mjhjmtu

As continuation of this question (How can I send a notification with polkit 0.106?), I've discovered that I have to execute notify-send as the user who I want to send notification.

But, with my current config, I can't do this, because polkit execute the script as polkitd user, and I can't do su $user without known user password.

By this reason, I need to create a new polkit action, to allow execute notify-send as other user from polkitd.

My polkit rule is this:

polkit.addRule(function(action, subject) 
 if (action.id == "org.freedesktop.consolekit.system.stop" );

This polkit rule must lock shutdown option in shutdown menu, and shows a notification with notify-send, with send_notify.sh script, which execute this:

#!/bin/bash

export DISPLAY=":0"

user=$1
pkexec --user $user notify-send "Pendrive Reminder" "Shutdown lock enabled. Disconnect pendrive to enable shutdown" -u critical

exit 0

I tried to add this polkit policy file:

<policyconfig>
 <action id="org.freedesktop.notify-send">
 <description>Launch notify-send command</description>
 <defaults>
 <allow_any>yes</allow_any>
 <allow_inactive>yes</allow_inactive>
 <allow_active>yes</allow_active>
 </defaults>
 <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/notify-send</annotate>
 <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
 </action>
</policyconfig>

I put this file in /usr/share/polkit-1/actions/org.freedesktop.policykit.notify-send.policy

But, after put policy file in /usr/share/polkit-1/rules.d/ and press shutdown button, the shutdown menu took a long time to be showed, and notification didn't appeared. The shutdown option is locked correctly

How can I get that polkit can call notify-send from my script?

After doing a few test, I got this results:

• polkitd is a nologin user


• 
  

  If I execute this command, to execute my script with polkitd user, shows an error:

  
  
  

  sudo su polkitd -s /bin/bash -c aux_scripts/send_notify.sh almu

  
  
  

  Error executing command as another user: Not authorized

  
  
  

  This incident has been reported.

  
  

So, I think that polkitd user is a limited account, who it can't execute commands as other user

As a conclusion, I determine that this action isn't possible to do without modify system internal. I can't allow this in my application, so I can't launch commands as another user from polkit