With polkit versions 0.120 and below, the version number was structured with a major/minor format always using the major version of 0. It appears that Splunk was using that dot between them to decode the version number in its create-polkit-rules option to detect whether the older PKLA file or the newer JS version would be supported.
Starting in polkit version 121, the maintainers of polkit have dropped the "0." major number and started using the minor version as the major version. Because of this, Splunk does not currently seem to be able to deploy its own polkit rules. This affects both RHEL 9 and Ubuntu 24.04 so far in my testing. Has anyone else run into this issue or have another workaround for it? Thanks!
root@dev2404-1:~# pkcheck --version
pkcheck version 124
root@dev2404-1:~# apt-cache policy polkitd
polkitd:
Installed: 124-2ubuntu1
Candidate: 124-2ubuntu1
Version table:
*** 124-2ubuntu1 500
500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
100 /var/lib/dpkg/status
root@dev2404-1:~# /opt/splunk/bin/splunk version
Splunk 9.2.1 (build 78803f08aabb)
root@dev2404-1:~# /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 -create-polkit-rules 1
"
": unable to parse Polkit major version: '.' separator not found.
^C
root@dev2404-1:~#
https://github.com/polkit-org/polkit/tags
