I found the root cause of this issue.Since polkit 127, pkexec resolves the program path with realpath(3) *before* matching it against the org.freedesktop.policykit.exec.path annotations. This comes from upstream commit 9aa43e089d870a8ee695e625237c5b731b250678 ("pkexec: Use realpath when comparing org.freedesktop.policykit.exec.path"), which was meant to handle usrmerge aliasing (/bin/foo vs /usr/bin/foo, upstream issue polkit-org/polkit#194).
The annotation match in find_action_for_path() is an exact string comparison, so if the annotated path is a symlink the resolved path no longer matches, the action is silently not found, and pkexec falls back to the implicit action. As a consequence allow_gui is not applied (DISPLAY and XAUTHORITY get stripped), and any custom defaults/message of the action are ignored as well.
In my case: /usr/bin/bleachbit is a symlink to /usr/share/bleachbit/bleachbit.py, so the org.bleachbit action (which has allow_gui=true, as shown by pkaction) is no longer matched. allow_gui itself is not broken: the same annotation works if the annotated path is not a symlink. This also explains why manually passing the variables with "pkexec env DISPLAY=... XAUTHORITY=..." works.
So the behavior contradicts both the pkexec(1) manpage (which still says DISPLAY/XAUTHORITY are retained when allow_gui is set) and the least-surprise expectation for packages whose entry point in /usr/bin is a symlink (fairly common for interpreted programs). The upstream commit message itself warned "a review of your <annotate key=\"org.freedesktop.policykit.exec.path\"> actions might be in order", but nothing was documented in NEWS or the manpage, and affected actions fail silently.
Possible fixes on the polkit side:- match the annotation against both the pre-realpath absolute path and the resolved one (or also canonicalize the annotation value before comparing), or - at minimum document the behavior change in pkexec(1)/NEWS so packages know they must annotate the canonical path.
I have worked around it in bleachbit by shipping a second action with the resolved path (keeping the old one for pkexec < 127), which will be in bleachbit 6.0.2-1. Other packages with symlinked exec.path annotations are likely affected in the same way.
Please consider forwarding this upstream (https://github.com/polkit-org/polkit/issues).
OpenPGP_signature.asc
Description: OpenPGP digital signature
