title: polkit-gnome-authentication-agent-1 fail to start in docker without privileged flag
body: <p>I'm using next docker gui container:</p>
  
  <pre><code>FROM centos:6
  
  RUN yum -y install epel-release
  RUN yum -y groupinstall "X Window System" "Desktop" "General Purpose Desktop"
  RUN yum -y install openssh-server x2goserver x2goserver-xsession x2goserver-fmbindings x2goserver-printing pwgen
  RUN yum reinstall glibc-common # fix some issues
  RUN chkconfig sshd on
  RUN sed -i "s/UsePAM.*/UsePAM no/g" /etc/ssh/sshd_config
  RUN sed -i "s/#PermitRootLogin/PermitRootLogin/g" /etc/ssh/sshd_config
  RUN adduser vagrant
  RUN echo 'root:vagrant' | chpasswd
  RUN echo 'vagrant:vagrant' | chpasswd
  RUN service sshd restart
  RUN echo '#!/bin/bash' &gt; /run.sh
  RUN echo 'mkdir -p /tmp/.X11-unix' &gt;&gt; /run.sh
  RUN echo 'chmod 1777 /tmp/.X11-unix' &gt;&gt; /run.sh
  RUN echo 'service messagebus start' &gt;&gt; /run.sh
  RUN echo 'exec /usr/sbin/sshd -D' &gt;&gt; /run.sh
  RUN chmod +x /run.sh
  EXPOSE 22
  CMD ["/run.sh"]
  </code></pre>
  
  <p>And when I run it without <code>--privileged</code> flag, <code>polkit-gnome-authentication-agent-1</code> (<code>PolicyKit Authentication Agent</code> in Startup applications) failing to start and applications which require root permissions at some stage (for example <code>gpk-application</code> - <code>Add/Remove Software</code> menu item) could not get these permissions.</p>
  
  <pre><code>$ /usr/libexec/polkit-gnome-authentication-agent-1
  
  (polkit-gnome-authentication-agent-1:772): polkit-gnome-1-WARNING **: Unable to determine the session we are in: Remote Exception invoking org.freedesktop.ConsoleKit.Manager.GetSessionForUnixProcess() on /org/freedesktop/ConsoleKit/Manager at name org.freedesktop.ConsoleKit: org.freedesktop.ConsoleKit.Manager.GeneralError: Unable to lookup session information for process '772' org.freedesktop.ConsoleKit.Manager.GeneralError Unable%20to%20lookup%20session%20information%20for%20process%20%27772%27
  </code></pre>
  
  <p>I don't want to use <code>--privileged</code> flag, so I'm modifying desktop files for such application, adding <code>beesu</code> as workaround:</p>
  
  <pre><code>RUN yum -y install beesu
  RUN sed -i "s/Exec=gpk-application/Exec=beesu gpk-application/g" /usr/share/applications/gpk-application.desktop
  </code></pre>
  
  <p>Which asking root password upfront (even when you don't need in this particular run) and triggers additional warning that gpk-application should not be run from root.</p>
  
  <p>Is there better workaround (ideally which allows <code>polkit-gnome-authentication-agent-1</code> to run successfully)?</p>
  
  <p>My docker host is Ubuntu 16.04 VM on ESXi 6.5, apparmor enabled. It looks to me that I need to enable some apparmor capability, but I don't see apparmor audit records in /var/log/kern.log.</p>
  
  <pre><code>$ docker version
  Client:
   Version:      1.13.1
   API version:  1.26
   Go version:   go1.7.5
   Git commit:   092cba3
   Built:        Wed Feb  8 06:50:14 2017
   OS/Arch:      linux/amd64
  
  Server:
   Version:      1.13.1
   API version:  1.26 (minimum version 1.12)
   Go version:   go1.7.5
   Git commit:   092cba3
   Built:        Wed Feb  8 06:50:14 2017
   OS/Arch:      linux/amd64
   Experimental: true
  
  $ docker info
  Containers: 15
   Running: 12
   Paused: 0
   Stopped: 3
  Images: 1083
  Server Version: 1.13.1
  Storage Driver: zfs
   Zpool: zmain
   Zpool Health: ONLINE
   Parent Dataset: zmain/docker
   Space Used By Parent: 25711493632
   Space Available: 2017301029888
   Parent Quota: no
   Compression: on
  Logging Driver: json-file
  Cgroup Driver: cgroupfs
  Plugins:
   Volume: local
   Network: bridge host ipvlan macvlan null overlay
  Swarm: inactive
  Runtimes: runc
  Default Runtime: runc
  Init Binary: docker-init
  containerd version: aa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1
  runc version: 9df8b306d01f59d3a8029be411de015b7304dd8f
  init version: 949e6fa
  Security Options:
   apparmor
   seccomp
    Profile: default
  Kernel Version: 4.4.0-64-generic
  Operating System: Ubuntu 16.04.2 LTS
  OSType: linux
  Architecture: x86_64
  CPUs: 56
  Total Memory: 147.6 GiB
  Name: dockerl1
  ID: 2QMS:5T3N:Y7CT:FFOK:A3PI:VGVB:WHW3:V43D:AHOD:MFX3:WB4C:6UBY
  Docker Root Dir: /var/lib/docker
  Debug Mode (client): false
  Debug Mode (server): false
  Registry: https://index.docker.io/v1/
  WARNING: No swap limit support
  Experimental: true
  Insecure Registries:
   docker.acme.com
   registry-proxy.acme.com
   127.0.0.0/8
  Registry Mirrors:
   registry-proxy.acme.com
  Live Restore Enabled: true
  </code></pre>