Alpine Linux - User contributions [en]

Polkit

2026-03-27T20:53:07Z

PlumpPot: Remove trailing whitespace

[https://polkit.pages.freedesktop.org/polkit/polkit.8.html Polkit] is an authorization manager which is used for allowing unprivileged processes to speak to privileged processes through some form of inter-process communication mechanism like [[D-Bus]].

== Prerequisites ==

* Install and configure [[D-Bus#Installation|D-Bus]].

== Installation ==

For graphical applications, polkit relies on [[Elogind|elogind]] or [[Seatd]] to determine the identity of the user making a request. To use the full features of polkit, [[#Using polkit with elogind|using polkit with elogind]] is recommended.

=== Using polkit with elogind ===

For a feature-rich [[Desktop environments and Window managers|desktop]] experience, use polkit with [[Elogind|elogind]]. Features like [[#Authentication agents|authentication agents]] can be used only with elogind. Install the {{Pkg|polkit-elogind}} package and enable the {{ic|polkit}} service using [[OpenRC]].

{{Cmd|<nowiki># apk add polkit-elogind
# rc-update add polkit
# rc-service polkit start </nowiki>}}

Proceed to configure [[Elogind|elogind]], if not done already.

=== Using polkit with seatd ===

For a minimal desktop like [[Sway]], polkit can be used with [[Seatd#Polkit|seatd with certain limitations]]. With Seatd, polkit rules can only evaluate group membership, resulting in a 'yes' or 'no' decision. Graphical, session aware [[#Authentication agents|authentication agents]] are not supported.

To proceed to use polkit with seatd, install the {{Pkg|polkit}} package and enable the {{ic|polkit}} service using [[OpenRC]]: {{Cmd|<nowiki># apk add polkit
# rc-update add polkit
# rc-service polkit start </nowiki>}}

== Authentication agents ==

Polkit authentication agent integration helps coordinate the display of a password prompt to the active and local users.
When an unprivileged user attempts to access a privileged location (such as by typing admin:// in the address bar of a [[File_management#File_managers|File Manager]]), when the appropriate polkit policy requires administrative authentication, a password dialogue will typically appear.

{{Warning|Authentication agents will work only when [[PAM]] is properly set up and [[#Using polkit with elogind|polkit is used with elogind]].}}

Some of the authentication agents available in Alpine linux is listed below:

* {{Pkg|xfce-polkit}}
* {{Pkg|mate-polkit}}
* {{Pkg|polkit-gnome}}
* {{Pkg|polkit-kde-agent-1}}

For [[Xfce]], install {{Pkg|xfce-polkit}} as follows:

{{Cmd|# apk add xfce-polkit}}

== Polkit rule files ==

The following example rule files have been provided to show the limitations of [[#Using polkit with seatd|seatd]].

Ensure that correct permissions are set for the rule files. For example, for the rule file {{Path|/etc/polkit-1/rules.d/50-udisks.rules}}:{{Cmd|<nowiki># chown root:root /etc/polkit-1/rules.d/50-udisks.rules
# chmod 644 /etc/polkit-1/rules.d/50-udisks.rules</nowiki>}}

=== Example1 ===

A sample polkit rule file {{Path|/etc/polkit-1/rules.d/50-udisks.rules}} which allow [[File_management#Automounting_removable_storage|automatic mounting of removable storage]] based on being a member of '''disk''' or '''storage''' group. This rule depends only on group membership which works with seatd: {{cat|/etc/polkit-1/rules.d/50-udisks.rules|<nowiki>
polkit.addRule(function(action, subject) {
if ((subject.isInGroup("disk") || subject.isInGroup("storage")) &&
(action.id == "org.freedesktop.udisks2.filesystem-mount" ||
action.id == "org.freedesktop.udisks2.filesystem-mount-system" ||
action.id == "org.freedesktop.udisks2.filesystem-unmount-others" ||
action.id == "org.freedesktop.udisks2.eject-media" ||
action.id == "org.freedesktop.udisks2.encrypted-unlock" ||
action.id == "org.freedesktop.udisks2.power-off-drive")) {
return polkit.Result.YES;
}
});
</nowiki>}}

The above polkit rule file is fully supported when used with both [[#Using polkit with seatd|seatd]] and [[#Using polkit with elogind|Elogind]].

=== Example2 ===

[[elogind|Elogind]] is required for "subject.active" rules and no AUTH_ADMIN, since polkit agents need POLKIT_IS_SUBJECT. Given below is a sample polkit rule file {{Path|/etc/polkit-1/rules.d/51-require-active-session.rules}} which allow only active local sessions to suspend:{{Cat|/etc/polkit-1/rules.d/51-require-active-session.rules|<nowiki>
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.login1.suspend" &&
subject.active) {
return polkit.Result.YES;
} else if (action.id == "org.freedesktop.login1.suspend") {
return polkit.Result.NO; // Or polkit.Result.AUTH_ADMIN to prompt for password
}
});
</nowiki>}}

The above rule file depends on ''subject.active'' which is supported only when [[#Using polkit with elogind|polkit is used with Elogind]].

== See also ==
* [https://polkit.pages.freedesktop.org/polkit/polkit.8.html polkit Architecture]
* [https://github.com/polkit-org/polkit polkit github page]
* [https://wiki.archlinux.org/title/Polkit Arch wiki Polkit page]
* [https://wiki.archlinux.org/title/Running_GUI_applications_as_root Arch wiki Running GUI applications as root]

[[Category:Authentication]]

Using an answerfile with setup-alpine

2026-03-27T20:46:49Z

PlumpPot: Fix typo

To perform an Alpine Linux [[Installation|installation]] that approaches being fully non-interactive, an answerfile can be created and used to preprogram various answers to the questions prompted by the [[Alpine_configuration_management_scripts#setup-alpine|setup-alpine]] script. [[Alpine_configuration_management_scripts#Environment_Variables|Environment variables]] can be added to configure the behavior of any given utility called by the script.

A fully non-interactive {{ic|setup-alpine}} installation would entail replacing the prompt for a root password with an empty password, and suppressing the verification prompt to erase the target disk. This could only be achieved if {{ic|setup-alpine}} were run by combining both facilities above – i.e. an answerfile and a certain environment variable considered below – plus an additional {{ic|setup-alpine}} switch for an empty password. These prompts serve as safety and security guards, and their suppression would '''not be recommended''' in general use.

== Creating an initial answerfile ==

To get an quick start with setup-alpine answerfiles, a starter answerfile can be generated with:
{{Cmd|setup-alpine -c <var>PATH_TO_FILENAME</var>}}
At the time of writing this, the previous command will result in output in the specified <var>PATH_TO_FILENAME</var>:
{{Cat|PATH_TO_FILENAME|<nowiki>
# Example answer file for setup-alpine script
# If you don't want to use a certain option, then comment it out

# Use US layout with US variant
# KEYMAPOPTS="us us"
KEYMAPOPTS=none

# Set hostname to 'alpine'
HOSTNAMEOPTS=alpine

# Set device manager to mdev
DEVDOPTS=mdev

# Contents of /etc/network/interfaces
INTERFACESOPTS="auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
hostname alpine-test
"

# Search domain of example.com, Google public nameserver
# DNSOPTS="-d example.com 8.8.8.8"

# Set timezone to UTC
#TIMEZONEOPTS="UTC"
TIMEZONEOPTS=none

# set http/ftp proxy
#PROXYOPTS="http://webproxy:8080"
PROXYOPTS=none

# Add first mirror (CDN) - Option -1
# Enable the community repo - Option -c
APKREPOSOPTS="-1 -c"

# Create admin user
USEROPTS="-a -u -g audio,input,video,netdev juser"
#USERSSHKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIiHcbg/7ytfLFHUNLRgEAubFz/13SwXBOM/05GNZe4 juser@example.com"
#USERSSHKEY="https://example.com/juser.keys"

# Install Openssh
SSHDOPTS=openssh
#ROOTSSHKEY="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOIiHcbg/7ytfLFHUNLRgEAubFz/13SwXBOM/05GNZe4 juser@example.com"
#ROOTSSHKEY="https://example.com/juser.keys"

# Use openntpd
# NTPOPTS="openntpd"
NTPOPTS=none

# Use /dev/sda as a sys disk
# DISKOPTS="-m sys /dev/sda"
DISKOPTS=none

# Setup storage with label APKOVL for config storage
#LBUOPTS="LABEL=APKOVL"
LBUOPTS=none

#APKCACHEOPTS="/media/LABEL=APKOVL/cache"
APKCACHEOPTS=none

</nowiki>}}

When using answerfile, be sure to edit the file's contents to your needs. Comment out variables you wish not to be set.
Be sure that the uncommented variables have valid values set to your preference. Once you are satisfied with the answerfile contents, this how is to use it:
{{Cmd|setup-alpine -f <var>PATH_TO_FILENAME</var>}}

== Answerfile Variables ==

The variables in the answerfile alter the arguments passed to the setup-* scripts that are called out to from setup-alpine. These are:
* [[Alpine_setup_scripts#setup-keymap|<code>setup-keymap</code>]]
:: KEYMAPOPTS="LAYOUT VARIANT"

* [[Alpine_setup_scripts#setup-hostname|<code>setup-hostname</code>]]
:: HOSTNAMEOPTS="HOSTNAME"

* [[Alpine_setup_scripts#setup-devd|<code>setup-devd</code>]]
:: DEVDOPTS="DEVD"
::: The choices are mdev (from busybox), mdevd (standalone), and udev (from eudev).

* [[Alpine_setup_scripts#setup-interfaces|<code>setup-interfaces</code>]]
:: INTERFACEOPTS="''file contents to put in /etc/network/interfaces''"
::: This will be used as input to the setup-interfaces command.

* [[Alpine_setup_scripts#setup-dns|<code>setup-dns</code>]]
:: DNSOPTS="-d DOMAIN ''IP_ADDR''
::: Use -d to specify search domain. Use IP_ADDR to specify DNS servers to use (mutliple allowed).

* [[Alpine_setup_scripts#setup-timezone|<code>setup-timezone</code>]]
:: TIMEZONEOPTS="ZONE"
::: Specify the timezone, based on files relative to /usr/share/zoneinfo.

* [[Alpine_setup_scripts#setup-proxy|<code>setup-proxy</code>]]
:: PROXYOPTS="PROXY_URL"
::: Specify the URL for proxy to use; eg http://webproxy:8080.

* [[Alpine_setup_scripts#setup-ntp|<code>setup-ntp</code>]]
:: NTPOPTS="NTP_DAEMON"
::: The choices are busybox, openntpd, chrony, and none.

* [[Alpine_setup_scripts#setup-apkrepos|<code>setup-apkrepos</code>]]
:: APKREPOSPTS="''setup-apkrepos options''"
::: Specify command line options for setup-apkrepos:
::: {{Cat|setup-apkrepos -h|<nowiki>
usage: setup-apkrepos [-ch] [-f|-r|-1|REPO...]
setup-apkrepos -o

Setup apk repositories

options:
-c Enable the community repo
-f Detect and add fastest mirror
-h Show this help
-o Only enable a community repo for every defined repo
-r Add a random mirror and do not prompt
-1 Add first mirror on the list (normally a CDN)

Option -o cannot be used with options -c, -f, -r or -1</nowiki>}}

* [[Alpine_setup_scripts#setup-user|<code>setup-user</code>]]
:: USEROPTS="''setup-user options''"
::: Specify setup-user options:
::: {{Cat|setup-user -h|<nowiki>
usage: setup-user [-h] [-a] [-u] [-f FULLNAME] [-g GROUPS] [-k SSHKEY] [USERNAME]

Create user account

options:
-a Create admin user. Add to wheel group and set up doas
-h Show this help
-f Set full name for user
-g Comma or space separated list of groups to add user to
-k ssh key or URL to ssh key (eg. https://gitlab.alpinelinux.org/user.keys)
or 'none' for no key
-u Unlock the user automatically (eg. creating the user non-interactively
with an ssh key for login)

If USERNAME is not specified user will be prompted.</nowiki>}}
:: USERSSHKEY="PUBKEY or URL"
::: Specify the contents or url to ssh public key to use as user's login key.

* [[Alpine_setup_scripts#setup-sshd|<code>setup-sshd</code>]]
:: SSHDOPTS="SSHD
::: The choice of ssh daemon; one of openssh, dropbear, or none.
:: ROOTSSHKEY="PUBKEY or URL"
::: Specify the contents or url to ssh public key to use as root user's login key.

* [[Alpine_setup_scripts#setup-xen-dom0|<code>setup-xen-dom0</code>]]
:: XENDOM0OPTS="PACKAGES
::: Specify additional packages to install along with the xen package.

* [[Alpine_setup_scripts#setup-disk|<code>setup-disk</code>]]
:: DISKOPTS="''setup-disk options''"
::: Specify setup-disk options:
::: {{Cat|setup-disk -h|<nowiki>
usage: setup-disk [-hLqrve] [-k kernelflavor] [-m MODE] [-o apkovl] [-s SWAPSIZE]
[-w FILE] [MOUNTPOINT | DISKDEV...]

Install alpine on harddisk.

If MOUNTPOINT is specified, then do a traditional disk install with MOUNTPOINT
as root.

If DISKDEV is specified, then use the specified disk(s) without asking. If
multiple disks are specified then set them up in a RAID array. If there are
more than 2 disks, then use raid level 5 instead of raid level 1.

options:
-h Show this help
-e Encrypt disk
-m Use disk for MODE without asking, where MODE is either 'data' or 'sys'
-o Restore system from given apkovl file
-k Use kernelflavor instead of lts
-L Use LVM to manage partitions
-q Exit quietly if no disks are found
-r Enable software raid1 with single disk
-s Use SWAPSIZE MB instead of autodetecting swap size (Use 0 to disable swap)
-v Be more verbose about what is happening
-w Write selected install mode to FILE

If BOOTLOADER is specified, the specified bootloader will be used.
If no bootloader is specified, the default bootloader is syslinux(extlinux)
except when EFI is detected or explicitly set by USE_EFI which will select grub.
Supported bootloaders are: grub, syslinux, zipl, raspberrypi-bootloader, u-boot, none

If KERNELOPTS is specified, it will be appended to the kernel boot parameters.
Default is: quiet

If DISKLABEL is specified, the specified partition label will be used.
if no partition label is specified, the default label will be dos
except when EFI is detected or explicitly set by USE_EFI which will select gpt.
Supported partition labels are: dos, gpt

If BOOTFS, ROOTFS, VARFS are specified, then format a partition with specified
filesystem. If not specified, the default filesystem is ext4.
Supported filesystems for
boot: ext2, ext3, ext4, btrfs, xfs, vfat(EFI)
root: ext2, ext3, ext4, btrfs, xfs
var: ext2, ext3, ext4, btrfs, xf</nowiki>}}
:: In addition to the environment variables described above, also relavent are:
:: BOOT_SIZE="SIZE_IN_MIB"
:: SWAP_SIZE="SIZE_IN_MIB"
:: ROOT_SIZE="SIZE_IN_MIB"
::: If lvm is used, SWAP_SIZE and ROOT_SIZE may specified as percentage of volume group, for example:
::: ROOT_SIZE="50%VG"
::
* [[Alpine_setup_scripts#setup-lbu|<code>setup-lbu</code>]]
:: LBUOPTS="MEDIA"
::: Specify option mountpoint under /media.

* [[Alpine_setup_scripts#setup-apkcache|<code>setup-apkcache</code>]]
:: APKCACHEOPTS="DIR"
::: Specify directory to setup for apk caching.

== Environment variables and setup-alpine ==

Another way to achieve the same
thing is to set these variables in the environment, either exported or on the commandline.

'''Fully non-interactive''' {{ic|setup-disk}}: The {{ic|setup-disk}} section still prompts to confirm whether to erase your target stated in the answerfile. To avoid this, [[Alpine_configuration_management_scripts#Environment_Variables|'''use the following with caution''']], as it is bound to '''''immediately erase the target media''''':
{{Cmd|<nowiki>ERASE_DISKS=</nowiki><var>/path/to/targetmedia</var> setup-alpine -f <var>/path/to/answerfile</var>}}

It is not necessary to use an answerfile to get the same functionality.
{{Cmd|DISKOPTS{{=}}<q>-e -L -m sys /dev/sda</q> ROOT_SIZE{{=}}<q>50&percnt;VG</q> setup-alpine}}
The above command specifies to do a system disk install with lvm on encrypted partition, and that the root
logical volume should be 50% of the volume group.

This method is probably not realistic for setting many variables, but for using just a few may be justified.

== See also ==

* [[Alpine configuration management scripts#Environment Variables|Environment Variables]]
* [[Installation]]

[[Category:Installation]]