It's a way to let user processes communicate with privileged processes while potentially, action dependent also prompting the user for a password.
pkexec on the other hand is separate program bundled with polkit which is kinda which let's you combine polkit with running predefined commands, or easily accidentally any command and IMHO should not exist.
there are various programs which work with polkit (even if they don't necessary require it) including:
- systemd, logind, NetworkManager, udisks, flatpack, fwupd, timedate(setting), and others
It also allows rather flexible configurations about what users can do which actions under which conditions, which can be quite useful for a multi-user server (e.g. GPU server).
While I think a program like polkit is a must have for a modern Linux OS I'm not a fan of it's design.
- pkexec is a bad idea for many more reasons then this vulnerability
- the way it's configured and how it handles caching is prone to accidentally make mistakes with security consequences
- pkexec should not exist, even without the vulnerability it's really easy to mess up using it
- having a embedded language for handling permission scripting, and not inventing your own language or pseudo-language config format is a good. But js? I guess there are simple embedded js interpreters.(1)
(1): Note that it only runs small snippets, so no need to have a JS interpreter with modern features like classes, or an JIT ;=)