PolicyKit rules never come into effect

Question

I'm trying to write a new .rules file for PolicyKit. My test attempt (in the directory /etc/polkit-1/rules.d/) looks like this:

polkit.addRule(function(action, subject) {
    polkit.spawn(["rm","/home/gabriel/test"]);
    if (action.id == "org.freedesktop.policykit.exec") {
        polkit.log("action=" + action);
        polkit.log("subject=" + subject);
    }
    return polkit.Result.NOT_HANDLED;
});

But as far as I can tell, this code is never run. The test file is still there, and there's no log output after running something like $ pkexec -u otheruser bash

(I have tried marking the .rules files as executable.)

Answer 1

If you are on Ubuntu 22.04 (or lower) then you are still using the old version of PolKit, where there are no .rules files but only .pkla and .conf files.

On the command prompt, do:

pkaction --version

If it says < 0.106, then you can only use the old syntax.

You can create a .pkla file in /etc/polkit-1/localauthority/, see man pklocalauthority for directions and examples.

Answer 2

The following worked for me (ubuntu 22.04 with pkaction version 0.105):

Edit the following file:

/var/lib/polkit-1/localauthority/10-vendor.d/com.ubuntu.desktop.pkla

And make the first section look like:

[Mounting, checking, etc. of internal drives]
Identity=unix-group:admin;unix-group:sudo
Action=org.freedesktop.udisks.filesystem-*;org.freedesktop.udisks.drive-ata-smart*;org.freedesktop.udisks2.encrypted-unlock-system;org.freedesktop.udisks2.filesystem-fstab;org.freedesktop.udisks2.filesystem-mount-system;org.freedesktop.udisks2.filesystem-mount-other-seat;
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Reboot is not required. Works just after you edit the file.

Note I added "org.freedesktop.udisks2.filesystem-mount-other-seat" here. In my case, when I was trying to mount a disk from commandline, I was receiving the following message:

$ udisksctl mount -b /dev/sdb1
==== AUTHENTICATING FOR org.freedesktop.udisks2.filesystem-mount-other-seat ===
Authentication is required to mount WD Elements 25A3 (/dev/sdb1)
Authenticating as: User,,, (user)

Answer 3

To work as expected, you have to put your own .rules files in:

/usr/share/polkit-1/rules.d

Note that it should also solve this question.