Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is it possible to do the following using 1 polkit .pkla file?

  1. Disable all users except those in the wheel group from using polkit.
  2. The users in the wheel group will need to provide the root password when using polkit.

/etc/polkit-1/localauthority/50-local.d/99-wheel-only.pkla

[disable all users except the wheel group]
Identity=unix-group:wheel
Action=*
ResultAny=???
ResultInactive=???
ResultActive=???

The following file works but you need to provide all the users in /etc/group:

[disable all users except those in the wheel group: root and myuser]
Identity=unix-user:daemon;unix-user:bin;unix-user:sys;unix-user:adm;unix-user:tty;unix-user:disk;unix-user:lp;unix-user:mail;unix-user:news;unix-user:uucp;unix-user:man;unix-user:proxy;unix-user:kmem;unix-user:dialout;unix-user:fax;unix-user:voice;unix-user:cdrom;unix-user:floppy;unix-user:tape;unix-user:sudo;unix-user:audio;unix-user:dip;unix-user:www-data;unix-user:backup;unix-user:operator;unix-user:list;unix-user:irc;unix-user:src;unix-user:gnats;unix-user:shadow;unix-user:utmp;unix-user:video;unix-user:sasl;unix-user:plugdev;unix-user:staff;unix-user:games;unix-user:users;unix-user:nogroup;unix-user:libuuid;unix-user:crontab;unix-user:messagebus;unix-user:Debian-exim;unix-user:mlocate;unix-user:avahi;unix-user:netdev;unix-user:bluetooth;unix-user:lpadmin;unix-user:ssl-cert;unix-user:fuse;unix-user:utempter;unix-user:Debian-gdm;unix-user:scanner;unix-user:saned;unix-user:i2c;unix-user:haldaemon;unix-user:powerdev
Action=*
ResultAny=no
ResultInactive=no
ResultActive=no
share|improve this question

1 Answer 1

up vote 0 down vote accepted

I would try the following .pkla

[First disable all users]
Identity=unix-user:*
Action=*
ResultActive=no
ResultInactive=no
ResultAny=no

[Then enable wheel group]
Identity=unix-group:wheel
Action=*
ResultActive=auth_admin
ResultInactive=no
ResultAny=no

in conjunction with a modification of the AdminIdentities, configured in a file under /etc/polkit-1/localauthority.conf.d/.
I have the following two files

50-localauthority.conf

[Configuration]
AdminIdentities=unix-user:0

and

51-ubuntu-admin.conf

[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

The second one override the first, and force to use sudo (and the old admin) group. Remove the second file and you are leaved with a root password request.

share|improve this answer
    
unix-group may not work on some buggy polkit versions. In that case, use unix-user instead. –  John Nash Sep 9 '12 at 8:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.