$ cat /usr/src/mini-polkit/README.md

mini-polkit

A secure and minimal PolicyKit authentication agent designed for lightweight and embedded Linux environments. It provides a secure, modular and customizable way to interact with PolicyKit authorization requests via external prompt tools.

Built for simplicity. Designed for power users.

Features

Minimal Codebase
Pure C implementation with only 307 lines of code
Zero Bloat
Only depends on glib and polkit
Universal Integration
Works with dmenu, rofi, zenity or any custom script
Secure by Design
Performant and highly secure password handling (no lingering in memory)
Display Server Agnostic
X11 and Wayland ready, depending on your prompt manager
Versatile Environment
Suitable for tiling Window Managers and floating setups

Performance (on my ancient system)

Benchmark
Language C
Lines of Code 307
Memory Usage (RSS) ≤5.6 MB
Startup Time ≤15 ms
Authentication Latency ≤40 ms
Process Count 1
D-Bus Roundtrips 1

Usage

When PolKit requests authentication, mini-polkit runs your command, reads the stdout as the password, then securely passes it to PolKit via D-Bus — thats it :3

To show the PolKit message inside your prompt, use {{MESSAGE}}:

mini-polkit "zenity --password --title='{{MESSAGE}}'"

As long as your tool writes the password to stdout, you're good.

Run mini-polkit in the background (e.g. using &), to make it act as a full-time agent

mini-polkit "zenity --password" &

You can autostart it via .xinitrc, .bash_profile, systemd or whatever you like.

Installation

Clone, build and install manually:

(deps. gcc, make, pkg-config, polkit-agent-1, glib->v2.0)
git clone https://github.com/cyber-amr/mini-polkit.git
cd mini-polkit
doas make install

Security Notes

  • Password is securely passed to PolicyKit via DBus and wrecked right afterwards from memory.
  • Input is read from stdin to avoid command-line exposure.
  • It is your responsibility to ensure the prompt tool handles input securely (e.g., dmenu with -P, rofi with -password).