Polkit - Revision history

Ntninja: Show how to do authorization request debugging

2026-02-19T21:17:20Z

Show how to do authorization request debugging

← Older revision		Revision as of 21:17, 19 February 2026
Line 52:		Line 52:

	(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.)		(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.)

			=== Debugging requested rules ===

			To have Polkit print debug information for every incoming authorization, it is possible to create a debugging rule and enable Polkit debug printing:

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			security.polkit = {
			debug = true; // Enables `polkit.log` function
			extraConfig = ''
			polkit.addRule(function(action, subject) {
			polkit.log("");
			polkit.log("action=" + action);
			polkit.log("subject=" + subject);
			});
			'';
			};
			</nowiki>}}

	== Authentication agents ==		== Authentication agents ==

Rrdpad: Update syntax for example systemd unit

2025-04-02T15:56:07Z

Update syntax for example systemd unit

@@ Line 61: / Line 61: @@
 Alternatively, you can start it on login by creating a systemd user service:
 <syntaxhighlight lang="nix">
 systemd.user.services.polkit-gnome-authentication-agent-1 = {
@@ Line 79: / Line 97: @@
    };
 };
-</syntaxhighlight>
+</syntaxhighlight>Another option is <code>lxqt.lxqt-policykit</code>, which can be launched on login through the command <code>lxqt-policykit-agent</code> on e.g. Hyprland.
 == Start the authentication agent in dwm ==

PopeRigby: Update syntax for example systemd unit

2025-01-31T04:03:39Z

Update syntax for example systemd unit

← Older revision		Revision as of 04:03, 31 January 2025
Line 62:		Line 62:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	systemd ~~= {~~		systemd.user.services.polkit-gnome-authentication-agent-1 = {
	user.services.polkit-gnome-authentication-agent-1 = {		Unit = {
	~~description~~ = "polkit-gnome-authentication-agent-1";		Description = "polkit-gnome-authentication-agent-1";
	~~wantedBy~~ = [ "graphical-session.target" ];		Wants = [ "graphical-session.target" ];
	~~wants~~ = [ "graphical-session.target" ];		After = [ "graphical-session.target" ];
	~~after~~ = [ "graphical-session.target" ];		};
	~~serviceConfig~~ = {		Install = {
	Type = "simple";		WantedBy = [ "graphical-session.target" ];
	ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";		};
	Restart = "on-failure";		Service = {
	RestartSec = 1;		Type = "simple";
	TimeoutStopSec = 10;		ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
	};		Restart = "on-failure";
			RestartSec = 1;
			TimeoutStopSec = 10;
	};		};
	};		};

Dass: Fix minor typing and consistency errors

2024-12-30T22:52:04Z

Fix minor typing and consistency errors

← Older revision		Revision as of 22:52, 30 December 2024
Line 94:		Line 94:
	</syntaxhighlight>		</syntaxhighlight>

	Use this method, you won't need to change the codes even <code>mate.mate-polkit</code> gets an update.		Use this method, you won't need to change the codes even if <code>mate.mate-polkit</code> gets an update.

	<syntaxhighlight lang=bash>		<syntaxhighlight lang=bash>
	#!/bin/sh		#!/bin/sh
	...		...
	/nix/store/$(ls -la /nix/store \| grep polkit-kde-agent \| grep '^d' \| awk '{print $9}')/libexec/polkit-kde-authentication-agent-1 &		/nix/store/$(ls -la /nix/store \| grep 'polkit-kde-agent' \| grep '^d' \| awk '{print $9}')/libexec/polkit-kde-authentication-agent-1 &
	...		...
	</syntaxhighlight>		</syntaxhighlight>

	The same but for <code>polkit-kde-agent</code>		The same but for <code>polkit-kde-agent</code>.

Artoria2e5: /* Writing rules */ /etc/polkit-1/rules.d/10-nixos.rules

2024-07-10T12:24:09Z

Writing rules: /etc/polkit-1/rules.d/10-nixos.rules

← Older revision		Revision as of 12:24, 10 July 2024
Line 11:		Line 11:

	On NixOS, Polkit uses [https://duktape.org/ Duktape] as its JavaScript runtime. Keep that in mind when you try to write newfangled code.		On NixOS, Polkit uses [https://duktape.org/ Duktape] as its JavaScript runtime. Keep that in mind when you try to write newfangled code.

			The rules you write, together with any rule generated by <code>security.polkit</code>, is stored at <code>/etc/polkit-1/rules.d/10-nixos.rules</code> for the current running generation.

	=== Reboot/poweroff for unprivileged users ===		=== Reboot/poweroff for unprivileged users ===

Artoria2e5: /* No password for wheel */

2024-07-10T12:20:26Z

No password for wheel

← Older revision		Revision as of 12:20, 10 July 2024
Line 38:		Line 38:

	=== No password for wheel ===		=== No password for wheel ===
	The following rule is the analogue of NOPASSWD:ALL in [[sudo]], in that ~~all~~ wheel users do not need to authenticate again when performing ''any'' action.		The following rule is the analogue of NOPASSWD:ALL in [[sudo]], in that wheel users do not need to authenticate again when performing ''any'' action.

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>

Artoria2e5: Group rules together. Add a rule "no password for wheel", because who doesn't have wheelNeedsPassword on their plaything?

2024-07-10T12:20:08Z

Group rules together. Add a rule "no password for wheel", because who doesn't have wheelNeedsPassword on their plaything?

← Older revision		Revision as of 12:20, 10 July 2024
Line 7:		Line 7:
	Polkit is disabled by default. If you wish to enable it, you can set <code>security.polkit.enable</code> to true. (However, if you are running any one of the desktop environments, you are likely to have polkit enabled as a dependency.)		Polkit is disabled by default. If you wish to enable it, you can set <code>security.polkit.enable</code> to true. (However, if you are running any one of the desktop environments, you are likely to have polkit enabled as a dependency.)

	== Reboot/poweroff for unprivileged users ==		== Writing rules ==
			The Polkit rule language is described at https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules. It is really just JavaScript with an API.

			On NixOS, Polkit uses [https://duktape.org/ Duktape] as its JavaScript runtime. Keep that in mind when you try to write newfangled code.

			=== Reboot/poweroff for unprivileged users ===

	With the following rule, we can grant the permissions <code>reboot</code> and <code>poweroff</code> a machine to users in the <code>		With the following rule, we can grant the permissions <code>reboot</code> and <code>poweroff</code> a machine to users in the <code>
Line 16:		Line 21:
	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
	security.polkit.extraConfig = ''		security.polkit.extraConfig = ''
	polkit.addRule(function(action, subject) {		polkit.addRule(function (action, subject) {
	if (		if (
	subject.isInGroup("users")		subject.isInGroup("users") &&
	&& (		[
	~~action.id ==~~ "org.freedesktop.login1.reboot" \|\|		"org.freedesktop.login1.reboot",
	~~action.id ==~~ "org.freedesktop.login1.reboot-multiple-sessions" \|\|		"org.freedesktop.login1.reboot-multiple-sessions",
	~~action.id ==~~ "org.freedesktop.login1.power-off" \|\|		"org.freedesktop.login1.power-off",
	~~action.id ==~~ "org.freedesktop.login1.power-off-multiple-sessions"		"org.freedesktop.login1.power-off-multiple-sessions",
	)		].indexOf(action.id) !== -1
	)		) {
	{
	return polkit.Result.YES;		return polkit.Result.YES;
	}		}
Line 33:		Line 37:
	</nowiki>}}		</nowiki>}}

	(The ~~above~~ is ~~a PolKit rule~~, ~~which is based on JavaScript~~. ~~See https:~~//~~www~~.~~freedesktop~~.~~org/software/~~polkit~~/docs/latest/~~polkit.8.~~html#~~polkit~~-rules for more information on~~ the ~~language~~.)		=== No password for wheel ===
			The following rule is the analogue of NOPASSWD:ALL in [[sudo]], in that all wheel users do not need to authenticate again when performing ''any'' action.

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			security.polkit.extraConfig = ''
			polkit.addRule(function(action, subject) {
			if (subject.isInGroup("wheel"))
			return polkit.Result.YES;
			});
			'';
			</nowiki>}}

			(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.)

	== Authentication agents ==		== Authentication agents ==

Artoria2e5: /* Enable polkit */

2024-07-10T11:43:09Z

Enable polkit

← Older revision		Revision as of 11:43, 10 July 2024
Line 5:		Line 5:
	== Enable polkit ==		== Enable polkit ==

	Polkit is disabled by default. If you wish to enable it, you can set <code>security.polkit.enable</code> to true.		Polkit is disabled by default. If you wish to enable it, you can set <code>security.polkit.enable</code> to true. (However, if you are running any one of the desktop environments, you are likely to have polkit enabled as a dependency.)

	== Reboot/poweroff for unprivileged users ==		== Reboot/poweroff for unprivileged users ==

Artoria2e5: /* Reboot/poweroff for unprivileged users */

2024-07-10T11:40:46Z

Reboot/poweroff for unprivileged users

← Older revision		Revision as of 11:40, 10 July 2024
Line 33:		Line 33:
	</nowiki>}}		</nowiki>}}

	(The above is a PolKit rule in JavaScript ~~format~~. See https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules for more information on the language.)		(The above is a PolKit rule, which is based on JavaScript. See https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules for more information on the language.)

	== Authentication agents ==		== Authentication agents ==

Artoria2e5: /* Reboot/poweroff for unprivileged users */

2024-07-10T11:40:15Z

Reboot/poweroff for unprivileged users

← Older revision		Revision as of 11:40, 10 July 2024
Line 32:		Line 32:
	'';		'';
	</nowiki>}}		</nowiki>}}

			(The above is a PolKit rule in JavaScript format. See https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html#polkit-rules for more information on the language.)

	== Authentication agents ==		== Authentication agents ==