I've read a lot of threads about gksu being removed from many linux flavours, including ubuntu 18.04. Many state that gksu is an abomination and no user should ever need to use anything like it. I have 2 examples where, as far as I know, I must have something that allows me to run as root (not just for editing files).

First, I have a need to start mysql only after an encrypted folder is opened on (GUI) command. This means having a script run by the encryption system that starts the mysql service. That has to be done as root, so I use gksu in that startup script which asks me for a password. How else can I start a service from a GUI system?

I also run ubuntu system backups as root, otherwise many system files can't be backed up. So the desktop file uses gksu to start the backup.

pkexec looks complicated, needing policy files. Is that the only alternative, and if so, why is it any safer?

Other answers to similar questions don't seem to address individual issues that people have now that gksu is no more (or harder to find...). I think such questions from non-expert users would benefit from more detailed answers. I now have some, and so would like to answer my own question.

I found this command alias gksu='pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY' in the page below
https://sites.google.com/site/installationubuntu/home/ubuntu-17-10/alternatives-for-gksu-and-gksudo

I know there are said to be answers to this elsewhere, I have not found any of them clear and simple enough for me to resolve this issue. So I dug around in many places and came up with this. I still don’t understand why the linux community has decided to make life so hard for us simple desktop users (and I have tried to understand many explanations), but that’s life. I use the gui for just about everything, only using the terminal window when necessary. As far as I can tell solutions using sudo options don’t help with this. So I have .desktop files and scripts that do all the jobs I use regularly.

There are two basic solutions.

1. Reinstall gksu

This solution may or may not last. Anti-gksu techies may find a way to stop it. But in the mean time, download 2 .deb files from libgksu (x64) and gksu (x64). Install libgksu2 and then gksu using gdebi or whichever installation tool you like to use. This worked for me.

2. Use pkexec

As a (hopefully) longer term solution, I managed to get pkexec to work for the tools I need.

1. To start a service from a script. It turns out that neither gksu or pkexec is needed. Just start service xyz and it will ask for your password.




2. To edit root files, or to open nautilus as root, see How To Run Gedit And Nautilus As Root With pkexec Instead Of gksu - Web Upd8. This provides two ‘polkit’ files for pkexec, that allow you to use a script containing pkexec gedit to edit a root file, and similarly for nautilus. The instructions are all on that web page. I’m now using ‘filemanager-actions’ to provide right-click actions to run gedit or nautilus as root.



3. 
   

   I run deja-dup as root for backups of the core system. I do this infrequently, excluding /home (for /home I do frequent backups that don’t need root access). To get this to work I took a copy of the file used in step 2 for gedit and edited it for deja-dup. I don’t really understand the contents, but it does work, both for backups and to restore files, using pkexec backup in a script initiated from a .desktop file. I added this new file to /usr/share/polkit-1/actions containing:

   
   
   

   <?xml version="1.0" encoding="UTF-8"?>
   
   <!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD polkit Policy Configuration 1.0//EN" "http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
   
   
   
   <policyconfig>
   
     <icon_name>deja-dup</icon_name>
   
   
   
     <action id="org.gnome.DejaDup">
   
       <description gettext-domain="deja-dup">Backup</description>
   
       <message gettext-domain="deja-dup">Privileges are required to backup system files</message>
   
       <defaults>
   
       <allow_any>no</allow_any>
   
       <allow_inactive>auth_admin</allow_inactive>
   
       <allow_active>auth_admin</allow_active>
   
        </defaults>
   
       <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/deja-dup</annotate>
   
       <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
   
     </action>
   
   
   
   </policyconfig>
   
   

   
   
   

   Note that there is another deja-dup file in this directory, which claims to help with restoring files, but I couldn’t get it to work. This new file needs to have a unique name, such as org.gnome.DejaDupNew.policy.

   
   

I am, for now, running without gksu. I’ll try to carry on…

Nautilus Admin (nautilus-admin) is a simple Python extension for the Nautilus file manager that adds some administrative actions to the right-click menu:

• Open as Administrator: opens a folder in a new Nautilus window running with administrator (root) privileges.


• Edit as Administrator: opens a file in a Gedit window running with administrator (root) privileges.

To install Nautilus Admin in all currently supported versions of Ubuntu open the terminal and type:

sudo apt install nautilus-admin

I've tested all the alternatives to gksu in 18.04 for other applications besides files and Gedit, and the one that seems to work the most consistently is:

sudo -H appname &>/dev/null

pkexec is the best replacement for gksu when it works because it provides higher security, but it is very inconsistent across different apps and can cause crashing with some apps. sudo -i is unnecessarily difficult to manage because it elevates your privileges to root for an extended period of time when you only need to be root to run a single command.

I use a script called sgedit which inherits user preferences for font, tabs, and extensions. It uses sudo -H gedit instead of gksu gedit for stability in GUI environment. It prompts for a password.

Have sudo inherit your user account gedit settings

In this example the user settings for font name, font size, tab stops, convert tabs to spaces, 80 column highlight, and right side thumbnail slider bar have been inherited by sudo.

With regular sudo -H gedit you cannot make nor save these configuration settings. With the script below sgedit the settings are inherited from your user account.

This script also addresses the "gksu is bad and not installed by default" and "pkexec is hard to setup" problems.

Background

I've been nagged by the same issue for years. This weekend's project was to write the sgedit script:

• Call using sgedit filename1 filename2...
  


• Gets user's gedit settings for tab stops, fonts, line-wrap, etc.


• Elevates to sudo -H to preserve file ownership whilst getting root powers.


• Requests password if last sudo has timed out.


• Gets sudo's gedit settings


• Compares differences between user and sudo gedit settings


• Runs gsettings set on the differences only (reduces 174 set commands to a dozen or less. Next time it's run perhaps only one or two changes but often times none.


• Calls gedit as a background task such that terminal prompt reappears immediately.

Bash script sgedit

#!/bin/bash



# NAME: sgedit

# PATH: /mnt/e/bin

# DESC: Run gedit as sudo using $USER preferences

# DATE: June 17, 2018.



# Must not prefix with sudo when calling script

if [[ $(id -u) == 0 ]]; then

    zenity --error --text "You cannot call this script using sudo. Aborting."

    exit 99

fi



# Get user preferences before elevating to sudo

gsettings list-recursively | grep -i gedit | grep -v history |

    grep -v docinfo |

    grep -v virtual-root | grep -v state.window > /tmp/gedit.gsettings



sudoFunc () {

    # Must be running as sudo

    if [[ $(id -u) != 0 ]]; then

        zenity --error --text "Sudo password authentication failed. Aborting."

        exit 99

    fi



    # Get sudo's gedit preferences

    gsettings list-recursively | grep -i gedit | grep -v history |

        grep -v docinfo |

        grep -v virtual-root | grep -v state.window > /tmp/gedit.gsettings.root

    diff /tmp/gedit.gsettings.root /tmp/gedit.gsettings | grep '>' > /tmp/gedit.gsettings.diff

    sed -i 's/>/gsettings set/g; s/uint32 //g' /tmp/gedit.gsettings.diff

    chmod +x /tmp/gedit.gsettings.diff

    bash -x /tmp/gedit.gsettings.diff  # Display override setting to terminal

    # nohup gedit $@ &>/dev/null &

    nohup gedit -g 1300x840+1+1220 "$@" &>/dev/null &

    # Set the X geometry window size (WIDTHxHEIGHT+X+Y).

}



FUNC=$(declare -f sudoFunc)

sudo -H bash -c "$FUNC; sudoFunc $*;"

Housekeeping

Copy the bash script above to a new file called sgedit. I recommend placing it in your $HOME/bin directory, i.e. /home/YOURNAME/bin. You may have to create the directory first.

Mark the file as executable using:

chmod a+x ~/sgedit

Note ~ is a shortcut for /home/YOURNAME.