Modifying Configuration Files for Implicit Privileges

openSUSE ships with two sets of default authorizations located in /etc/polkit-default-privs.standard and /etc/polkit-default-privs.restrictive. The .standard file defines privileges suitable for most desktop systems. The .restrictive set of privileges is designed for machines administrated centrally.Activate it by setting POLKIT_DEFAULT_PRIVS to restrictive in /etc/sysconfig/security and run set_polkit_default_privs as root afterwards. Do not modify these two files.

In order to define your custom set of privileges, use /etc/polkit-default-privs.local. Privileges defined here will always take precedence over the ones defined in the other configuration files. To define a privilege, add a line for each policy with the following format:

<privilege
      name>     <any
      session>:<inactive
      session>:<active
      session>

For a list of all privilege names available, run the command polkit-action. The following values are valid for the session parameters:

yes

grant privilege

no

block

auth_self

user needs to authenticate with own password every time the privilege is requested

auth_self_keep_session

user needs to authenticate with own password once per session, privilege is granted for the whole session

auth_self_keep_always

user needs to authenticate with own password once, privilege is granted for the current and for future sessions

auth_admin

user needs to authenticate with root password every time the privilege is requested

auth_admin_keep_session

user needs to authenticate with root password once per session, privilege is granted for the whole session

auth_admin_keep_always

user needs to authenticate with root password once, privilege is granted for the current and for future sessions

Run set_polkit_default_privs to activate your settings.

Modifying Configuration Files for Explicit Privileges

Explicit privileges can be set in /etc/PolicyKit/PolicyKit.conf. This configuration file is written in XML using the PolicyKit DTD. The file that is shipped with openSUSE already contains the necessary headers and the root element <config>. Place your edits inside the <config> tags.

match

Specify an action or a user. match knows two attributes, user and action, but only a single attribute is allowed. Use nested match statements to combine attributes. POSIX Extended Regular Expressions are allowed as attribute values.

user=USER

Specify one or more login names. Separate multiple names by the | symbol.

action=policy

Specify a policy by it's unique identifier. To get a list of all available policy identifiers use the command polkit-action.

return

Specify the answer PolicyKit will return. Takes a single attribute, result=value with one of the values listed under Modifying Configuration Files for Implicit Privileges.

define_admin_auth

Specify users or groups allowed to authorize with their own password where normally the root password would be required. Takes the attributes user=USER or group=GROUP, but only one may be used at a time. Multiple attribute values must be separated by |, Extended POSIX Regular Expressions are not supported. Applies to all policies when used at the top level, or to specific policies when used within <match> statements.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE pkconfig PUBLIC "-//freedesktop//DTD PolicyKit Configuration 1.0//EN"
"http://hal.freedesktop.org/releases/PolicyKit/1.0/config.dtd">
<config version="0.1">
  <match action="org.freedesktop.packagekit.system-update">
    <match user="tux">
      <return result="yes"/>
    </match>
  </match>
  <match action="org.freedesktop.policykit.*">
    <match user="tux|wilber">
      <return result="no"/>
    </match>
  </match>
  <define_admin_auth group="administrators"/>
</config>