The point is that pkexec uses different mechanisms for authorization and authentication. Authentication is how you prove who you are. Authorization is the rules that determine what you can do. Sudo relies on traditional Unix discretionary access controls for authentication. These consist of your user's UID, GID, and password. So you can configure sudo to authenticate users based on their user, group membership, and/or passwords. Sudo relies on sudoers files for determining authorization. You put in there rules on what commands can be executed as what user, whether they require a password, and so on and so forth. Sudo is most useful in situations were you want to be able to log root access to particular users. Giving sudo access to the command is pretty much the same as granting them root access. Instead of them logging in as root using root's password (which doesn't give you a indication of who they are), they have to execute sudo which creates a log entry that indicates when and who executed a particular command. It isn't really useful in strongly limiting root access since it is usually trivial for a attacker to trick programs into giving them full root access. Thus limiting what commands they can execute is more of just a way to limit accidental foot-shooting. Of course you can use sudo to grant access from one user account to another, but it is less commonly used for that. Pkexec, on the other hand, adds sudo-like CLI features to Polkit (formally known as policykit). The point of polkit is mostly for authentication/authorizing users to communicate between processes. Like if you are on your desktop and you plug in a USB drive... does your user have the right to have the desktop environment automatically mount the drive for you? So when you plug in a USB drive the udev system sends a notification out over DBUS that a drive was plugged in. Your Desktop Environment daemons (KDE or Gnome or whatever) receive the dbus message and then sends a request to udisk daemon running as root to mount the drive on their behalf. Polkit provides the policy mechanism to determine if your user is authorized to perform that action. So it regulates the interact between your DE and udisk. Polkit policies are a lot more fine grained then sudoer rules and can make decisions based on context. Like if you are logged over SSH you can have a different set of rules then if you are logged directly into the machine. This is generally considered a lot more secure then using sudo for mounting because it doesn't require using root to execute commands. Instead you are sending requests to privileged daemons and they decide whether or not to actually perform the action. Pkexec then allows you to use polkit rules instead of sudo for doing sudo-like stuff. You lose a lot of the security benefits, but it does allow people to only have to rely on a single policy source. I don't think that it is very commonly used, though. Answer from natermer on reddit.com