GUI won't let me open files as "Open as Administrator" if logged in as another

[Vera]

On my LL laptop, I have 3 accounts, one for me (the admin) and two others for two family members.

A family member was logged into his account, none of the other accounts were logged in. I needed to open one of his folders as admin (long story, he was there with me, I was doing this with his permission). So I right clicked on the folder and went to "Open As Administrator" and it asked for password, and I put in my root password. It said it was incorrect. I tried this several times, and I checked that caps lock was off. I can only conclude that it wasn't letting me open it as admin while logged in under his account instead of mine. Is that the expected behavior?

[trinidad]

You have to shuttle through the main file system (computer) after opening it as administrator /home/user name/whatever.the.file.is to open it as administrator. You can't open anything as administrator from his home directory. You have to get there from the home folder in main file system. It's that way on all non rooted systems that use sudo.

TC

[Vera]

Ah - that clears it up. Thank you so much for the clear and helpful explanation [member=5916]trinidad[/member] . This definitely helped explain the behavior I'm seeing. OK, next time I need to do that I'll go through the file system instead of starting in his home directory.

[ralphy]

So I right clicked on the folder and went to "Open As Administrator" and it asked for password, and I put in my root password. It said it was incorrect. I tried this several times, and I checked that caps lock was off. I can only conclude that it wasn't letting me open it as admin while logged in under his account instead of mine. Is that the expected behavior?

[member=6960]Vera[/member]  this is a gksu limitation.  It is expected behavior only if using gksu instead of pkexec.


You can work your way around by authenticating with gksu 2 times to get the access you want as the user you want... which is in my opinion rather inconvenient but here is how to do it:

Code:

gksu -w -u admin gksu any-application

Else, switch to pkexec and that allows you to elevate when needed from a non sudoer account. E.g.: while logged into a family member account.

UnlockMe app and Lite Control Center options were moved to pkexec for this exact scenario.

With UnlockMe, just select pkexec Open As Root. It will not only set your own custom action to use pkexec but it will fix it for all current users accounts and also for accounts created at later time.



If you are not interested in UnlockMe, just manually edit the "Open as Administrator" custom action under all accounts to:

Code:

pkexec Thunar %F

... and add this Policy to your system under:

/usr/share/polkit-1/actions/com.ubuntu.pkexec.unlockme-thunar.policy

Hope that helps.

[Vera]

Thanks [member=6629]ralphy[/member] , I had to wrap my head around this, not knowing anything about gksu and pkexec. I may wind up installing UnlockMe on that computer, since I forsee multi-user issues coming up again and again on that machine.

One question: If pkexec has the advantage of resulting in more intuitive or more convenient behavior on multi-user machines, why does LL use gksu out of the box and not pkexec? Is there some advantage to gksu somewhere?

[ralphy]

One question: If pkexec has the advantage of resulting in more intuitive or more convenient behavior on multi-user machines, why does LL use gksu out of the box and not pkexec? Is there some advantage to gksu somewhere?

Linux Lite uses pkexec for the most part. When you launch Install Updates, Lite Tweak, etc... they are all authenticated using pkexec and not gksu. I think Thunar custom actions is one of the few exceptions. It might be addressed at some point I guess.

I can't really tell what advantages gksu offers (if any) in Linux Lite other than been used as a simple front-end (an old one I must add). It does limit admins in multi-users setups as you just experienced (even though there are ways around it). Personally, I prefer pkexec everywhere since I don't use a sudoer account for daily work (for sanity).

Maybe we see something done about it with Linux Lite 4 but then again, it might not bee quite a necessity for the vast majority and that's why it has been left as it is today.

[trinidad]

[member=6629]ralphy[/member]  Essentially gksudo is deprecated for security reasons on all gtk3+ apps in gnome so it is inconsistent across platforms based on Ubuntu 16.04 and up and/or Debian 9. The deployment of pkexec is incomplete in Ubuntu 16.04 and up as well, depending on the version, so that XFCE, Mate, Lubuntu, and others can still access gksudo for certain other apps. It is an Ubu thing. Similar issues with NM and WICD since Deb default went gnome, i/e gnome default compared to LXDE. Core issue is with the base GUI for apps.

TC

[ralphy]

[member=6629]ralphy[/member]  Essentially gksudo is deprecated for security reasons on all gtk3+ apps in gnome so it is inconsistent across platforms based on Ubuntu 16.04 and up and/or Debian 9. The deployment of pkexec is incomplete in Ubuntu 16.04 and up as well, depending on the version, so that XFCE, Mate, Lubuntu, and others can still access gksudo for certain other apps. It is an Ubu thing. Similar issues with NM and WICD since Deb default went gnome, i/e gnome default compared to LXDE. Core issue is with the base GUI for apps.

TC

I agree [member=5916]trinidad[/member]  , it hasn't been maintained since 08-09 and deprecated. In Ubuntu it is jus a symbolic link to gksu. pkexec is been in Ubuntu since precise. Just hadn't been widely adopted for the reasons you stated. pkexec is pretty much available across platforms today and even Ubuntu derivates have switched fully to pkexec. E.g.: Ubuntu-Budgie does not have gksu/do installed out of the box.

[Vera]

Thanks [member=6629]ralphy[/member] and [member=5916]trinidad[/member] for so ably answering my question about the background behind this. OK, so it seems that this is due mainly to historical reasons that it is set up like that for custom admin actions via Thunar.

Thanks again ralphy for UnlockMe - I think that will be a real asset to my multi-user machine.