#1031676 pkexec's internal polkit agent doesn't work in a ssh or getty session

Package:
pkexec
Source:
pkexec
Description:
run commands as another user with polkit authorization
Submitter:
Simon McVittie
Date:
2026-01-10 11:15:34 UTC
Severity:
normal
#1031676#5
Date:
2023-02-20 10:52:17 UTC
From:
To:
To reproduce:

* Have a user in the sudo group, and default polkitd configuration, so
  they can do root-equivalent things after authenticating as themselves
* Initial state: do not be logged in to the machine at all
* Log in on a text virtual console (getty/login) or with interactive ssh,
  or use `ssh -t machine pkexec ...` to force allocation of a
  pseudo-terminal
* Run: systemctl restart avahi-daemon.service
  (or any other service that is installed and is harmless to restart)
* Run: pkexec true
* Enter the user's correct password whenever prompted to authenticate

Expected result:

* `systemctl restart avahi-daemon.service` prompts for the user's password,
  then restarts avahi-daemon, successfully
* `pkexec true` prompts for the user's password, then runs `true`,
  successfully

Actual result:

systemctl successfully prompts for the user's password, demonstrating
that polkitd is working as intended (so this is a pkexec bug and not a
polkitd bug):

but pkexec fails with "No session for cookie":

Logging in on tty6 with getty/login has similar symptoms. I used ssh for
the version quoted here because it was easier to copy/paste.

    smcv
#1031676#10
Date:
2026-01-10 10:08:33 UTC
From:
To:
Es gibt eine Familienspende in Höhe von 1.850.000,00 USD von Cheng Charlie
Saephan. Bitte antworten Sie für weitere Informationen. Denken Sie daran,
Ihrer Familie und den Bedürftigen in Ihrer Umgebung Gutes zu tun.

Dies ist bereits der zweite Versuch, Sie zu erreichen. Bitte antworten Sie
für weitere Details.