2012}} have already switched to the rewritten polkit.

It is also possible to use polkit to execute commands with elevated privileges using the command pkexec followed by the command intended to be executed (with root permission).{{cite web|url= https://www.freedesktop.org/software/polkit/docs/latest/pkexec.1.html|title= pkexec|work= polkit Reference Manual|access-date= 25 May 2013}} However, it may be preferable to use sudo, as this command provides more flexibility and security, in addition to being easier to configure.{{cite web|url= https://askubuntu.com/questions/78352/when-to-use-pkexec-vs-gksu-gksudo|title= When to use pkexec vs. gksu/gksudo?|access-date= 25 May 2013}}

Implementation

The polkitd daemon implements Polkit functionality.{{cite book

| author = Команда разработчиков BLFS

| chapter = 4: Bezopasnost'

| title = За пределами проекта "Linux® с нуля". Версия 7.4

| date = 5 September 2017

| trans-title = Beyond Linux from scratch

| url = https://books.google.com/books?id=OWn5CQAAQBAJ

| language = ru

| volume = 1

| location = Moscow

| publisher = Litres

| publication-date = 2017

| page = 169

| isbn = 9785457831186

| access-date = 5 September 2017

}}

Vulnerability

{{Infobox bug

| name = PwnKit

| CVE = {{CVE|2021-4034}}

| discovered = {{Start date and age|2021|11|18|df=yes}}

| discoverer = Qualys Research Team

| affected hardware = All architectures

| affected software = Polkit (all versions prior to discovery)

| used by = Default on every major Linux distribution

| website = {{URL|https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034|qualys.com}}

}}

A memory corruption vulnerability PwnKit (CVE-2021-4034{{cite web|url=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034|website=Mitre|title=CVE listing for CVE-2021-4034|accessdate=January 25, 2022}}) discovered in the pkexec command (installed on all major Linux distributions) was announced on January 25, 2022.{{cite web|url=https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034|website=Qualys|title=PwnKit: Local Privilege Escalation Vulnerability Discovered in polkit's pkexec (CVE-2021-4034)|date=January 25, 2022|accessdate=January 25, 2022}}{{cite web|url=https://www.zdnet.com/article/major-linux-policykit-security-vulnerability-uncovered-pwnkit/|title=Major Linux PolicyKit security vulnerability uncovered: Pwnkit|website=ZDNet|date=January 25, 2022|accessdate=January 25, 2022}} The vulnerability dates back to the original distribution from 2009. The vulnerability received a CVSS score of 7.8 ("High severity") reflecting serious factors involved in a possible exploit: unprivileged users can gain full root privileges, regardless of the underlying machine architecture or whether the polkit daemon is running or not.

See also

{{Portal|Free and open-source software}}

References

{{Reflist}}