- PolicyKit is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes: It is a framework for centralizing the decision making process with respect to granting access to privileged operations for unprivileged applications. PolicyKit is specifically targeting applications in rich desktop environments on multi-user UNIX-like operating systems. It does not imply or rely on any exotic kernel features.
PolicyKit is used for controlling system-wide privileges. It provides an organized way for non-privileged processes to communicate with privileged ones. In contrast to systems such as sudo, it does not grant root permission to an entire process, but rather allows a finer level of control of centralized system policy.
PolicyKit works by delimiting distinct actions, e.g. running GParted, and delimiting users by group or by name, e.g. members of the wheel group. It then defines how -- if at all -- those users are allowed those actions, e.g. by identifying as members of the group by typing in their passwords.
PolicyKit vs. polkit
In the development of PolicyKit, major changes were introduced around version 0.92. In order to make the distinction clear between the way the old and the new versions worked, the new ones are referred to as 'polkit' rather than PolicyKit. Searching for PolicyKit on the web will mostly point to outdated documentation and lead to confusion and frustration, e.g. . The main distinction between PolicyKit and polkit is the abandonment of single-file configuration in favour of directory-based configuration, i.e. there is no PolicyKit.conf.
PolicyKit definitions can be divided into three kinds:
- Actions are defined in XML .policy files located in
/usr/share/polkit-1/actions. Each action has a set of default permissions attached to it (e.g. you need to identify as an administrator to use the GParted action). The defaults can be overruled but editing the actions files is NOT the correct way (see askubuntu.com for a bad example)
- Authorities are defined in INI-like .pkla files. They are found in two places: 3rd party packages can use
/var/lib/polkit-1(though few if any do) and
/etc/polkit-1is for local configuration. The .pkla files designate a subset of users, refer to one (or more) of the actions specified in the actions files and determine with what restrictions these actions can be taken by that/those user(s). As an example, an authority file could overrule the default requirement for all users to authenticate as an admin when using GParted, determining that some specific user doesn't need to. Or isn't allowed to use GParted at all.
- Admin identities are set in
/etc/polkit-1/localauthority.conf.dOne of the basic points of using PolicyKit is determining whether or not a user needs to authenticate (possibly as an administrative user) or not in order to get permission to carry out the action. PolicyKit therefore has a specific configuration for deciding if the user trying to carry out an action is or is not an administrative user. Common definitions are 'only root user' or 'all members of wheel' (the Arch default).
Each action is defined in an <action> tag in a .policy file. The
org.archlinux.pkexec.gparted.policy contains a single action and looks like this:
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd"> <policyconfig> <action id="org.archlinux.pkexec.gparted"> <message>Authentication is required to run the GParted Partition Editor</message> <icon_name>gparted</icon_name> <defaults> <allow_any>auth_admin</allow_any> <allow_inactive>auth_admin</allow_inactive> <allow_active>auth_admin</allow_active> </defaults> <annotate key="org.freedesktop.policykit.exec.path">/usr/sbin/gparted</annotate> <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate> </action> </policyconfig>
The attribute id is the actual command sent to dbus, the message tag is the explanation to the user when authentification is required and the icon_name is sort of obvious.
The default tag is where the permissions or lack thereof are located. It contains three settings: allow_any, allow_inactive, and allow_active. Inactive sessions are generally remote sessions (SSH, VNC, etc.) whereas active sessions are logged directly into the machine on a TTY or an X display. Allow_any is the setting encompassing both scenarios.
For each of these settings the following options are available:
- no: The user is not authorized to carry out the action. There is therefore no need for authentification.
- yes: The user is authorized to carry out the action without any authentification.
- auth_self: Authentication is required but the user need not be an administrative user.
- auth_admin: Authentication as an administrative user is require.
- auth_self_keep: The same as auth_self but, like sudo, the authorization lasts a few minutes.
- auth_admin_keep: The same as auth_admin but, like sudo, the authorization lasts a few minutes.
These are default setting and unless overruled in later configuration will be valid for all users.
As can be seen from the GParted action, users are required to authenticate as administrators in order to use GParted, regardless of whether the session is active or inactive.
Please note: to correct issues with automount and shutdown, please check the ConsoleKit page.
How to let all users in the group
wheel have the same privileges as root (so you do not have to enter the root password, but the wheel user's password):
Installing AUR will create this file automatically.AUR from the
Create the following file:
To let users alice and bob perform all PackageKit actions (but not necessarily other PolicyKit actions), create the following file:
[Let Wheel Use PackageKit] Identity=unix-user:alice;unix-user:bob Action=org.freedesktop.packagekit.* ResultAny=no ResultInactive=no ResultActive=auth_self_keep