In xrdp, how to run programs as root?

[kgfly]

sudo gnome-disks
->
No protocol specified
Unable to init server: Could not connect: Connection refused

(gnome-disks:5322): Gtk-WARNING **: 19:13:39.181: cannot open display: :10.0

I need GUI tool because manually editing /etc/fstab is tedious and error prone.

I notice a related thread, #1568. It talks about thuar, not gnome-disk

Is there a workaround for gnome-disks?

Thanks.

[matt335672]

Using sudo to run GUI programs isn't recommended. It might work, but desktop integration isn't what you might expect.

The correct way to do this on a modern desktop is to learn how to use pkexec. If you're on Ubuntu, this post from #1568 should give you all the details you need.

Again, if you're on Ubuntu, you can start with this file as /usr/share/polkit-1/actions/mycorp.apps.disks.policy and edit as required:-

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">

<policyconfig>

<!-- Choose action_id so as not to conflict with anything else -->
 <action id="mycorp.apps.gnome-disks">
 <description>Run gnome-disks as root</description>

<!-- These appear on the authentication dialog box.

     The icon is the one provided for gnome-disks
-->
 <vendor>mycorp</vendor>
 <vendor_url>https://wiki.mycorp.org/Apps/GnomeDisks</vendor_url>
 <icon_name>gnome-disks</icon_name>

 <defaults>
 <!-- allow_any set to auth_admin for XRDP users -->
 <allow_any>auth_admin</allow_any>
 <allow_inactive>auth_admin</allow_inactive>
 <allow_active>auth_admin</allow_active>
 </defaults>

 <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/gnome-disks</annotate>
 <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
 </action>

</policyconfig>

On my system I can then pkexec /usr/bin/gnome-disks and I get prompted for a password.

To tailor this, read up on policykit. It's a good tool to get the hang of, particularly for system admins.

[pelepelin]

Hello @matt335672 !

I looked for the recipe to disable GUI "sudo" password prompts completely. I've found https://askubuntu.com/a/123260/897087 but it didn't work in xrdp session. I've found several issues in xrdp from which I conclude that following .pkla is the way to go (for Ubuntu 20.04):

[no password for sudoers]
Identity=unix-group:sudo
Action=*
ResultActive=yes
ResultInactive=yes
ResultAny=yes

It seems working now.
Is it a correct equivalent for sudoers' %sudo ALL=(ALL:ALL) NOPASSWD: ALL?

[matt335672]

It's pretty much the same, with the exception that the sudoers file entry will at least ask you to type sudo in front of privileged commands. The GUI equivalent has no safeguard at all.

[pelepelin]

Thank you!

[kgfly]

It works. Thanks for the sharing