pkcheck

Check PolicyKit authorization for actions

TLDR

Check authorization

$ pkcheck --action-id [org.freedesktop.action] --process [pid]

Check with user

$ pkcheck --action-id [action] --user [username]

Allow user interaction

$ pkcheck --action-id [action] --process [pid] --allow-user-interaction

pkcheck queries the polkit daemon to determine whether a specific process, user, or D-Bus connection is authorized to perform a given action. It is the standard programmatic entry point for non-graphical authorization checks.

PARAMETERS

-a, --action-id ACTION

The polkit action identifier to authorize against (e.g., org.freedesktop.systemd1.manage-units).

-p, --process PID[,START-TIME,UID]

Authorize the named process. Supplying start-time and uid closes a TOCTOU window where a PID can be reused.

-u, --user USER

Authorize as a specific user (only callable by root).

-s, --system-bus-name NAME

Authorize the D-Bus connection identified by NAME.

--allow-user-interaction

Permit polkit to prompt the user via the registered authentication agent.

--enable-internal-agent

Use a built-in text-mode agent when no graphical agent is registered (useful in TTY scripts).

--detail KEY VALUE

Pass extra detail key/value pairs to the polkit policy (used by some action rules).

--help

Display help.

EXIT STATUS

Code	Meaning
0	Authorization granted.
1	Not authorized.
2	Help shown / invocation error.
3	Authentication is required but --allow-user-interaction was not given.

Scripts can branch on these codes to decide whether to escalate via pkexec or skip the operation.

INSTALL

sudo apt install polkitd

sudo apk add polkit-common

CAVEATS

Part of PolicyKit. Requires polkitd running.

HISTORY

pkcheck is part of PolicyKit for checking authorization policies.