Wheel group as polkit admins

Wheel group as polkit admins

[Leo Prikler]

Hello,

some other distros use a Polkit rule, that makes the local admin group
("wheel" on Guix) Polkit admins.  Yet others easily allow writing your
own files to /etc, so that such a rule can be added.  Guix lacks such a
rule by default and adding it in the way you're supposed to in other
distros is not very guixy.

Since our polkit service expects a list of packages as extension, I
currently use the following in my /etc/config.scm:

--8<---------------cut here---------------start------------->8---
(define polkit-wheel
  (package
   (name "polkit-wheel")
   (version "0")
   (source #f)
   (build-system trivial-build-system)
   (arguments
    `(#:modules ((guix build utils))
      #:builder
      (begin
        (use-modules ((guix build utils)))
        (let ((rules.d (string-append %output "/share/polkit-
1/rules.d")))
          (mkdir-p rules.d)
          (with-output-to-file (string-append rules.d "/wheel.rules")
            (lambda ()
              (display "polkit.addAdminRule(function(action, subject) {
    return [\"unix-group:wheel\"];
});
")))))))
   (home-page #f)
   (synopsis "Make wheel adminstrate")
   (description #f)
   (license #f)))

(define polkit-wheel-service-type
  (service-type (name 'polkit-wheel)
                (extensions
                 (list (service-extension polkit-service-type
                                          (const (list polkit-
wheel)))))
                (default-value '())))
--8<---------------cut here---------------end--------------->8---

The problems with this apporach should be clear.  "polkit-wheel" is by
no stretch of the imagination an actual package.  It is so trivial,
that it might as well just be a file.  Is there a simpler way of
extending polkit, perhaps with just a g-expression?

Regards,

Leo

Re: Wheel group as polkit admins

[Ludovic Courtès]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> Since our polkit service expects a list of packages as extension, I
> currently use the following in my /etc/config.scm:
>
> (define polkit-wheel
>   (package
>    (name "polkit-wheel")
>    (version "0")
>    (source #f)
>    (build-system trivial-build-system)
>    (arguments
>     `(#:modules ((guix build utils))
>       #:builder
>       (begin
>         (use-modules ((guix build utils)))
>         (let ((rules.d (string-append %output "/share/polkit-
> 1/rules.d")))
>           (mkdir-p rules.d)
>           (with-output-to-file (string-append rules.d "/wheel.rules")
>             (lambda ()
>               (display "polkit.addAdminRule(function(action, subject) {
>     return [\"unix-group:wheel\"];
> });
> ")))))))
>    (home-page #f)
>    (synopsis "Make wheel adminstrate")
>    (description #f)
>    (license #f)))
>
> (define polkit-wheel-service-type
>   (service-type (name 'polkit-wheel)
>                 (extensions
>                  (list (service-extension polkit-service-type
>                                           (const (list polkit-
> wheel)))))
>                 (default-value '())))
>
> The problems with this apporach should be clear.  "polkit-wheel" is by
> no stretch of the imagination an actual package.  It is so trivial,
> that it might as well just be a file.  Is there a simpler way of
> extending polkit, perhaps with just a g-expression?

Yup, I think you could make it a ‘computed-file’ instead of a package:

  (computed-file "polkit-wheel-rule"
                 (with-imported-modules '((guix build utils))
                   #~(begin …)))

Should we make that the default, BTW?  It would seem to make sense as
that’s the whole point of the “wheel” group.

What do people think?

Thanks,
Ludo’.

Re: Wheel group as polkit admins

[Leo Prikler]

Hi Ludo,

Am Sonntag, den 17.11.2019, 17:46 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > Since our polkit service expects a list of packages as extension, I
> > currently use the following in my /etc/config.scm:
> > 
> > (define polkit-wheel
> >   (package
> >    (name "polkit-wheel")
> >    (version "0")
> >    (source #f)
> >    (build-system trivial-build-system)
> >    (arguments
> >     `(#:modules ((guix build utils))
> >       #:builder
> >       (begin
> >         (use-modules ((guix build utils)))
> >         (let ((rules.d (string-append %output "/share/polkit-
> > 1/rules.d")))
> >           (mkdir-p rules.d)
> >           (with-output-to-file (string-append rules.d
> > "/wheel.rules")
> >             (lambda ()
> >               (display "polkit.addAdminRule(function(action,
> > subject) {
> >     return [\"unix-group:wheel\"];
> > });
> > ")))))))
> >    (home-page #f)
> >    (synopsis "Make wheel adminstrate")
> >    (description #f)
> >    (license #f)))
> > 
> > (define polkit-wheel-service-type
> >   (service-type (name 'polkit-wheel)
> >                 (extensions
> >                  (list (service-extension polkit-service-type
> >                                           (const (list polkit-
> > wheel)))))
> >                 (default-value '())))
> > 
> > The problems with this apporach should be clear.  "polkit-wheel" is
> > by
> > no stretch of the imagination an actual package.  It is so trivial,
> > that it might as well just be a file.  Is there a simpler way of
> > extending polkit, perhaps with just a g-expression?
> 
> Yup, I think you could make it a ‘computed-file’ instead of a
> package:
> 
>   (computed-file "polkit-wheel-rule"
>                  (with-imported-modules '((guix build utils))
>                    #~(begin …)))
Thanks for the hint.  Since it's all just static text, I don't really
need the whole Guile power of computed-file, so I've shortened it to:

--8<---------------cut here---------------start------------->8---
(define polkit-wheel
  (file-union
   "polkit-wheel"
   `(("share/polkit-1/rules.d/wheel.rules"
      ,(plain-file
        "wheel.rules"
        "polkit.addAdminRule(function(action, subject) {
    return [\"unix-group:wheel\"];
});
")))))
--8<---------------cut here---------------end--------------->8---

"guix system build" seems to return what I want with that.  Strangely
enough plain-file does not like to build directories, so I had to use a
file-union here.

> Should we make that the default, BTW?  It would seem to make sense as
> that’s the whole point of the “wheel” group.
> 
> What do people think?

I'm probably biased as the author of this service, but I think it would
probably make sense to include it in %desktop-services.  Perhaps we
could even add wheel.rules to polkit-service-type itself, although I'm
somewhat conflicted on that, as one could not opt out.

Regards,
Leo

Re: Wheel group as polkit admins

[Ludovic Courtès]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> Thanks for the hint.  Since it's all just static text, I don't really
> need the whole Guile power of computed-file, so I've shortened it to:
>
> (define polkit-wheel
>   (file-union
>    "polkit-wheel"
>    `(("share/polkit-1/rules.d/wheel.rules"
>       ,(plain-file
>         "wheel.rules"
>         "polkit.addAdminRule(function(action, subject) {
>     return [\"unix-group:wheel\"];
> });
> ")))))

Neat.

>> Should we make that the default, BTW?  It would seem to make sense as
>> that’s the whole point of the “wheel” group.
>> 
>> What do people think?
>
> I'm probably biased as the author of this service, but I think it would
> probably make sense to include it in %desktop-services.  Perhaps we
> could even add wheel.rules to polkit-service-type itself, although I'm
> somewhat conflicted on that, as one could not opt out.

Yeah, let’s make it a separate service like you did.

Could you send a patch that does that?

Thanks!

Ludo’.

Re: Wheel group as polkit admins

[Leo Prikler]

[-- Attachment #1: Type: text/plain, Size: 1484 bytes --]

Hi Ludo,

Am Samstag, den 23.11.2019, 18:17 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > Thanks for the hint.  Since it's all just static text, I don't
> > really
> > need the whole Guile power of computed-file, so I've shortened it
> > to:
> > 
> > (define polkit-wheel
> >   (file-union
> >    "polkit-wheel"
> >    `(("share/polkit-1/rules.d/wheel.rules"
> >       ,(plain-file
> >         "wheel.rules"
> >         "polkit.addAdminRule(function(action, subject) {
> >     return [\"unix-group:wheel\"];
> > });
> > ")))))
> 
> Neat.
> 
> > > Should we make that the default, BTW?  It would seem to make
> > > sense as
> > > that’s the whole point of the “wheel” group.
> > > 
> > > What do people think?
> > 
> > I'm probably biased as the author of this service, but I think it
> > would
> > probably make sense to include it in %desktop-services.  Perhaps we
> > could even add wheel.rules to polkit-service-type itself, although
> > I'm
> > somewhat conflicted on that, as one could not opt out.
> 
> Yeah, let’s make it a separate service like you did.
> 
> Could you send a patch that does that?
> 
> Thanks!
> 
> Ludo’.
Sure.  I've split it up into two patches – one for the service itself,
and one to add it to %desktop-services.  Also I'm using a simple-
service instead of a service type, but it still serves the same
purpose.

Regards,

Leo


[-- Attachment #2: 0001-services-Add-polkit-wheel-service.patch --]
[-- Type: text/x-patch, Size: 1364 bytes --]

From 42eedd4d9d64a8432f787e68d64476c59200c1b6 Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:51:15 +0100
Subject: [PATCH 1/2] services: Add polkit-wheel-service.

* gnu/services/desktop.scm: (polkit-wheel): New variable.
(polkit-wheel-service): New service.
---
 gnu/services/desktop.scm | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 0152e86e8a..e58a08e068 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -135,6 +135,8 @@
             inputattach-configuration?
             inputattach-service-type
 
+            polkit-wheel-service
+
             %desktop-services))
 
 ;;; Commentary:
@@ -1064,6 +1066,25 @@ as expected.")))
    (description "Return a service that runs inputattach on a device and
 dispatches events from it.")))
 
+\f
+;;;
+;;; polkit-wheel-service
+;;;
+
+(define polkit-wheel
+  (file-union
+   "polkit-wheel"
+   `(("share/polkit-1/rules.d/wheel.rules"
+      ,(plain-file
+        "wheel.rules"
+        "polkit.addAdminRule(function(action, subject) {
+    return [\"unix-group:wheel\"];
+});
+")))))
+
+(define polkit-wheel-service
+  (simple-service 'polkit-wheel polkit-service-type (list polkit-wheel)))
+
 \f
 ;;;
 ;;; The default set of desktop services.
-- 
2.24.0


[-- Attachment #3: 0002-services-Add-polkit-wheel-service-to-desktop-service.patch --]
[-- Type: text/x-patch, Size: 1040 bytes --]

From 1585513cc6d96e2f32a56850c9c26551a29d9f0f Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:58:11 +0100
Subject: [PATCH 2/2] services: Add polkit-wheel-service to %desktop-services.

* gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-service.
---
 gnu/services/desktop.scm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index e58a08e068..9b8d5be905 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -1101,6 +1101,9 @@ dispatches events from it.")))
          ;; Add udev rules for MTP devices so that non-root users can access
          ;; them.
          (simple-service 'mtp udev-service-type (list libmtp))
+         ;; Add polkit rules, so that non-root users in the wheel group can
+         ;; perform administrative tasks (similar to "sudo").
+         polkit-wheel-service
 
          ;; NetworkManager and its applet.
          (service network-manager-service-type)
-- 
2.24.0

Re: Wheel group as polkit admins

[Ludovic Courtès]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> From 42eedd4d9d64a8432f787e68d64476c59200c1b6 Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 23 Nov 2019 19:51:15 +0100
> Subject: [PATCH 1/2] services: Add polkit-wheel-service.
>
> * gnu/services/desktop.scm: (polkit-wheel): New variable.
> (polkit-wheel-service): New service.
> ---
>  gnu/services/desktop.scm | 21 +++++++++++++++++++++
>  1 file changed, 21 insertions(+)
>
> diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
> index 0152e86e8a..e58a08e068 100644
> --- a/gnu/services/desktop.scm
> +++ b/gnu/services/desktop.scm
> @@ -135,6 +135,8 @@
>              inputattach-configuration?
>              inputattach-service-type
>  
> +            polkit-wheel-service
> +
>              %desktop-services))
>  
>  ;;; Commentary:
> @@ -1064,6 +1066,25 @@ as expected.")))
>     (description "Return a service that runs inputattach on a device and
>  dispatches events from it.")))
>  
> +\f
> +;;;
> +;;; polkit-wheel-service
> +;;;
> +
> +(define polkit-wheel
> +  (file-union
> +   "polkit-wheel"
> +   `(("share/polkit-1/rules.d/wheel.rules"
> +      ,(plain-file
> +        "wheel.rules"
> +        "polkit.addAdminRule(function(action, subject) {
> +    return [\"unix-group:wheel\"];
> +});
> +")))))
> +
> +(define polkit-wheel-service
> +  (simple-service 'polkit-wheel polkit-service-type (list polkit-wheel)))

Could you (1) add a comment saying what this does, like you did in the
second patch, and (2) document it in guix.texi, presumably right below
‘polkit-service’?

> From 1585513cc6d96e2f32a56850c9c26551a29d9f0f Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 23 Nov 2019 19:58:11 +0100
> Subject: [PATCH 2/2] services: Add polkit-wheel-service to %desktop-services.
>
> * gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-service.

OK!

I’ll wait for your updated patch, thank you!

Ludo’.

Re: Wheel group as polkit admins

[Leo Prikler]

[-- Attachment #1: Type: text/plain, Size: 2581 bytes --]

Hi Ludo,

Am Dienstag, den 26.11.2019, 11:17 +0100 schrieb Ludovic Courtès:
> Hi Leo,
> 
> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
> 
> > From 42eedd4d9d64a8432f787e68d64476c59200c1b6 Mon Sep 17 00:00:00
> > 2001
> > From: Leo Prikler <leo.prikler@student.tugraz.at>
> > Date: Sat, 23 Nov 2019 19:51:15 +0100
> > Subject: [PATCH 1/2] services: Add polkit-wheel-service.
> > 
> > * gnu/services/desktop.scm: (polkit-wheel): New variable.
> > (polkit-wheel-service): New service.
> > ---
> >  gnu/services/desktop.scm | 21 +++++++++++++++++++++
> >  1 file changed, 21 insertions(+)
> > 
> > diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
> > index 0152e86e8a..e58a08e068 100644
> > --- a/gnu/services/desktop.scm
> > +++ b/gnu/services/desktop.scm
> > @@ -135,6 +135,8 @@
> >              inputattach-configuration?
> >              inputattach-service-type
> >  
> > +            polkit-wheel-service
> > +
> >              %desktop-services))
> >  
> >  ;;; Commentary:
> > @@ -1064,6 +1066,25 @@ as expected.")))
> >     (description "Return a service that runs inputattach on a
> > device and
> >  dispatches events from it.")))
> >  
> > +
> > +;;;
> > +;;; polkit-wheel-service
> > +;;;
> > +
> > +(define polkit-wheel
> > +  (file-union
> > +   "polkit-wheel"
> > +   `(("share/polkit-1/rules.d/wheel.rules"
> > +      ,(plain-file
> > +        "wheel.rules"
> > +        "polkit.addAdminRule(function(action, subject) {
> > +    return [\"unix-group:wheel\"];
> > +});
> > +")))))
> > +
> > +(define polkit-wheel-service
> > +  (simple-service 'polkit-wheel polkit-service-type (list polkit-
> > wheel)))
> 
> Could you (1) add a comment saying what this does, like you did in
> the
> second patch, and (2) document it in guix.texi, presumably right
> below
> ‘polkit-service’?
(1) I'm not sure whether I should copy/move the comment from the second
patch, since that one is in line with the other comments for %desktop-
services.  I added a small, simplified comment in the "header" instead.
(2) Done.

> > From 1585513cc6d96e2f32a56850c9c26551a29d9f0f Mon Sep 17 00:00:00
> > 2001
> > From: Leo Prikler <leo.prikler@student.tugraz.at>
> > Date: Sat, 23 Nov 2019 19:58:11 +0100
> > Subject: [PATCH 2/2] services: Add polkit-wheel-service to
> > %desktop-services.
> > 
> > * gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-
> > service.
> 
> OK!
> 
> I’ll wait for your updated patch, thank you!
> 
> Ludo’.
Patch is updated.

Leo.

[-- Attachment #2: 0001-services-Add-polkit-wheel-service.patch --]
[-- Type: text/x-patch, Size: 2351 bytes --]

From fae10039a5c875e48ca2ae8087bab702b69ac0b0 Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:51:15 +0100
Subject: [PATCH 1/2] services: Add polkit-wheel-service.

* gnu/services/desktop.scm: (polkit-wheel): New variable.
(polkit-wheel-service): New service.
* doc/guix.texi: Document polkit-wheel-service.
---
 doc/guix.texi            |  7 +++++++
 gnu/services/desktop.scm | 21 +++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/doc/guix.texi b/doc/guix.texi
index a64b0fb84c..3bf5eb2587 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -15585,6 +15585,13 @@ capabilities to ordinary users.  For example, an ordinary user can be granted
 the capability to suspend the system if the user is logged in locally.
 @end deffn
 
+@defvr {Scheme Variable} polkit-wheel-service
+Service that adds the @code{wheel} group as admins to the Polkit
+service.  This makes it so that users in the @code{wheel} group are queried
+for their own passwords when performing administrative actions instead of
+@code{root}'s, similar to the behaviour used by @code{sudo}.
+@end defvr
+
 @defvr {Scheme Variable} upower-service-type
 Service that runs @uref{https://upower.freedesktop.org/, @command{upowerd}}, a
 system-wide monitor for power consumption and battery levels, with the given
diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 0152e86e8a..9eee2fa485 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -135,6 +135,8 @@
             inputattach-configuration?
             inputattach-service-type
 
+            polkit-wheel-service
+
             %desktop-services))
 
 ;;; Commentary:
@@ -1064,6 +1066,25 @@ as expected.")))
    (description "Return a service that runs inputattach on a device and
 dispatches events from it.")))
 
+\f
+;;;
+;;; polkit-wheel-service -- Allow wheel group to perform admin actions
+;;;
+
+(define polkit-wheel
+  (file-union
+   "polkit-wheel"
+   `(("share/polkit-1/rules.d/wheel.rules"
+      ,(plain-file
+        "wheel.rules"
+        "polkit.addAdminRule(function(action, subject) {
+    return [\"unix-group:wheel\"];
+});
+")))))
+
+(define polkit-wheel-service
+  (simple-service 'polkit-wheel polkit-service-type (list polkit-wheel)))
+
 \f
 ;;;
 ;;; The default set of desktop services.
-- 
2.24.0


[-- Attachment #3: 0002-services-Add-polkit-wheel-service-to-desktop-service.patch --]
[-- Type: text/x-patch, Size: 1040 bytes --]

From db1477567fa6c9a217c7fa12c6d9c49f0e0b285b Mon Sep 17 00:00:00 2001
From: Leo Prikler <leo.prikler@student.tugraz.at>
Date: Sat, 23 Nov 2019 19:58:11 +0100
Subject: [PATCH 2/2] services: Add polkit-wheel-service to %desktop-services.

* gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-service.
---
 gnu/services/desktop.scm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 9eee2fa485..4a5898fbb9 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -1101,6 +1101,9 @@ dispatches events from it.")))
          ;; Add udev rules for MTP devices so that non-root users can access
          ;; them.
          (simple-service 'mtp udev-service-type (list libmtp))
+         ;; Add polkit rules, so that non-root users in the wheel group can
+         ;; perform administrative tasks (similar to "sudo").
+         polkit-wheel-service
 
          ;; NetworkManager and its applet.
          (service network-manager-service-type)
-- 
2.24.0

Re: Wheel group as polkit admins

[Ludovic Courtès]

Hi Leo,

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> From fae10039a5c875e48ca2ae8087bab702b69ac0b0 Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 23 Nov 2019 19:51:15 +0100
> Subject: [PATCH 1/2] services: Add polkit-wheel-service.
>
> * gnu/services/desktop.scm: (polkit-wheel): New variable.
> (polkit-wheel-service): New service.
> * doc/guix.texi: Document polkit-wheel-service.

[...]

> From db1477567fa6c9a217c7fa12c6d9c49f0e0b285b Mon Sep 17 00:00:00 2001
> From: Leo Prikler <leo.prikler@student.tugraz.at>
> Date: Sat, 23 Nov 2019 19:58:11 +0100
> Subject: [PATCH 2/2] services: Add polkit-wheel-service to %desktop-services.
>
> * gnu/services/desktop.scm: (%desktop-services): Add polkit-wheel-service.

Applied both, thank you!

Ludo’.

Re: Wheel group as polkit admins

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 489 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Leo Prikler <leo.prikler@student.tugraz.at> skribis:
>>           (with-output-to-file (string-append rules.d "/wheel.rules")
>>             (lambda ()
>>               (display "polkit.addAdminRule(function(action, subject) {
>>     return [\"unix-group:wheel\"];
>> });

[...]

> Should we make that the default, BTW?  It would seem to make sense as
> that’s the whole point of the “wheel” group.

Sounds reasonable to me.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]