Polkit: Difference between revisions
Update syntax for example systemd unit |
m fix indentation |
||
| (2 intermediate revisions by 2 users not shown) | |||
| Line 22: | Line 22: | ||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | {{file|/etc/nixos/configuration.nix|nix|<nowiki> | ||
security.polkit.extraConfig = '' | |||
polkit.addRule(function (action, subject) { | |||
if ( | |||
subject.isInGroup("users") && | |||
[ | |||
"org.freedesktop.login1.reboot", | |||
"org.freedesktop.login1.reboot-multiple-sessions", | |||
"org.freedesktop.login1.power-off", | |||
"org.freedesktop.login1.power-off-multiple-sessions", | |||
].indexOf(action.id) !== -1 | |||
) { | |||
return polkit.Result.YES; | |||
} | |||
}); | |||
''; | |||
</nowiki>}} | </nowiki>}} | ||
| Line 43: | Line 43: | ||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | {{file|/etc/nixos/configuration.nix|nix|<nowiki> | ||
security.polkit.extraConfig = '' | security.polkit.extraConfig = '' | ||
polkit.addRule(function(action, subject) { | |||
if (subject.isInGroup("wheel")) | |||
return polkit.Result.YES; | |||
}); | |||
''; | |||
</nowiki>}} | |||
(This does ''not'' take into account the <code>security.polkit.adminIdentities</code> setting.) | |||
=== Debugging requested rules === | |||
To have Polkit print debug information for every incoming authorization, it is possible to create a debugging rule and enable Polkit debug printing: | |||
{{file|/etc/nixos/configuration.nix|nix|<nowiki> | |||
security.polkit = { | |||
debug = true; // Enables `polkit.log` function | |||
extraConfig = '' | |||
polkit.addRule(function(action, subject) { | polkit.addRule(function(action, subject) { | ||
polkit.log(""); | |||
polkit.log("action=" + action); | |||
polkit.log("subject=" + subject); | |||
}); | }); | ||
''; | ''; | ||
}; | |||
</nowiki>}} | </nowiki>}} | ||
== Authentication agents == | == Authentication agents == | ||
| Line 61: | Line 78: | ||
Alternatively, you can start it on login by creating a systemd user service: | Alternatively, you can start it on login by creating a systemd user service: | ||
=== Using NixOS === | |||
<syntaxhighlight lang="nix"> | |||
systemd.user.services.polkit-gnome-authentication-agent-1 = { | |||
description = "polkit-gnome-authentication-agent-1"; | |||
wantedBy = [ "graphical-session.target" ]; | |||
wants = [ "graphical-session.target" ]; | |||
after = [ "graphical-session.target" ]; | |||
serviceConfig = { | |||
Type = "simple"; | |||
ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"; | |||
Restart = "on-failure"; | |||
RestartSec = 1; | |||
TimeoutStopSec = 10; | |||
}; | |||
}; | |||
</syntaxhighlight> | |||
=== Using Home Manager === | |||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
systemd.user.services.polkit-gnome-authentication-agent-1 = { | systemd.user.services.polkit-gnome-authentication-agent-1 = { | ||
| Line 79: | Line 114: | ||
}; | }; | ||
}; | }; | ||
</syntaxhighlight> | </syntaxhighlight>Another option is <code>lxqt.lxqt-policykit</code>, which can be launched on login through the command <code>lxqt-policykit-agent</code> on e.g. Hyprland. | ||
Another option is <code>lxqt.lxqt-policykit</code>, which can be launched on login through the command <code>lxqt-policykit-agent</code> on e.g. Hyprland. | |||
== Start the authentication agent in dwm == | == Start the authentication agent in dwm == | ||