I wrote a post about updating KDE Neon without entering your password before. Since then the authentication system has changed a bit and a different approach is necessary. This post will explain what to do on Kubuntu 23.10 – however it should work on other distros using PackageKit (and recent Polkit).

Discover, the application managing package installation and updates on Kubuntu uses PackageKit as a backend for system package manipulation. That means packages you normally install/update with apt. In contrast to Snap and Flatpak packages that are managed by different backends. As explained in the amazing ArchWiki, whenever PackageKit requires admin rights, it queries Polkit. Let’s see it in action – open a terminal and run:

journalctl -fu polkit

Now start Discover, let it show you some available system updates and click the “Update” button. A password prompt should appear. Click cancel. New logs should show up in the terminal with Polkit journal:

kvě 08 11:52:24 wincak-tablet polkitd[125025]: Operator of unix-session:3 FAILED to authenticate to gain authorization for action org.freedesktop.packagekit.system-update for system-bus-name::1.586 [/usr/bin/plasma-discover --mode update] (owned by unix-user:wincak)

Here we see that /usr/bin/plasma-discover was asking Polkit to authenticate action org.freedesktop.packagekit.system-update but the request was denied by clicking the cancel button. That’s all the info we need. Now we need to add a Polkit rule that always allow this action to proceed. It would be possible to modify current Polkit policy files but as explained in the wiki article, the right approach is to add a new rule. Let’s create a new file: /etc/polkit-1/rules.d/00-discover.rules and enter a new rule:

/* Allow running Discover update without authentication */
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.packagekit.system-update") {
        return polkit.Result.YES;
    }
});

This rule universally allows everyone to run the mentioned action. It’s possible to make the rule stricter by allowing only certain users or groups, etc. but this works for me. Right when you save and close the file, new logs should appear in the Polkit journal:

kvě 08 11:54:40 wincak-tablet polkitd[125025]: Reloading rules
kvě 08 11:54:40 wincak-tablet polkitd[125025]: Collecting garbage unconditionally...
kvě 08 11:54:40 wincak-tablet polkitd[125025]: Loading rules from directory /etc/polkit-1/rules.d
kvě 08 11:54:40 wincak-tablet polkitd[125025]: Loading rules from directory /usr/share/polkit-1/rules.d
kvě 08 11:54:40 wincak-tablet polkitd[125025]: Finished loading, compiling and executing 13 rules

Here we can see the new rule loaded OK. In case you made a typo, you would see an error.

And that’s it!