I've tried setuid and it seems to have resolved for one of the hosts exhibiting the issue.

chmod u+s /usr/lib/polkit-1/polkit-agent-helper-1

So the regression would also be an upstream issue, just like 0009497 with https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125141 ?

Hello.

First thing: did you reboot after the upgrade? Cf. https://bugs.kali.org/view.php?id=9497#c21506. You MUST reboot after this particular update of polkit / pkexec. I guess you did, given you said « noticed this regress some weeks back ».

Second question: what terminal do you use?

First thing: did you reboot after the upgrade?

Yes indeed. My typical habit is rebooting after any updates via kali-rolling (regardless of whether needed or not). As you mentioned, yes, when this regressed I noticed it after reboot. :-(

Second question: what terminal do you use?

qterminal (built-in), Xfce, launched from the toolbar using the built-in shortcut (red terminal icon).

I wish I took a note of when I saw this regress. I didn't look to see how many releases there have been between 127+really126-0+kali1 and 127+really127-0kali1. I'm also surprised this hasn't been seen by anyone else running kali-rolling (at least I haven't found any reports or discussion).

I've experienced this on at least two hosts, <del>and I've been reluctant to upgrade a laptop on kali-rolling until I understand what is going on.</del> make that three hosts. The laptop I thought wasn't upgraded, was and is also exhibiting the issue, 127+really127-0kali1 installed.

# grep -r "polkitd" /var/log/dpkg.log*
/var/log/dpkg.log.1:2026-04-03 14:40:05 upgrade polkitd:amd64 127+really126-0+kali1 127+really127-0kali1
/var/log/dpkg.log.1:2026-04-03 14:40:05 status half-configured polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.1:2026-04-03 14:40:05 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.1:2026-04-03 14:40:05 status half-installed polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.1:2026-04-03 14:40:05 status unpacked polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.1:2026-04-03 14:40:26 configure polkitd:amd64 127+really127-0kali1 <none>
/var/log/dpkg.log.1:2026-04-03 14:40:26 status unpacked polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.1:2026-04-03 14:40:26 status half-configured polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.1:2026-04-03 14:40:27 status triggers-awaited polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.1:2026-04-03 14:40:31 status installed polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.4:2026-01-12 16:04:47 upgrade polkitd:amd64 126-2+kali1 127-1+kali1
/var/log/dpkg.log.4:2026-01-12 16:04:47 status half-configured polkitd:amd64 126-2+kali1
/var/log/dpkg.log.4:2026-01-12 16:04:47 status unpacked polkitd:amd64 126-2+kali1
/var/log/dpkg.log.4:2026-01-12 16:04:47 status half-installed polkitd:amd64 126-2+kali1
/var/log/dpkg.log.4:2026-01-12 16:04:48 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-12 16:06:02 configure polkitd:amd64 127-1+kali1 <none>
/var/log/dpkg.log.4:2026-01-12 16:06:02 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-12 16:06:02 status half-configured polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-12 16:06:03 status triggers-awaited polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-12 16:06:21 status installed polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:11 upgrade polkitd:amd64 127-1+kali1 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:11 status half-configured polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:11 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:11 status half-installed polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:11 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:24 configure polkitd:amd64 127+really126-0+kali1 <none>
/var/log/dpkg.log.4:2026-01-14 00:14:24 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:24 status half-configured polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:25 status triggers-awaited polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-14 00:14:26 status installed polkitd:amd64 127+really126-0+kali1

From the aforementioned laptop:

# grep "polkitd" /var/log/dpkg.log*
/var/log/dpkg.log:2026-05-25 23:27:07 upgrade polkitd:amd64 127+really126-0+kali1 127+really127-0kali1
/var/log/dpkg.log:2026-05-25 23:27:07 status half-configured polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log:2026-05-25 23:27:07 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log:2026-05-25 23:27:07 status half-installed polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log:2026-05-25 23:27:07 status unpacked polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log:2026-05-25 23:40:54 configure polkitd:amd64 127+really127-0kali1 <none>
/var/log/dpkg.log:2026-05-25 23:40:54 status unpacked polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log:2026-05-25 23:40:54 status half-configured polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log:2026-05-25 23:40:55 status installed polkitd:amd64 127+really127-0kali1
/var/log/dpkg.log.4:2026-01-17 20:06:49 upgrade polkitd:amd64 127-1+kali1 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-17 20:06:49 status half-configured polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-17 20:06:49 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-17 20:06:49 status half-installed polkitd:amd64 127-1+kali1
/var/log/dpkg.log.4:2026-01-17 20:06:49 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-17 20:07:36 configure polkitd:amd64 127+really126-0+kali1 <none>
/var/log/dpkg.log.4:2026-01-17 20:07:36 status unpacked polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-17 20:07:36 status half-configured polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-17 20:07:36 status triggers-awaited polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.4:2026-01-17 20:07:38 status installed polkitd:amd64 127+really126-0+kali1
/var/log/dpkg.log.5:2026-01-12 16:08:21 upgrade polkitd:amd64 126-2+kali1 127-1+kali1
/var/log/dpkg.log.5:2026-01-12 16:08:21 status half-configured polkitd:amd64 126-2+kali1
/var/log/dpkg.log.5:2026-01-12 16:08:21 status unpacked polkitd:amd64 126-2+kali1
/var/log/dpkg.log.5:2026-01-12 16:08:21 status half-installed polkitd:amd64 126-2+kali1
/var/log/dpkg.log.5:2026-01-12 16:08:21 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.5:2026-01-12 16:13:55 configure polkitd:amd64 127-1+kali1 <none>
/var/log/dpkg.log.5:2026-01-12 16:13:55 status unpacked polkitd:amd64 127-1+kali1
/var/log/dpkg.log.5:2026-01-12 16:13:55 status half-configured polkitd:amd64 127-1+kali1
/var/log/dpkg.log.5:2026-01-12 16:13:56 status triggers-awaited polkitd:amd64 127-1+kali1
/var/log/dpkg.log.5:2026-01-12 16:14:48 status installed polkitd:amd64 127-1+kali1
/var/log/dpkg.log.10:2025-07-10 17:43:02 install polkitd:amd64 <none> 126-2+kali1
/var/log/dpkg.log.10:2025-07-10 17:43:02 status half-installed polkitd:amd64 126-2+kali1
/var/log/dpkg.log.10:2025-07-10 17:43:02 status unpacked polkitd:amd64 126-2+kali1
/var/log/dpkg.log.10:2025-07-10 17:47:56 configure polkitd:amd64 126-2+kali1 <none>
/var/log/dpkg.log.10:2025-07-10 17:47:56 status unpacked polkitd:amd64 126-2+kali1
/var/log/dpkg.log.10:2025-07-10 17:47:56 status half-configured polkitd:amd64 126-2+kali1
/var/log/dpkg.log.10:2025-07-10 17:47:56 status installed polkitd:amd64 126-2+kali1

From the third host, and an attempt at readability. :-)

# grep -r "polkitd" /var/log/dpkg.log* |awk -F: 'BEGIN { OFS=":" } { print $2,$3,$4,$5 }' | sort -g
2026-01-09 09:45:44 status half-configured polkitd:amd64 126-2+kali1
2026-01-09 09:45:44 status half-installed polkitd:amd64 126-2+kali1
2026-01-09 09:45:44 status unpacked polkitd:amd64 126-2+kali1
2026-01-09 09:45:44 status unpacked polkitd:amd64 127-1+kali1
2026-01-09 09:45:44 upgrade polkitd:amd64 126-2+kali1 127-1+kali1
2026-01-09 09:45:54 configure polkitd:amd64 127-1+kali1 <none>
2026-01-09 09:45:54 status half-configured polkitd:amd64 127-1+kali1
2026-01-09 09:45:54 status unpacked polkitd:amd64 127-1+kali1
2026-01-09 09:45:55 status installed polkitd:amd64 127-1+kali1
2026-01-09 09:45:55 status triggers-awaited polkitd:amd64 127-1+kali1
2026-01-13 09:20:19 status half-configured polkitd:amd64 127-1+kali1
2026-01-13 09:20:19 status half-installed polkitd:amd64 127-1+kali1
2026-01-13 09:20:19 status unpacked polkitd:amd64 127+really126-0+kali1
2026-01-13 09:20:19 status unpacked polkitd:amd64 127-1+kali1
2026-01-13 09:20:19 upgrade polkitd:amd64 127-1+kali1 127+really126-0+kali1
2026-01-13 09:20:20 configure polkitd:amd64 127+really126-0+kali1 <none>
2026-01-13 09:20:20 status half-configured polkitd:amd64 127+really126-0+kali1
2026-01-13 09:20:20 status unpacked polkitd:amd64 127+really126-0+kali1
2026-01-13 09:20:21 status triggers-awaited polkitd:amd64 127+really126-0+kali1
2026-01-13 09:20:23 status installed polkitd:amd64 127+really126-0+kali1
2026-04-03 13:10:47 status half-configured polkitd:amd64 127+really126-0+kali1
2026-04-03 13:10:47 upgrade polkitd:amd64 127+really126-0+kali1 127+really127-0kali1
2026-04-03 13:10:48 status half-installed polkitd:amd64 127+really126-0+kali1
2026-04-03 13:10:48 status unpacked polkitd:amd64 127+really126-0+kali1
2026-04-03 13:10:48 status unpacked polkitd:amd64 127+really127-0kali1
2026-04-03 13:10:49 configure polkitd:amd64 127+really127-0kali1 <none>
2026-04-03 13:10:49 status half-configured polkitd:amd64 127+really127-0kali1
2026-04-03 13:10:49 status unpacked polkitd:amd64 127+really127-0kali1
2026-04-03 13:10:50 status triggers-awaited polkitd:amd64 127+really127-0kali1
2026-04-03 13:10:52 status installed polkitd:amd64 127+really127-0kali1

Can you please paste the output of these commands?

dpkg -l | grep -E 'polkitd|pkexec|kali-menu|kali-default' | column -t -l 5

which qterminal

ls -l /usr/share/polkit-1/actions/org.kali.pkexec.policy

sha1sum /usr/share/polkit-1/actions/org.kali.pkexec.policy

Thanks

From the laptop:

└─# dpkg -l | grep -E 'polkitd|pkexec|kali-menu|kali-default' | column -t -l 5
ii  kali-defaults          2026.2.10             all    Kali default settings
ii  kali-defaults-desktop  2026.2.10             all    Kali default settings for graphical desktops
ii  kali-menu              2026.2.5              all    Kali Linux custom menu
ii  pkexec                 127+really127-0kali1  amd64  run commands as another user with polkit authorization
ii  polkitd                127+really127-0kali1  amd64  framework for managing administrative policies and privileges

└─# which qterminal
/usr/bin/qterminal

└─# ls -l /usr/share/polkit-1/actions/org.kali.pkexec.policy
-rw-r--r-- 1 root root 12817 May 14 01:25 /usr/share/polkit-1/actions/org.kali.pkexec.policy

└─# sha1sum /usr/share/polkit-1/actions/org.kali.pkexec.policy
94d00585e95edc94b69db6f22cc7d87149da7e78  /usr/share/polkit-1/actions/org.kali.pkexec.policy

Ok, everything looks good in your logs above... Please give me the output of:

ls -l /usr/lib/systemd/system/polkit-agent-helper.socket

ps fax | grep polkit | grep -v grep

systemctl status polkit-agent-helper.socket

└─# ls -l /usr/lib/systemd/system/polkit-agent-helper.socket  
-rw-r--r-- 1 root root 200 Dec 17 08:14 /usr/lib/systemd/system/polkit-agent-helper.socket

└─# ps fax | grep polkit | grep -v grep
   1632 ?        Sl     0:01          \_ /usr/libexec/polkit-mate-authentication-agent-1
 582332 ?        Ssl    0:07 /usr/lib/polkit-1/polkitd --no-debug --log-level=notice

└─# systemctl status polkit-agent-helper.socket
○ polkit-agent-helper.socket - Authorization Manager Agent Helper
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper.socket; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:polkit(8)
     Listen: /run/polkit/agent-helper.socket (Stream)
   Accepted: 0; Connected: 0;

uptime... ;-)

└─# uptime          
 09:38:37 up 33 days, 17:19,  1 user,  load average: 1.77, 0.68, 0.30

Looks like your polkit-agent-helper is disabled and that's the issue.

Try that:

systemctl enable --now polkit-agent-helper.socket

That should fix the issue. If it doesn't fix it, try a reboot and retry. Does that work?

└─# systemctl enable --now polkit-agent-helper.socket
Created symlink '/etc/systemd/system/sockets.target.wants/polkit-agent-helper.socket' → '/usr/lib/systemd/system/polkit-agent-helper.socket'.

No change after enabling, need to reboot. Will try that momentarily.

Rebooting the system after enabling made the laptop work.

On the other two systems, (0009713:0021714) setuid permitted the root terminal to launch (across reboots), and their helpers are still disabled:

Sat May 30 17:42:16 PDT 2026

○ polkit-agent-helper.socket - Authorization Manager Agent Helper
     Loaded: loaded (/usr/lib/systemd/system/polkit-agent-helper.socket; disabled; preset: enabled)
     Active: inactive (dead)
       Docs: man:polkit(8)
     Listen: /run/polkit/agent-helper.socket (Stream)
   Accepted: 0; Connected: 0;

i.e.:

└─# ls -al /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root root 22840 Mar 31 21:49 /usr/lib/polkit-1/polkit-agent-helper-1

For some reason 3 of 3 systems didn't have the helper enabled (and I'm assuming that should have been the case since you mentioned it!). I'm wondering what the conditions are which do not set it to enabled. I'm surprised nobody else has reported this experience.

Guessing there are only a few situations where it's not enabled? (e.g., is not set... or becomes disabled after repeat crash)

Should the upgrade ensure it's enabled? Is this a Debian inherited thing?

For some reason 3 of 3 systems didn't have the helper enabled (and I'm assuming that should have been the case since you mentioned it!). I'm wondering what the conditions are which do not set it to enabled. I'm surprised nobody else has reported this experience.

I'm also curious about that. Do you think that you could zip the directory /var/log/apt on the machine that didn't have the setuid bit, and then send it over to [email protected]? The issue could be due to how packages are ordered during the "apt upgrade" transaction. For the polkit-agent-helper to be enabled you need the latest version of base-files (this is a Kali-specific thing). If both base-files and polkit are updagred together, maybe there's an issue. I think I tested this scenario, but not 100% sure anymore.

Note that the setuid bit should not be set, ie. you should remove it now that we know what is the correct fix (which is, to enable polkit-agent-helper.socket) .

The latest version of polkit did some refactoring so that there's no need for the setuid bit anymore, to increase security of the system. So setting the setuid bit reverts back to a less secure system -- not good!

Do you think that you could zip the directory /var/log/apt on the machine that didn't have the setuid bit, and then send it over to [email protected]?

Yes, just sent.

Thanks! I understand better what happens now. Because you updated your system at the time of https://bugs.kali.org/view.php?id=9497, at the time the service polkit-agent-helper.socket was disabled during the apt upgrade transaction, because that's what we do for network services by default in Kali, we disable it. Later on I update the policy to specifically allow the service polkit-agent-helper.socket (this is in the base-files package). But for all users that updated their system before that and got the bogus polkitd package, that was too late, the service was already disabled.

And there's nothing in place to forcefully enable polkit-agent-helper.socket when installed , so all those users have to enable it manually...

I'll check if I can force enabling polkit-agent-helper.socket somehow

And this is fixed with version 127+really127-3kali1 of polkitd ! Thank you very much @RZA_SF for helping to troubleshoot this issue!

Awesome, glad to help. Looking forward to reversing the setuid on those two boxes and testing it out. :-)