Enable boot-start -create-polkit-rules no longer correctly detects the polkit version


With polkit versions 0.120 and below, the version number was structured with a major/minor format always using the major version of 0. It appears that Splunk was using that dot between them to decode the version number in its create-polkit-rules option to detect whether the older PKLA file or the newer JS version would be supported.

Starting in polkit version 121, the maintainers of polkit have dropped the "0." major number and started using the minor version as the major version. Because of this, Splunk does not currently seem to be able to deploy its own polkit rules. This affects both RHEL 9 and Ubuntu 24.04 so far in my testing. Has anyone else run into this issue or have another workaround for it? Thanks!


root@dev2404-1:~# pkcheck --version
pkcheck version 124
root@dev2404-1:~# apt-cache policy polkitd
  Installed: 124-2ubuntu1
  Candidate: 124-2ubuntu1
  Version table:
 *** 124-2ubuntu1 500
        500 noble/main amd64 Packages
        100 /var/lib/dpkg/status
root@dev2404-1:~# /opt/splunk/bin/splunk version
Splunk 9.2.1 (build 78803f08aabb)
root@dev2404-1:~# /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 1 -create-polkit-rules 1
": unable to parse Polkit major version: '.' separator not found.

Labels (3)
Tags (3)
0 Karma

New Member

Fresh proxmox 8.2 - same error when trying to deploy universal forwarder with polkit policy...

As for now, I am going the way via root user - but this clearly seems a bug splunk needs to address in his future version releases.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...