polkit
The pending polkit authentication request, its progress and the last failure.
The password never reaches Lua: a secure field with
secure_submit = { capability = "polkit", action = "authenticate" } sends it straight to the
Supervisor.
column {
visible = mantle.polkit:map(function(polkit)
return polkit ~= nil and polkit.active
end),
spacing = 8,
children = {
text {
content = mantle.polkit:map(function(polkit)
return polkit and polkit.message or ""
end),
},
textfield {
width = 280,
height = 24,
placeholder = "Password",
secure_submit = { capability = "polkit", action = "authenticate" },
},
text {
foreground = "#F38BA8",
content = mantle.polkit:map(function(polkit)
return polkit and polkit.error or ""
end),
},
button {
on_click = function() mantle.polkit:cancel() end,
children = { text { content = "Cancel" } },
},
},
}
State
mantle.polkit:get() returns PolkitState, nil before the first push. A field marked ? may be absent.
mantle.polkit’s payload. Every other field is empty while active is false.
| Field | Type | Description |
|---|---|---|
action_id | string | Action being authorized, e.g. org.freedesktop.systemd1.manage-units. |
active | boolean | polkitd is waiting for the user to authenticate. |
authenticating | boolean | A password is with PAM. A second submit is refused while true. |
error | string | Drawable reason for the last failure, e.g. "authentication failed". The prompt stays open to retry. |
icon_name | string | Themed icon name, or empty when the caller set none. |
message | string | The action’s prompt, e.g. "Authentication is required to ...", in en_US: the locale the agent registers with. |
Actions
Call each as mantle.polkit:<action>(arguments...); ? marks an argument you may omit.
| Action | Arguments | Description |
|---|---|---|
cancel | Dismisses the prompt; the requesting program sees the request cancelled. |
Backend
On first read, registers as the authentication agent for $XDG_SESSION_ID’s session, at
/org/mantle/PolicyKit1/AuthenticationAgent with locale en_US.UTF-8. If another agent already
answers, it stays off for the run. polkitd accepts an answer only from uid 0, so the
PAM worker hands the password to polkit’s root helper at
/run/polkit/agent-helper.socket. The agent is polkit.rs.
Gotchas
| Trap | Fix |
|---|---|
| A second program’s prompt never shows | One request at a time: a request arriving while another is on screen is cancelled, and its program sees the cancel. Finish or cancel the first |
| Prompts go to another agent | polkit-gnome, hyprpolkitagent or similar registered first. Stop it and restart Mantle |
| The prompt stays open after a wrong password | By design: error says why, and the next submit retries |
See also: secure fields; FAQ for prompts that never appear.