Official NixOS Wiki

Polkit: Difference between revisions

← Older edit
DHCP (talk | contribs)
232 edits
VisualWikitext
→Writing rules: /etc/polkit-1/rules.d/10-nixos.rules
DHCP (talk | contribs)
232 edits
m fix indentation
 
(4 intermediate revisions by 4 users not shown)
Line 22: Line 22:


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
  security.polkit.extraConfig = ''
security.polkit.extraConfig = ''
    polkit.addRule(function (action, subject) {
  polkit.addRule(function (action, subject) {
      if (
    if (
        subject.isInGroup("users") &&
      subject.isInGroup("users") &&
        [
      [
          "org.freedesktop.login1.reboot",
        "org.freedesktop.login1.reboot",
          "org.freedesktop.login1.reboot-multiple-sessions",
        "org.freedesktop.login1.reboot-multiple-sessions",
          "org.freedesktop.login1.power-off",
        "org.freedesktop.login1.power-off",
          "org.freedesktop.login1.power-off-multiple-sessions",
        "org.freedesktop.login1.power-off-multiple-sessions",
        ].indexOf(action.id) !== -1
      ].indexOf(action.id) !== -1
      ) {
    ) {
        return polkit.Result.YES;
      return polkit.Result.YES;
      }
    }
    });
  });
  '';
'';
</nowiki>}}
</nowiki>}}


Line 43: Line 43:


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
   security.polkit.extraConfig = ''
security.polkit.extraConfig = ''
  polkit.addRule(function(action, subject) {
    if (subject.isInGroup("wheel"))
      return polkit.Result.YES;
   });
'';
</nowiki>}}
 
(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.)
 
=== Debugging requested rules ===
 
To have Polkit print debug information for every incoming authorization, it is possible to create a debugging rule and enable Polkit debug printing:
 
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
security.polkit = {
  debug = true;  // Enables `polkit.log` function
  extraConfig = ''
     polkit.addRule(function(action, subject) {
     polkit.addRule(function(action, subject) {
       if (subject.isInGroup("wheel"))
       polkit.log("");
        return polkit.Result.YES;
      polkit.log("action=" + action);
      polkit.log("subject=" + subject);
     });
     });
   '';
   '';
};
</nowiki>}}
</nowiki>}}
(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.)


== Authentication agents ==
== Authentication agents ==
Line 61: Line 78:
Alternatively, you can start it on login by creating a systemd user service:
Alternatively, you can start it on login by creating a systemd user service:


=== Using NixOS ===
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
systemd = {
systemd.user.services.polkit-gnome-authentication-agent-1 = {
  user.services.polkit-gnome-authentication-agent-1 = {
  description = "polkit-gnome-authentication-agent-1";
    description = "polkit-gnome-authentication-agent-1";
  wantedBy = [ "graphical-session.target" ];
    wantedBy = [ "graphical-session.target" ];
  wants = [ "graphical-session.target" ];
    wants = [ "graphical-session.target" ];
  after = [ "graphical-session.target" ];
    after = [ "graphical-session.target" ];
  serviceConfig = {
    serviceConfig = {
    Type = "simple";
        Type = "simple";
    ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
    Restart = "on-failure";
        Restart = "on-failure";
    RestartSec = 1;
        RestartSec = 1;
    TimeoutStopSec = 10;
        TimeoutStopSec = 10;
      };
   };
   };
};
};
</syntaxhighlight>
</syntaxhighlight>


Another option is <code>lxqt.lxqt-policykit</code>, which can be launched on login through the command <code>lxqt-policykit-agent</code> on e.g. Hyprland.
=== Using Home Manager ===
<syntaxhighlight lang="nix">
systemd.user.services.polkit-gnome-authentication-agent-1 = {
  Unit = {
    Description = "polkit-gnome-authentication-agent-1";
    Wants = [ "graphical-session.target" ];
    After = [ "graphical-session.target" ];
  };
  Install = {
    WantedBy = [ "graphical-session.target" ];
  };
  Service = {
    Type = "simple";
    ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
    Restart = "on-failure";
    RestartSec = 1;
    TimeoutStopSec = 10;
  };
};
</syntaxhighlight>Another option is <code>lxqt.lxqt-policykit</code>, which can be launched on login through the command <code>lxqt-policykit-agent</code> on e.g. Hyprland.


== Start the authentication agent in dwm ==
== Start the authentication agent in dwm ==
Line 94: Line 129:
</syntaxhighlight>
</syntaxhighlight>


Use this method, you won't need to change the codes even <code>mate.mate-polkit</code> gets an update.
Use this method, you won't need to change the codes even if <code>mate.mate-polkit</code> gets an update.


<syntaxhighlight lang=bash>
<syntaxhighlight lang=bash>
#!/bin/sh
#!/bin/sh
...
...
/nix/store/$(ls -la /nix/store | grep polkit-kde-agent | grep '^d' | awk '{print $9}')/libexec/polkit-kde-authentication-agent-1 &  
/nix/store/$(ls -la /nix/store | grep 'polkit-kde-agent' | grep '^d' | awk '{print $9}')/libexec/polkit-kde-authentication-agent-1 &  
...
...
</syntaxhighlight>
</syntaxhighlight>


The same but for <code>polkit-kde-agent</code>
The same but for <code>polkit-kde-agent</code>.
Retrieved from "https://wiki.nixos.org/wiki/Polkit"