Polkit

This article describes the setup of polkit (formerly PolicyKit), an authorization API intended to be used by privileged programs (e.g. system daemons) offering service to unprivileged programs.

Description
Privileged programs (in the following called daemons) with polkit support offload the decision, if a program is allowed to use some function of the daemon. The daemon keeps an incoming request on hold, ask polkit, if the program is authorized, and then allows or denies the request based on polkit's return. The requesting program is not aware of polkit and so need no polkit support itself. The communication is handled over D-Bus.

Daemons come with polkit action files, which offer some function and define, who is authorized. This can be any user, the active or inactive user. Also they can define, that the user needs to authenticate by entering a password as himself or as admin. The actions does not grant root permission to an entire process, but rather allows a finer level of control of centralized system policy.

The authorization defaults in the action files can be refined by rules files. Here you can define, who's admin (root or any user in a special group), and add special handling for an action.

Installation
Portage knows the global USE flag policykit for enabling support for polkit in other packages. Enabling this USE flag will pull in automatically (default for desktop profiles):

The USE flags of policykit are:

After setting this you want to update your system so the changes take effect:

Configuration
The actions file are in, the rules files are in and.

Rules
Rules redefine, who's authorized for an action. The rules files begin with a number and are processed in lexical order. Own files should have a high number, like 99. The filenames have the suffix.

To e.g. let also the users of the "wheel" group be functions as administrators, create the following file:

To e.g. allow user "larry" to mount internal disks, create the following file:

See the polkit man page for more information.

KDE
If you installed KDE with the policykit USE flag, there are systemsettings modules in the "System Administration" section:
 * Actions Policy: Rules configuration.
 * Global Policy Configuration: Administrator configuration.

Usage
For more informations see the man pages, e.g. for pkaction: man pkaction
 * pkaction - Shows all available actions.
 * pkaction --verbose --action-id ACTION - Shows details about the given action.
 * pkcheck --list-temp - Lists all temporary authorizations for the current session
 * pkexec --user USER PROGRAM - Runs the given program with the user rights of the given user.

Troubleshooting

 * Polkit communicates over D-Bus, so also see the D-Bus "Troubleshooting" section.
 * Polkit communicates over D-Bus, so also see the D-Bus "Troubleshooting" section.