Run Commands as Root Without Authentication

On many Linux-based operating systems, power users can use the /etc/sudoers file to make it possible to run certain command using sudo without being asked to authenticate. KDE Linux has neither /etc/sudoers nor sudo, so how can the same thing be accomplished?

The answer is to set up a systemd service that runs the specified command, and then a polkit rule that allows you to invoke the system service without needing to authenticate.

Systemd service

Here’s an example systemd service that runs /usr/bin/systemd-sysext refresh --always-refresh=yes to refresh systemd extensions:

/etc/systemd/system/sysext-refresh.service

[Unit]
Description=Refresh systemd extensions

[Service]
Type=oneshot
ExecStart=/usr/bin/systemd-sysext refresh --always-refresh=yes

Polkit Rule

And here’s an example polkit rule that allows locally logged-in active members of the wheel group to invoke that systemd service without authenticating:

/etc/polkit-1/rules.d/50-sysext-refresh.rules

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "sysext-refresh.service" &&
        action.lookup("verb") == "start" &&
        subject.local &&
        subject.active &&
        subject.isInGroup("wheel")) {
        return polkit.Result.YES;
    }
});

To further lock down this rule so that it only bypasses authentication for you, replace "wheel" with your username.

Use it

After creating both files, you can refresh systemd extensions without authenticating by invoking the systemd service: systemctl start sysext-refresh.

The same can be done for any other commands; simply create appropriate systemd services and polkit rules for them.

More information

• polkit manual
• systemd service manual

Article contributed by Nate Graham under the CC-BY-4.0 license.