验证GTK应用程序以root权限运行
我有一个适用于 Linux 的 UI 应用程序（使用 GTK），需要以 root 身份运行（它读取和写入 /dev/sd*）。
我不知道该应用程序是否可以使用某些操作系统提供的 API 来获取 root 权限，而不是要求用户每次启动我的应用程序时都打开 root shell 或手动使用“sudo”。 （注意：gtk 应用程序无法使用“setuid”模式，因此此处不提供此选项。）
这里的优点是工作流程更简单：用户可以从他的默认用户帐户中，从桌面双击我的应用程序，而不是双击我的应用程序。必须打开根终端并从那里启动它。
我问这个是因为 OS X 提供了这样的功能：应用程序可以要求操作系统启动具有 root 权限的可执行文件 - 然后操作系统（而不是应用程序）要求用户输入其凭据，验证它们，然后根据需要启动目标。
我想知道Linux（Ubuntu，例如）是否有类似的东西
澄清：
所以，在PolicyKit的提示之后我想知道我是否可以使用它来获得r/w访问“/dev/sd...”块设备。我发现该文档很难理解，所以我想在我花几个小时徒劳地尝试理解它之前先问一下这是否可能。
更新：
该应用程序是一个远程操作的磁盘修复工具，适合不熟练的 Linux 用户，那些 Linux 菜鸟不会对使用 sudo 或什至更改用户组有太多了解会员资格，尤其是当他们的磁盘刚刚开始出现故障并且他们吓坏了的时候。这就是为什么我寻求一种避免此类技术细节的解决方案。
I have a UI app (uses GTK) for Linux that requires to be run as root (it reads and writes /dev/sd*).
Instead of requiring the user to open a root shell or use "sudo" manually every time when he launches my app, I wonder if the app can use some OS-provided API to get root permissions. (Note: gtk app's can't use "setuid" mode, so that's not an option here.)
The advantage here would be an easier workflow: The user could, from his default user account, double click my app from the desktop instead of having to open a root terminal and launch it from there.
I ask this because OS X offers exactly this: An app can ask the OS to launch an executable with root permissions - the OS (and not the app) then asks the user to input his credentials, verifies them and then launches the target as desired.
I wonder if there's something similar for Linux (Ubuntu, e.g.)
Clarification:
So, after the hint at PolicyKit I wonder if I can use that to get r/w access to the "/dev/sd..." block devices. I find the documention quite hard to understand, so I thought I'd first ask whether this is possible at all before I spend hours on trying to understand it in vain.
Update:
The app is a remote operated disk repair tool for the unsavvy Linux user, and those Linux noobs won't have much understanding of using sudo or even changing their user's group memberships, especially if their disk just started acting up and they're freaking out. That's why I seek a solution that avoids technicalities like this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
旧的方法很简单，但现在已被淘汰，它是 GKSu。 这里是关于 GKSu 未来的讨论。
新方法是使用 PolicyKit。我不太确定这是如何工作的，但我认为您需要使用
pkexec命令启动您的应用程序。更新：
查看 http:// 上的示例代码hal.freedesktop.org/docs/polkit/polkit-apps.html，似乎您可以使用PolicyKit来获取
.policy<描述的某些操作的授权/code> 文件位于/usr/share/polkit-1/actions中。以另一个用户身份执行程序的操作是 org.freedesktop.policykit.exec。我似乎找不到直接访问块设备的操作，但我不得不承认，PolicyKit 文档也让我伤透了脑筋。因此，也许对您来说最简单的做法是将需要权限的磁盘管理代码分离到命令行实用程序中，并使用
g_spawn_[a]sync()从 GUI 应用程序运行该代码使用pkexec。这样您就不必费心请求操作之类的事情。无论如何，以 root 身份运行整个 GUI 应用程序可能是不好的做法。另一个建议是直接询问PolicyKit的作者（David Zeuthen）。或者尝试将您的问题发布到 gtk-app-devel 列表。
The old way, simple but now being phased out, is GKSu. Here is the discussion on GKSu's future.
The new way is to use PolicyKit. I'm not quite sure how this works but I think you need to launch your app using the
pkexeccommand.UPDATE:
Looking at the example code on http://hal.freedesktop.org/docs/polkit/polkit-apps.html, it seems that you can use PolicyKit to obtain authorization for certain actions which are described by
.policyfiles in/usr/share/polkit-1/actions. The action for executing a program as another user isorg.freedesktop.policykit.exec. I can't seem to find an action for directly accessing block devices, but I have to admit, the PolicyKit documentation breaks my brain too.So, perhaps the simplest course of action for you is to separate your disk-mangling code that requires privileges into a command-line utility, and run that from your GUI application using
g_spawn_[a]sync()withpkexec. That way you wouldn't have to bother with requesting actions and that sort of thing. It's probably bad practice anyway to run your whole GUI application as root.Another suggestion is to ask the author of PolicyKit (David Zeuthen) directly. Or try posting your question to the gtk-app-devel list.