Re: Wheel group as polkit admins

[Leo Prikler <leo.prikler@student.tugraz.at>]

Hi Ludo,

Am Sonntag, den 17.11.2019, 17:46 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > Since our polkit service expects a list of packages as extension, I
> > currently use the following in my /etc/config.scm:
> > 
> > (define polkit-wheel
> >   (package
> >    (name "polkit-wheel")
> >    (version "0")
> >    (source #f)
> >    (build-system trivial-build-system)
> >    (arguments
> >     `(#:modules ((guix build utils))
> >       #:builder
> >       (begin
> >         (use-modules ((guix build utils)))
> >         (let ((rules.d (string-append %output "/share/polkit-
> > 1/rules.d")))
> >           (mkdir-p rules.d)
> >           (with-output-to-file (string-append rules.d
> > "/wheel.rules")
> >             (lambda ()
> >               (display "polkit.addAdminRule(function(action,
> > subject) {
> >     return [\"unix-group:wheel\"];
> > });
> > ")))))))
> >    (home-page #f)
> >    (synopsis "Make wheel adminstrate")
> >    (description #f)
> >    (license #f)))
> > 
> > (define polkit-wheel-service-type
> >   (service-type (name 'polkit-wheel)
> >                 (extensions
> >                  (list (service-extension polkit-service-type
> >                                           (const (list polkit-
> > wheel)))))
> >                 (default-value '())))
> > 
> > The problems with this apporach should be clear.  "polkit-wheel" is
> > by
> > no stretch of the imagination an actual package.  It is so trivial,
> > that it might as well just be a file.  Is there a simpler way of
> > extending polkit, perhaps with just a g-expression?
> 
> Yup, I think you could make it a ‘computed-file’ instead of a
> package:
> 
>   (computed-file "polkit-wheel-rule"
>                  (with-imported-modules '((guix build utils))
>                    #~(begin …)))
Thanks for the hint.  Since it's all just static text, I don't really
need the whole Guile power of computed-file, so I've shortened it to:

--8<---------------cut here---------------start------------->8---
(define polkit-wheel
  (file-union
   "polkit-wheel"
   `(("share/polkit-1/rules.d/wheel.rules"
      ,(plain-file
        "wheel.rules"
        "polkit.addAdminRule(function(action, subject) {
    return [\"unix-group:wheel\"];
});
")))))
--8<---------------cut here---------------end--------------->8---

"guix system build" seems to return what I want with that.  Strangely
enough plain-file does not like to build directories, so I had to use a
file-union here.

> Should we make that the default, BTW?  It would seem to make sense as
> that’s the whole point of the “wheel” group.
> 
> What do people think?

I'm probably biased as the author of this service, but I think it would
probably make sense to include it in %desktop-services.  Perhaps we
could even add wheel.rules to polkit-service-type itself, although I'm
somewhat conflicted on that, as one could not opt out.

Regards,
Leo