I'm building a GUI app that needs to run as a root process. Digging around, I found Mike's "consolehelper" tool. The man page is inadequate and leaves much of the configuration of the pam environment totally uncovered.

Here's what I've done so far:

My App sits in a directory under /usr/sbin/myApp.d
I've created a symlink from /usr/bin/consolehelper to /usr/bin/myApp
I've created an entry in /etc/pam.d called myApp
It's contents are:
#%PAM-1.0
auth sufficient /lib/security/pam_rootok.so
auth required /lib/security/pam_pwdb.so
session optional /lib/security/pam_xauth.so
account required /lib/security/pam_permit.so

I've created an entry in /etc/security/console.apps called myApp
It's contents are:
USER=root
PROGRAM=/usr/sbin/myApp.d/myApp
SESSION=true
FALLBACK=true

However, when I attempt to execute myApp directly from /usr/bin/myApp, I get a window telling me "the exec() call falied" with no further info. Also, I'm not prompted for the password.

If I manually execute "sudo /usr/sbin/myApp.d/myApp" it runs.

Anyone have an idea of what I've missed? Do I need special bits on the real binary?

Thanks

Tim

I'm not a programmer, but why not setup your application to call gksu when launched ? you said you were writing a GUI app, not a console based app.

http://www.nongnu.org/gksu/

Just a thought, since this is the method most of the system management applications use these days.

Unfortunately, I can't always guarantee that gksu or kedsu will be available. In fact, on my FC6 system, gksu isn't even installed. And, since we're not devoted to one desktop or the other, we need something a bit more agnostic (I actually run XFCE). This is why consolehelper seems to fit the bill best. But, I'm not married to it if I can find something that is non-desktop specific.

Tim

Have you figured this out? I have the same dilemma, and I am considering PolicyKit. The catch I see now is it limits me to very modern Linux distributions.

Nope - I've resorted to checking the "id" of the user and posting a dialog telling them that they must either sudo or run as root.

Tim

I may do that for the short term. A major drag about PolicyKit is it requires a significant amount of development to develop policies and D-BUS services.