pkexec wrapper might be called without us having a chance to know that. Therefore I’ve now added logging when pkexec wrapper is called to systemd journal. (Calls to sudo are similarly logged by Debian default.)
https://github.com/Whonix/security-misc/commit/082f04f2d4101828455a4a9b2852376a72ced6ce
Identifying xfce4-power-manager xfpm-power-backlight-helper pkexec lxsudo popup - #2 by Patrick was simple but other stuff might otherwise be hard to debug.
https://github.com/Whonix/security-misc/commit/082f04f2d4101828455a4a9b2852376a72ced6ce