Why can I not open gedit with pkexec?

Question

I'm trying to run gedit as root, and heard that it is better to use pkexec over sudo -i.

However, when I run pkexec gedit I see this:

Unable to init server: Could not connect: Connection refused

(gedit:18425): Gtk-WARNING **: cannot open display: 

Why does this happen, and how can I use pkexec with gedit?

Answer 1

According to pkexec man:

The environment that PROGRAM will run it, will be set to a minimal known and safe environment in order to avoid injecting code through LD_LIBRARY_PATH or similar mechanisms. In addition the PKEXEC_UID environment variable is set to the user id of the process invoking pkexec. As a result, pkexec will not allow you to run X11 applications as another user since the $DISPLAY and $XAUTHORITY environment variables are not set. These two variables will be retained if the org.freedesktop.policykit.exec.allow_gui annotation on an action is set to a nonempty value; this is discouraged, though, and should only be used for legacy programs.

Thus to make it work - create a policy file:

/usr/share/polkit-1/actions/org.freedesktop.policykit.pkexec.policy

And put inside following text:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

  <action id="org.freedesktop.policykit.pkexec.run-gedit">
    <description>Run Gedit</description>
    <message>Authentication is required to run Gedit</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/sbin/gedit</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">TRUE</annotate>
  </action>

</policyconfig>

Note, this is a policy config only for gedit, it contains path to the executable.