Difference between revisions of "Manjaro Polkit Rules"

Revision as of 13:26, 13 April 2020

What is polkit?

polkit is an authorization manager and helps the system to manage who is allowed to do a certain task.

What is polkit rules?

Rules are definitions of the relationship between an application, the user and the system.

99-manjaro.rules

Manjaro adds some useful rules for actions which would otherwise require the user to authenticate for a given action. The rules added by Manjaro are rules covering where the convenience of the user versus the system security becomes blurred.

Consider the following rules - all part of a ruleset installed on a default Manjaro system.

This first rule enables a user which is member of the administrative group wheel to handle disks and partitions without requiring the user to authenticate. This rule covers the usage of removable USB devices. Because of an overlap with the internal devices this rule also makes it possible for this administrative user to modify the system's internal devices.

polkit.addRule(function(action, subject) {
    if (action.id.indexOf("org.freedesktop.udisks2.") == 0 && subject.isInGroup("wheel")) {
        return polkit.Result.YES;
    }
});

The second rule allows any user to control if the system should be shut down or restarted

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.power-off" ||
        action.id == "org.freedesktop.login1.reboot" ||
        action.id == "org.freedesktop.login1.hibernate" ||
        action.id == "org.freedesktop.login1.suspend") {
        return polkit.Result.YES;
    }
});

The third rule allows the upower daemon to hibernate or suspend the system

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.upower.hibernate" ||
        action.id == "org.freedesktop.upower.suspend") {
        return polkit.Result.YES;
    }
});

The fourth rule allows a member of the network group to use the bluetooth devices without authentication

/* Allow users of network group to use blueman feature requiring root without authentication */
polkit.addRule(function(action, subject) {
    if ((action.id == "org.blueman.network.setup" ||
         action.id == "org.blueman.dhcp.client" ||
         action.id == "org.blueman.rfkill.setstate" ||
         action.id == "org.blueman.pppd.pppconnect") &&
        subject.isInGroup("network")) {
        return polkit.Result.YES;
    }
});

Conclusion

Manjaro has added these rules to make the system easier - you could say less confusing - to the average user.

The rules is included in a file 99-manjaro.rules which is installed/maintained using the package manjaro-hotfixes

@@ Line 41: / Line 41: @@
   });
-The fourth rule allows a member of the network group to use the bluetooth devices without authentication
+The fourth rule allows a member of the '''network''' group to use the bluetooth devices without authentication
   /* Allow users of network group to use blueman feature requiring root without authentication */