Re: Wheel group as polkit admins

[Leo Prikler <leo.prikler@student.tugraz.at>]

[-- Attachment #1: Type: text/plain, Size: 1484 bytes --]

Hi Ludo,

Am Samstag, den 23.11.2019, 18:17 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > Thanks for the hint.  Since it's all just static text, I don't
> > really
> > need the whole Guile power of computed-file, so I've shortened it
> > to:
> > 
> > (define polkit-wheel
> >   (file-union
> >    "polkit-wheel"
> >    `(("share/polkit-1/rules.d/wheel.rules"
> >       ,(plain-file
> >         "wheel.rules"
> >         "polkit.addAdminRule(function(action, subject) {
> >     return [\"unix-group:wheel\"];
> > });
> > ")))))
> 
> Neat.
> 
> > > Should we make that the default, BTW?  It would seem to make
> > > sense as
> > > that’s the whole point of the “wheel” group.
> > > 
> > > What do people think?
> > 
> > I'm probably biased as the author of this service, but I think it
> > would
> > probably make sense to include it in %desktop-services.  Perhaps we
> > could even add wheel.rules to polkit-service-type itself, although
> > I'm
> > somewhat conflicted on that, as one could not opt out.
> 
> Yeah, let’s make it a separate service like you did.
> 
> Could you send a patch that does that?
> 
> Thanks!
> 
> Ludo’.
Sure.  I've split it up into two patches – one for the service itself,
and one to add it to %desktop-services.  Also I'm using a simple-
service instead of a service type, but it still serves the same
purpose.

Regards,

Leo


[-- Attachment #2: 0001-services-Add-polkit-wheel-service.patch --]
[-- Type: text/x-patch, Size: 1364 bytes --]

From 42eedd4d9d64a8432f787e68d64476c59200c1b6 Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:51:15 +0100
Subject: [PATCH 1/2] services: Add polkit-wheel-service.

* gnu/services/desktop.scm: (polkit-wheel): New variable.
(polkit-wheel-service): New service.
---
 gnu/services/desktop.scm | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 0152e86e8a..e58a08e068 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -135,6 +135,8 @@
             inputattach-configuration?
             inputattach-service-type
 
+            polkit-wheel-service
+
             %desktop-services))
 
 ;;; Commentary:
@@ -1064,6 +1066,25 @@ as expected.")))
    (description "Return a service that runs inputattach on a device and
 dispatches events from it.")))
 
+\f
+;;;
+;;; polkit-wheel-service
+;;;
+
+(define polkit-wheel
+  (file-union
+   "polkit-wheel"
+   `(("share/polkit-1/rules.d/wheel.rules"
+      ,(plain-file
+        "wheel.rules"
+        "polkit.addAdminRule(function(action, subject) {
+    return [\"unix-group:wheel\"];
+});
+")))))
+
+(define polkit-wheel-service
+  (simple-service 'polkit-wheel polkit-service-type (list polkit-wheel)))
+
 \f
 ;;;
 ;;; The default set of desktop services.
-- 
2.24.0


[-- Attachment #3: 0002-services-Add-polkit-wheel-service-to-desktop-service.patch --]
[-- Type: text/x-patch, Size: 1040 bytes --]

From 1585513cc6d96e2f32a56850c9c26551a29d9f0f Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:58:11 +0100
Subject: [PATCH 2/2] services: Add polkit-wheel-service to %desktop-services.

* gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-service.
---
 gnu/services/desktop.scm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index e58a08e068..9b8d5be905 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -1101,6 +1101,9 @@ dispatches events from it.")))
          ;; Add udev rules for MTP devices so that non-root users can access
          ;; them.
          (simple-service 'mtp udev-service-type (list libmtp))
+         ;; Add polkit rules, so that non-root users in the wheel group can
+         ;; perform administrative tasks (similar to "sudo").
+         polkit-wheel-service
 
          ;; NetworkManager and its applet.
          (service network-manager-service-type)
-- 
2.24.0