1 |
On 05/17/2011 03:15 AM, Samuli Suominen wrote: |
2 |
> Let's start with generalized example so everyone gets the idea... |
3 |
> |
4 |
> Reference: man 8 pklocalauthority |
5 |
> |
6 |
> /etc/polkit-1/localauthority/10-vendor.d/example-udisks.pkla |
7 |
> |
8 |
> [Local users] |
9 |
> Identity=unix-group:plugdev |
10 |
> Action=org.freedesktop.udisks.* |
11 |
> ResultAny=yes |
12 |
> ResultInactive=yes |
13 |
> ResultActive=yes |
14 |
> |
15 |
> The above file would grant permission with or without active local |
16 |
> ConsoleKit session to users in plugdev group to everything udisks handles. |
17 |
> |
18 |
> Notice that getting active ConsoleKit session you are now required to |
19 |
> use PAM, or Display Manager like GDM with internal ConsoleKit support. |
20 |
> |
21 |
> Note that the PAM method requires you to have CONFIG_AUDITSYSCALL=y |
22 |
> support enabled in kernel to get valid sessionid string and not all |
23 |
> minor archs support this kernel option. |
24 |
> |
25 |
> |
26 |
> We could have similar .pkla files also for other stuff like bluetooth, |
27 |
> networkmanager, shutdown/reboot, suspend and hibernate (upower), and the |
28 |
> list continues. |
29 |
> |
30 |
> The benefits are somewhat clear, things would work out of box for remote |
31 |
> users beloging to right group, PAM-less users, as well as minor arches. |
32 |
> |
33 |
> The downside of this is that most users would propably end up using this |
34 |
> as workaround for inactive ConsoleKit sessions that should really be |
35 |
> local, but the user is just failing to configure his system in proper |
36 |
> state to gain it (launching the X wrong way, wrong kernel opts, ...) |
37 |
> |
38 |
> And if we want this, should we stick to generalized plugdev group? |
39 |
> |
40 |
> Or perhaps group wheel for shutdown/reboot. Group storage for udisks. |
41 |
> Group power for upower (hibernate, suspend). Group bluetooth for bluez. |
42 |
> Group network for networkmanager? (Just throwing ideas...) |
43 |
> |
44 |
> So... any comments before I just pick what I think is best and commit |
45 |
> the .pkla files (or not). I'm really 50-50 on this... |
46 |
> |
47 |
> Would like to get this decided before p.masking HAL. |
48 |
|
49 |
... |
50 |
|
51 |
Futhermore I would like the baselayout package to create the groups |
52 |
decided here, be it wheel (already there), plugdev, or more fine grained |
53 |
storage/power ones. |
54 |
I think the "distribution policy" (be it the general consensus on this |
55 |
thread) on this should be reflected in there. And it's the most |
56 |
convinient place, then packages don't have to worry about creating |
57 |
them... just follow |