If this annotation is not specified then only root can query whether a client running as a different user is authorized for an action. The value of this annotation is a string containing a space separated list of PolkitIdentity entries, for example "unix-user:42 unix-user:colord".

Functions are called in the order they have been added until one of the functions returns a value. Hence, to add an authorization rule that is processed before other rules, put it in a file in /etc/polkit-1/rules.d with a name that sorts before other rules files, for example 00-early-checks.rules.

March 7, 2024 - User-provided rules, instead, live under /etc/polkit-1/rules.d. Rules are written using Javascript, in files with the “.rules” extension. Here is an example of a rule installed by the GNOME desktop environment as /usr/share/polkit-1/rules.d/gnome-control-center.rules:

It creates a rule that allows mounting a file system on a system device for the storage group. The rule is stored in the /etc/polkit-1/rules.d/10-enable-mount.rules file: Example 4.1.

Put your rules in /etc/polkit-1/rules.d/*.rules.

To allow users of group somegroup to manage systemd services, create /etc/polkit-1/localauthority/50-local.d/manage-units.pkla with the following content:

If this annotation is not specified then only root can query whether a client running as a different user is authorized for an action. The value of this annotation is a string containing a space separated list of PolkitIdentity entries, for example "unix-user:42 unix-user:colord".

If this annotation is not specified then only root can query whether a client running as a different user is authorized for an action. The value of this annotation is a string containing a space separated list of PolkitIdentity entries, for example "unix-user:42 unix-user:colord".

The actions files are in ... and /etc/polkit-1/rules.d. Rules redefine who's authorized for an action. The rules files begin with a number and are processed in lexical order. The first file with a matching rule is used. Own files should have a low number, like 10. The filenames have the .rules suffix. For example, to let the ...

A mechanism need to declare a set of "ACTIONS" in order to use PolicyKit. Actions correspond to operations that clients can request the mechanism to carry out and are defined in XML files that the mechanism installs into the /usr/share/polkit-1/actions directory.

polkit (formerly PolicyKit) is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes. - polkit-org/polkit

<action id="org.freedesktop.policykit.example.pkexec.run-frobnicate"> <_description>Run the polkit example program Frobnicate</_description> <_message>Authentication is required to run the polkit example program Frobnicate (user=$(user), user.gecos=$(user.gecos), user.display=$(user.display), program=$(program), command_line=$(command_line))</_message> <icon_name>audio-x-generic</icon_name> <!-- just an example --> <defaults> <allow_any>no</allow_any> <allow_inactive>no</allow_inactive> <allow_active>auth_admin_keep</allow_active> </defaults> <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/pk-example-frobnicate</annotate> </action> ·

As an example of code using the GObject API, see Example 1, “Querying the Authority”. For an example using the D-Bus API, see Example 2, “Accessing the Authority via D-Bus”.

August 17, 2022 - For example, when the unprivileged user tries to mount a USB drive, the Polkit policy file indicates what action should be taken and what command should be executed as part of the action.

This is a simple example of how to use plicykit and dbus in order to provide a priviliged/unpriviliged communication bridge between two processes.

PolkitAgentTextListener — Text-based Authentication Agent

If this annotation is not specified, then only root can query whether a client running as a different user is authorized for an action. The value of this annotation is a string containing a space-separated list of PolkitIdentity entries, for example "unix-user:42 unix-user:colord".

DO pass a customized authentication ... declared in the .policy file's message element. For example, it's better to show “Authentication is needed to format INTEL SSDSA2MH080G1GC (/dev/sda)” than just “Authentication is needed to format the device”....