[opensuse-factory] How to make custom policy configuration?
Hi! It seems that the polkit policy in Factory is no longer compatible with HAL which is essential for normal use of KDE3. Is it possible to enable a custom policy set in KDE3 repository without forking the polkit-default-priv package? That is with current Factory policy a KDE3 user can enable say, automatic mounting of removable media with the following command: sudo polkit-auth --user $USER --grant org.freedesktop.hal.storage.mount-removable But this command is not suitable for autostart (because requires a root password) and also not suitable for install-time because it requires a username and cannot be used to enable the privilege for all users. It there another way of doing the same which is suitable for packaging and makes the process automatic? -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org
On Wed, 2011-08-10 at 12:38 +0400, Ilya Chernykh wrote:
Hi!
It seems that the polkit policy in Factory is no longer compatible with HAL which is essential for normal use of KDE3. Is it possible to enable a custom policy set in KDE3 repository without forking the polkit-default-priv package?
That is with current Factory policy a KDE3 user can enable say, automatic mounting of removable media with the following command:
sudo polkit-auth --user $USER --grant org.freedesktop.hal.storage.mount-removable
You can add your own modification to polkit-default-privs.local; those will not be overwritten by system updates. Hth, Dominique -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org
On Wed, Aug 10, 2011 at 12:38:39PM +0400, Ilya Chernykh wrote:
Hi!
It seems that the polkit policy in Factory is no longer compatible with HAL which is essential for normal use of KDE3. Is it possible to enable a custom policy set in KDE3 repository without forking the polkit-default-priv package?
That is with current Factory policy a KDE3 user can enable say, automatic mounting of removable media with the following command:
sudo polkit-auth --user $USER --grant org.freedesktop.hal.storage.mount-removable
But this command is not suitable for autostart (because requires a root password) and also not suitable for install-time because it requires a username and cannot be used to enable the privilege for all users.
It there another way of doing the same which is suitable for packaging and makes the process automatic?
Locally you can edit /etc/polkit-default-privs.local to add this rule, in the style of If you want to hav it system wide, open a bug and assign it to lnussel@novell.com (or suse.com) or to security-team@suse.de Or if you just want to have it for your package, use a file within /etc/polkit-default-privs.d/ as drop directory. Use something like this line org.freedesktop.hal.storage.mount-removable no:no:yes (the user at the local console has the rights, no others) Ciao, Marcus -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org
Marcus Meissner wrote:
On Wed, Aug 10, 2011 at 12:38:39PM +0400, Ilya Chernykh wrote:
It seems that the polkit policy in Factory is no longer compatible with HAL which is essential for normal use of KDE3. Is it possible to enable a custom policy set in KDE3 repository without forking the polkit-default-priv package?
That is with current Factory policy a KDE3 user can enable say, automatic mounting of removable media with the following command:
sudo polkit-auth --user $USER --grant org.freedesktop.hal.storage.mount-removable
But this command is not suitable for autostart (because requires a root password) and also not suitable for install-time because it requires a username and cannot be used to enable the privilege for all users.
It there another way of doing the same which is suitable for packaging and makes the process automatic?
Locally you can edit /etc/polkit-default-privs.local to add this rule, in the style of
If you want to hav it system wide, open a bug and assign it to lnussel@novell.com (or suse.com) or to security-team@suse.de
Hal is gone and so are it's privileges. No point adding them back.
Or if you just want to have it for your package, use a file within /etc/polkit-default-privs.d/ as drop directory.
Use something like this line
org.freedesktop.hal.storage.mount-removable no:no:yes
Exactly. Just take the lines that refer to hal from 11.4's polkit-default-privs.{standard,restrictive} and put them in e.g. /etc/polkit-default-privs.d/hal.{standard,restrictive}. However, since PolicyKit will vanish sooner or later too I'm considering removing support for it from polkit-default-privs as well. So you may need to patch /usr/share/PolicyKit/policy/*hal*.policy with sane settings instead. Alternatively consider using udisks instead of hal for the job to get rid of the hal+PolicyKit dependency. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org
participants (4)
-
Dimstar / Dominique Leuenberger -
Ilya Chernykh -
Ludwig Nussel -
Marcus Meissner