Polkit

Polkit is an authorization manager which is used for allowing unprivileged processes to speak to privileged processes through some form of inter-process communication mechanism like D-Bus.

Prerequisites

Install and configure D-Bus to use polkit.

Polkit and elogind

polkit is used for authentication by elogind. Without polkit some things may not function. Install the polkit-elogind package and enable the polkit service using OpenRC.

# apk add polkit-elogind # rc-update add polkit # rc-service polkit start

Polkit and seatd

polkit can be used for authentication with seatd, if you use groups in the polkit rules. With seatd you are restricted to YES or NO rules.

Install the polkit package and enable the polkit service using OpenRC:

# apk add polkit # rc-update add polkit # rc-service polkit start

A sample polkit rule file /etc/polkit-1/rules.d/50-my-custom-rules.rules which allow members of the "wheel" group to reboot without a password. This rule depends only on group membership which works with seatd can be as follows:

Contents of /etc/polkit-1/rules.d/50-my-custom-rules.rules

    
    polkit.addRule(function(action, subject) {
        if (action.id == "org.freedesktop.login1.reboot" &&
            subject.isInGroup("wheel")) {
            return polkit.Result.YES;
        }
    });

Elogind is required for "subject.active" rules and no AUTH_ADMIN, since polkit agents need POLKIT_IS_SUBJECT. Given below is a sample polkit rule file /etc/polkit-1/rules.d/51-require-active-session.rules which allow only active local sessions to suspend based on subject.active which requires Elogind can be as follows:

Contents of /etc/polkit-1/rules.d/51-require-active-session.rules

 
    polkit.addRule(function(action, subject) {
        if (action.id == "org.freedesktop.login1.suspend" &&
            subject.active) {
            return polkit.Result.YES;
        } else if (action.id == "org.freedesktop.login1.suspend") {
            return polkit.Result.NO; // Or polkit.Result.AUTH_ADMIN to prompt for password
        }
    });

Prerequisites

Polkit and elogind

Polkit and seatd

See also