Knowledge Base (Posts about policykit)

Polkit rule for Fedora Media Writer

bgstack15 — Thu, 21 Oct 2021 13:26:09 GMT

Policy Kit is a complex piece of software that tries to do more than it probably should. And sometimes you get stuck using software like that. Thankfully, there's a great manpage on the Internet for writing the rules.

I added a policykit rule so that Fedora Media Writer (a gui for placing an image on removable media) would work with my "admins" user group. I use a FreeIPA group named admins instead of the local group wheel.

Write a new file, /usr/share/spolkit-1/rules.d/fedora-media-writer.rules and fill with these contents.

polkit.addRule(function(action, subject) {
   if (action.id == "org.freedesktop.udisks2.open-device") {
      polkit.log("action=" + action);
      polkit.log("subject=" + subject);
      if (subject.isInGroup("wheel") || subject.isInGroup("admins")) {
         return polkit.Result.YES;
      }
   }
});

The policykit daemon should immediately detect the changes.

Devuan with lightdm and xfce will not let user reboot or shutdown from user session

bgstack15 — Sun, 01 Sep 2019 13:14:30 GMT

I use Devuan GNU+Linux on most of my desktop systems now. I use XFCE, but I have my daily driver on Fluxbox because I can. Well, I think a recent change that happened, or else I only recently noticed it, was that when I use Devuan ceres with lightdm (instead of slim) with xfce4, the user cannot effectively select "Restart" or "Shutdown" from the menu. The options may nor may not be enabled, but selecting either of them just return the user to the login screen. For some random reason I was searching for "consolekit" on the Devuan forum and stumbled across an interesting title: HOWTO: lightdm (with libpam-elogind) + xfce4 (ASCII/Stable) / Documentation / Dev1 Galaxy Forum After adapting the instructions for ceres (unstable) release, I am pleased to announce the successful results! The steps that I took are the following. Observe that they are briefer than the instructions provided by the source. Trying to add or remove other packages than the two listed here on my system caused apt-get to want to remove some crazy sets of packages which I obviously wanted to keep

sudo apt-get install --no-install-recommends libpolkit-gobject-elogind-1-0 policykit-1 lightdm lightdm-gtk-greeter
# and adjust pam:
sed -i -r -e '/session\s+optional\s+pam_systemd.so/s/systemd/elogind/;' /etc/pam.d/lightdm-greeter

I chose to reboot to ensure lightdm inherited the new pam settings. And, then my user could shut down from the user session! It's the little things, isn't it...

PolicyKit rule for admins to automatically mount iso files in file manager

bgstack15 — Wed, 09 Jan 2019 14:18:08 GMT

If you use a graphical file manager and want to take advantage of automatically mounting .iso files, you might be prompted to authenticate as an authorized user. This interrupts the workflow, and should not happen.

![XFCE PolicyKit Agent warning about authentication required to perform an

action](/2019/01/Screenshot_2018-12-29_20-30-30.jpg) Workflow interruption detected! A Linux guru is needed if you want to automate this.

Here is a polkit rule you can make and place in the /usr/lib/polkit-1/rules.d directory. I don't think freeipa has policykit abilities, so you have to apply this file locally for any system that needs it. https://gitlab.com/snippets/1793736

// File: /usr/share/polkit-1/rules.d/mount-iso.rules
// File: /usr/share/polkit-1/rules.d/mount-iso.rules
// Author: bgstack15
// Startdate: 2018-12-29 19:18
// Title: PolicyKit Rules for Allowing FreeIPA admins to mount loop devices for ISO files
// History:
// Usage:
// Reference:
//    https://www.freeipa.org/page/Howto/FreeIPA_PolicyKit
//    lightdm.rules
//    https://askubuntu.com/questions/536405/location-of-policykit-log-output/536432#536432
// Documentation: comments are C-style
polkit.addRule(function(action, subject) {
    if ( (action.id.indexOf("org.freedesktop.udisks2.filesystem-mount-system") == 0) || 
         (action.id.indexOf("org.freedesktop.udisks2.loop-modify-others") == 0) ) {
        polkit.log("action=" + action);
        polkit.log("subject=" + subject);
        if (subject.isInGroup ("wheel") || subject.isInGroup("admins") || subject.isInGroup("cdrom")) {
            return polkit.Result.YES;
        }
    }
});

I realize the logic is crude so if you have any improvements, please share them!

Add policykit rules for virt-manager

bgstack15 — Sun, 28 Oct 2018 12:48:56 GMT

If a user wants to use virt-man to control virtual machines on localhost, he will be prompted to authenticate to policykit. If you have a policykit rule established (as the libvirt package already provides) for the right group, it's seamless. Just make sure the user is in group "libvirt" (from /usr/share/polkit-1/rules.d/50-libvirt.rules) Or, to make a different group the (additional) accepted value:

tf=/etc/polkit-1/rules.d/80-libvirt.rules
touch "${tf}" ; chmod 0644 "${tf}"
cat <<EOF >"${tf}"
polkit.addRule(function(action, subject) {
  if (action.id == "org.libvirt.unix.manage" && subject.local && subject.active && subject.isInGroup("wheel")) {
      return polkit.Result.YES;
  }
});
EOF

References

Web links

1. How do I prevent virt-manager from asking for the root password? - Super User