https://bugzilla.novell.com/show_bug.cgi?id=770041 https://bugzilla.novell.com/show_bug.cgi?id=770041#c kk zhang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kkzhang@suse.com AssignedTo|bnc-team-screening@forge.pr |lnussel@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=770041 https://bugzilla.novell.com/show_bug.cgi?id=770041#c2 --- Comment #2 from Joerg Steffens 2012-07-13 09:37:21 UTC --- yes, this does help, however, as you know, this file gets regenerated as soon as the command /sbin/set_polkit_default_privs is called. And this command will be called at least as soon as polkit-default-privs gets installed or updated. These is nothing wrong with this behavior, I'm just wondering, that it is not possible to overwrite a PolicyKit rule for a specific group, if another rule has already defined a unix-group:* filter. I expected PolicyKit to check the rule in a specific order, but for me it seems, that the rule with unix-group:* filter is always chosen, independly of where a more specific group related rule is specified. In contrast to this, it is possible to overwrite the unix-group:* filter by a user specific filter. Is this behavior of PolicyKit is really intended? If yes, the only solution I see is to create a copy of /etc/polkit-default-privs.standard, remove the lines, where group specific rules are wanted, and reference to the new file from /etc/sysconfig/security. As you the author of the package, have you other suggestions? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=770041 https://bugzilla.novell.com/show_bug.cgi?id=770041#c3 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |joerg.steffens@dass-it.de --- Comment #3 from Ludwig Nussel 2012-07-13 13:29:04 CEST --- (In reply to comment #2)

yes, this does help, however, as you know, this file gets regenerated as soon as the command /sbin/set_polkit_default_privs is called. And this command will be called at least as soon as polkit-default-privs gets installed or updated.

Sure. I just wanted to check whether my guess about the cause was right :-)

These is nothing wrong with this behavior, I'm just wondering, that it is not possible to overwrite a PolicyKit rule for a specific group, if another rule has already defined a unix-group:* filter.

I expected PolicyKit to check the rule in a specific order, but for me it seems, that the rule with unix-group:* filter is always chosen, independly of where a more specific group related rule is specified. In contrast to this, it is possible to overwrite the unix-group:* filter by a user specific filter.

see man pklocalauthority about the evaluation order. You could try to use a directory that gets sorted before 10-vendor.d (e.g. 05-foobar). The existing directories are not hardcoded, they are just examples.

Is this behavior of PolicyKit is really intended?

Yes and no. Yes because polkit upstream thought that this local authority config thing makes sense. No becaues polkit-default-privs kind of abuses the method to set defaults. But hey, don't worry. Upstream now finally noticed that the config is too complicated and invented something entirely new! In the future those files are Javascript. \o/ *cough*.

If yes, the only solution I see is to create a copy of /etc/polkit-default-privs.standard, remove the lines, where group specific rules are wanted, and reference to the new file from /etc/sysconfig/security.

As you the author of the package, have you other suggestions?

You can also just modify the generated pkla files in some way. set_polkit_default_privs won't touch them anymore then. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=770041 https://bugzilla.novell.com/show_bug.cgi?id=770041#c5 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |WONTFIX --- Comment #5 from Ludwig Nussel 2012-07-23 14:20:13 CEST --- ok :) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.