0009497: policykit-1 127-1+kali1: pkexec issues - Kali Linux Bug Tracker

ID	Project	Category	View Status	Date Submitted	Last Update
0009497	Kali Linux	Kali Package Bug	public	2026-01-11 15:09	2026-01-14 07:45

Reporter	iojymbo	Assigned To	arnaudr
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	assigned	Resolution	open

Summary	0009497: policykit-1 127-1+kali1: pkexec issues
Description	policykit-1 127-1+kali1: pkexec issues Environment Version: Kali 2024.4 after policykit-1 (127-1+kali1) update Desktop: XFCE Host OS: Windows 11 Hypervisor: VMware Workstation Pro 25H2 Summary Due to the new Debian polkit mecanisms introduced in 127-1, the polkit authentication pop-up is broken and pkexec no longer work with some graphical applications that require root access upon launch, such as Qterminal, Sparrow-Wifi, Zenmap, etc. Polkit authentication pop-up: Symptom When you start one of these applications, you will see these error messages in the journalctl log: polkitd[PID]: Operator of unix-session:2 FAILED to authenticate to gain authorization for action org.freedesktop.policykit.exec for unix-process:PID:PID [xfce4-panel] (owned by unix-user:USER) Based on my observations of the Debian polkitd package update, the 'polkit-agent-helper.socket' service must now be enabled and started (https://salsa.debian.org/utopia-team/polkit/-/commit/07b46e3a27cb483e68a06292a0387d09d0060bea). Polkit authentication pop-up: Workaround To fix the Polkit authentication pop-up, add the following to the "Disable all sockets by default, except whitelisted ones" section of the "/usr/lib/systemd/system-preset/95-kali.preset" file: enable polkit-agent-helper.socket Next, enable and start it: systemctl enable polkit-agent-helper.socket systemctl start polkit-agent-helper.socket The journalctl error log entry disappears: kexec[PID]: USER: Executing command [USER=root] [TTY=unknown] [CWD=/home/USER] [COMMAND=/usr/bin/zenmap] Pkexec/Qterminal: Symptom This previous workaround fixs Sparrow-Wifi and Zenmap problems, but not the Qterminal command as 'root', probably due to the update from X11 to Wayland, DISPLAY and XAUTHORITY environment variables are no longer passed to the 'pkexec x-terminal-emulator' command. Qterminal output error: qt.qpa.xcb: could not connect to display qt.qpa.plugin: From 6.5.0, xcb-cursor0 or libxcb-cursor0 is needed to load the Qt xcb platform plugin. qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found. This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem. Available platform plugins are: minimal, vnc, wayland-egl, vkkhrdisplay, eglfs, wayland, offscreen, minimalegl, xcb, linuxfb. zsh: IOT instruction pkexec x-terminal-emulator Pkexec/Qterminal: Workaround Starting Pkexec with missing 'env' arguments: pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY x-terminal-emulator

arnaudr 2026-01-13 09:00 manager ~0021240	Please update your system (`sudo apt update && sudo apt full-upgrade`). The packages `polkitd` `pkexec` and friends should be update to version `127+really126-0+kali1`. After that the issue should be fixed (you might need to log out and back in, or reboot, not sure).

iojymbo 2026-01-13 10:18 reporter ~0021242	Hi Arnaud, I confirm the upgrade to `127+really126-0+kali1` resolved the issue, you can close my issue. Thank you so much!

iojymbo 2026-01-13 10:28 reporter ~0021243	PS: I have a question for my own personal knowledge. I haven't seen any updates to the `policykit-1` repository (https://gitlab.com/kalilinux/packages/policykit-1), which is still at version `127-1+kali1`, so where are the sources for version `127+really126-0+kali1` that are now being pushed by `apt`?

pkreuzt 2026-01-13 17:30 reporter ~0021246	Not sure the downgrade is a good idea. In my case the proposed workaround (manually enabling polkit-agent-helper.socket) already solved the issue in a satisfactory way. The problem about per-Kali politic of disabling everything not indispensable should be solved in its own package. The mentioned issue about graphical programs in elevated environment on Wayland is a known limitation of Polkit, IIRC. This can be worked by creating launchers that detect the environment and set the corresponding variables as needed.

Alderson Elliot 2026-01-13 23:39 reporter ~0021248	Hi, I confirm that the update fixed the issue. sudo apt update && sudo apt full-upgrade Updated the polkit packages to version 127+really126-0+kali1: polkitd pkexec libpolkit-agent-1-0 libpolkit-gobject-1-0 The setuid bit on /usr/lib/polkit-1/polkit-agent-helper-1 has been successfully restored, and volume mounting now works without problems. Thanks for your support!

arnaudr 2026-01-14 07:44 manager ~0021249 Last edited: 2026-01-14 07:45	@pkreuzt The downgrade is a temporary solution until we have time to investigate the issue. In my tests, enabling `enabling polkit-agent-helper.socket` only lead to a crash when trying to start Konsole as root. Another user reported something similar but not exactly the same.

Date Modified	Username	Field	Change
2026-01-11 15:09	iojymbo	New Issue
2026-01-13 08:52	daniruiz	Assigned To	=> arnaudr
2026-01-13 08:52	daniruiz	Status	new => assigned
2026-01-13 09:00	arnaudr	Note Added: 0021240
2026-01-13 09:36	daniruiz	Relationship added	has duplicate 0009500
2026-01-13 09:36	daniruiz	Relationship added	has duplicate 0009501
2026-01-13 09:36	daniruiz	Relationship added	has duplicate 0009489
2026-01-13 10:18	iojymbo	Note Added: 0021242
2026-01-13 10:28	iojymbo	Note Added: 0021243
2026-01-13 17:30	pkreuzt	Note Added: 0021246
2026-01-13 23:39	Alderson Elliot	Note Added: 0021248
2026-01-14 07:44	arnaudr	Note Added: 0021249
2026-01-14 07:45	arnaudr	Note Edited: 0021249