prompt to enter root pw for /bin/sh on boot

[KeithMorgan0101]

In the last week my desktop system has started prompting for the root pw to execute /bin/sh during boot. The only detail/explanation provided is that the request is by org.freedesktop.policykit.exe. I haven't installed anything new so it is very suspicious that it just started happening out of the blue and there is no identification of what application or service is requesting root perms. Of course, I have been clicking 'cancel' rather than providing the pw since this looks very scammy. Anyone have an idea what this is or how I should get rid of it?

[berniewalp]

I have this question also. I, too, will continue to decline authentication until I learn that it is okay. Can anyone point us to more information? Thanks.

[karlchen]

Hello, KeithMorgan0101.

In the last week my desktop system has started prompting for the root pw to execute /bin/sh during boot.

At which point during the system boot does this request appear?
Does it happen, before the graphical login screen appears? Or does it happen, after you have completed the graphical login screen?

Of course, I have been clicking 'cancel'

This strongly suggests that the request appears, after the graphical login screen has been completed and after the graphical desktop has been loaded. Else there would be no mouse support, yet.

Can you create a screenshot of the request window, please, and share it with us? Maybe it will ring a bell what it is.

The only detail/explanation provided is that the request is by org.freedesktop.policykit.exe.

First let me say that I doubt that the suffix .exe is present in the request, because .exe is the Windows filename extension for executable files. Linux does not use the filename extension .exe by default.
Anyway, this seems to suggest that there is a "Startup Applications.", which wants to start up, but which needs root privileges to do so and which as a consequence asks you to enter your password in order to authenticate as a user, who is permitted to execute commands with root permissions.
Such applications should not be present in "Startup Applications".

Advice:
Please, check you "Startup Applications". Best navigate to /home/<yourusername>/.config/autostart with your file-manager and inspect each .desktop file in the folder autostart for the term policykit.

Of course, I have been clicking 'cancel' rather than providing the pw since this looks very scammy.

This is the right approach, definitely, till it has been determined, what it is precisely and why it wants to run under the root account.

Best regards,
Karl

[karlchen]

Hello, berniewalp.

I have this question also. I, too, will continue to decline authentication until I learn that it is okay.

Whatever I have just written to the thread starter KeithMorgan0101, basically replies to you as well. (Not even sure whether KeithMorgan0101 is still monitoring his own thread.)

Best regards,
Karl

[berniewalp]

Thank you Karl.

Wiki Pedia says: "in May 2021 a 7-year-old bug was discovered by GitHub staff member Kevin Backhouse, it was reported to the Polkit maintainers and Red Hat’s security team, a fix was released on 3 June 2021."