--obtain action

Attempt to obtain an authorization through authentication for the given action. This is only useful for implicit authorizations requiring authentication; e.g. when an appropriate stanza in the defaults section of the .policy file for the action specifies auth_*.

The gained authorization will be constrained as much as possible using the constraints specified in the section called “CONSTRAINTS”. For example, on a system running SELinux, if the caller runs uses this tool to obtain an authorization from a shell in a desktop in an active session, then constraints for local, active, exe and selinux_context will all be added.

If an Authentication Agent (such as the one from PolicyKit-gnome) is available in the session, it will used for authentication unless the environment variable POLKIT_AUTH_FORCE_TEXT is set. If the environment variable POLKIT_AUTH_GRANT_TO_PID is set, the authorization will be granted to that process id instead of the invoking process (e.g. the shell from which polkit-auth is launched).

--show-obtainable

Prints all actions that can be obtained via authentication and for which an authorization does not exist.

[--user user] --explicit

Show explicit authorizations. Duplicates are not printed. If used with the --user option, the authorization org.freedesktop.policykit.read is required.

[--user user] --explicit-detail

Show detailed information about explicit authorizations. In contrast to the --explicit, duplicates are printed as several authorizations with different scope and constraints may exist.

[--user user] --grant action [--constraint constraint]*

Grant an authorization for an action. This is different than --obtain insofar that the defaults stanza of the .policy file is not consulted. Optionally, one or more constraints on the granted authorization can be specified, see the section called “CONSTRAINTS” for details. The authorization needed to grant authorizations is org.freedesktop.policykit.grant.

[--user user] --block action [--constraint constraint]*

Grant an negative authorization for an action. Negative authorizations are normally used to block users that would normally be authorized due to implicit authorizations. Optionally, one or more constraints on the granted authorization can be specified, see the section called “CONSTRAINTS” for details. The authorization needed to grant negative authorizations is org.freedesktop.policykit.grant if the "beneficiary" is another user.

[--user user] --revoke action

Revoke all authorizations for an action. If the user is not specified the calling user is used. The authorization org.freedesktop.policykit.revoke is needed to revoke authorizations from other users.

--version

Show version and exit.

--help

Show this information.

--constraint local

The caller must be in a session on a local console attached to the system. For example processes that belong to remote XDMCP or ssh connections will fail to meet this constraint and as such the authorization with such a constraint won't apply.

--constraint active

The caller must be in an active session. This is typically used with a local constraint to ensure that the caller is only authorized if his session is in the foreground. This is typically used for fast user switching (multiple sessions on the same console) to prevent inactive sessions from doing privileged operations like spying (using a webcam or a sound card) on the current active session.

--constraint exe:/path/to/program

The authorization is constrained to processes for where executable path (/proc/pid/exe on Linux) matches the given path. See the section called “NOTES” for limitations on why this may not be secure.

--constraint selinux_context:system_u:object_r:some_context_t

The authorization is constrained to processes for where their SELinux security context matches the given context.