polkit is just the layer that takes care of answering the question "is the caller authorized to do this action". It's not setuid. pkexec is setuid, it gets lau

polkit is just the layer that takes care of answering the question "is the caller authorized to do this action". It's not setuid. pkexec is setuid, it gets launched as root, asks polkit, and then does the thing the user asks or exits saying "you're not allowed".