Roles and Policy

Hey, I've just added a new subpackage in the polkit SRPM called polkit-desktop-policy. This package will add two new system groups (the trailing _r signifies these are really roles, not ordinary groups) - desktop_admin_r - desktop_user_r The patch is here http://cvs.fedoraproject.org/viewvc/devel/polkit/polkit.spec?r1=1.8&r... It works like this 1. If the desktop_admin_r group is non-empty, then users in the group are used for administrator authentication - see the polkit(8) man page for details: http://hal.freedesktop.org/docs/polkit/polkit.8.html If the desktop_admin_r group is empty, we just ask for the root password instead. For example, the following is a screenshot where the users davidz and bateman are in the desktop_admin_r group: http://people.freedesktop.org/~david/pkexec-with-desktop-admin-r.png 2. Second, if you are member of the desktop_admin_r group, then you should be allowed to do a lot of things without being interrupted by authentication dialogs. This part isn't complete, for now, it includes org.gnome.clockapplet.mechanism.* - set timezone and system time org.freedesktop.devicekit.disks.* - all storage related things org.freedesktop.RealtimeKit1.* - run real-time processes but we probably want to allow installing trusted packages, install trusted updates and remove packages. Without asking for a password. Probably more - Richard? 3. Third, if you are a member of the desktop_user_r group then you should be allowed to do a number of things - not as much as the desktop_admin_r role, but things like setting the time zone. For now, we only include org.gnome.clockapplet.mechanism.settimezone A couple of notes - As we add/remove mechanisms (e.g. privileged apps using polkit), we need to update this package. That's fine. - For this to be really useful, we need the User Account Editor that Matthias wrote about here https://www.redhat.com/archives/fedora-desktop-list/2008-May/msg00006.html Sadly no work has been done on this yet. Anyway, the main point is that we can add something like this Account Type (*) Standard User ( ) Administrative User to this tool. We can also add more roles, e.g. "Restricted User" and also tailor policy for the mythical guest account. - This is opt-in. If you don't want to use this, just don't add any users to the desktop_admin_r or desktop_user_r groups. Heck, just uninstall the package. Second, other third-party packages can easily override this thanks to how the polkit local authority works (see the pklocalauthority(8) man page for details). - This should put an end to the (IMO misguided) request "please add first user to the 'wheel' group". The new 'wheel' is 'desktop_admin_r' and the new sudo(1) is pkexec(1). (Of course sudo(1) will still continue to work but it is not what we officially want to support. PolicyKit is, however) - With support in the OS installer for automatically adding the first user to desktop_admin_r, we should be close to actually doing installs without the concept of a root password... Of course this is not 100% useful until a) the OS installer knows about this; and b) we have an User Account Editor. But it is 90% there. Finally, Matthias, can someone please add polkit-desktop-policy to the default desktop install? Thanks. David