xfce polkit

Author: heapbytes

src/airootfs/etc/polkit-1/localauthority/50-local.d/10-udisks.pkla

@@ -0,0 +1,14 @@
+[udisks1]
+Identity=unix-group:storage
+Action=org.freedesktop.udisks.filesystem-mount;org.freedesktop.udisks.luks-unlock;org.freedesktop.udisks.drive-eject;org.freedesktop.udisks.drive-detach
+ResultAny=yes
+
+[udisks2]
+Identity=unix-group:storage
+Action=org.freedesktop.udisks2.filesystem-mount;org.freedesktop.udisks2.encrypted-unlock;org.freedesktop.udisks2.eject-media;org.freedesktop.udisks2.power-off-drive
+ResultAny=yes
+
+[udisks2-other-seat]
+Identity=unix-group:storage
+Action=org.freedesktop.udisks2.filesystem-mount-other-seat;org.freedesktop.udisks2.filesystem-unmount-others;org.freedesktop.udisks2.encrypted-unlock-other-seat;org.freedesktop.udisks2.eject-media-other-seat;org.freedesktop.udisks2.power-off-drive-other-seat
+ResultAny=yes

src/airootfs/etc/polkit-1/rules.d/50-org.freedesktop.NetworkManager.rules

@@ -0,0 +1,5 @@
+polkit.addRule(function(action, subject) {
+  if (action.id.indexOf("org.freedesktop.NetworkManager.") == 0 && subject.isInGroup("network")) {
+    return polkit.Result.YES;
+  }
+});

src/airootfs/etc/polkit-1/rules.d/50-udiskie.rules

@@ -0,0 +1,25 @@
+polkit.addRule(function(action, subject) {
+  var YES = polkit.Result.YES;
+  // NOTE: there must be a comma at the end of each line except for the last:
+  var permission = {
+    // required for udisks1:
+    "org.freedesktop.udisks.filesystem-mount": YES,
+    "org.freedesktop.udisks.luks-unlock": YES,
+    "org.freedesktop.udisks.drive-eject": YES,
+    "org.freedesktop.udisks.drive-detach": YES,
+    // required for udisks2:
+    "org.freedesktop.udisks2.filesystem-mount": YES,
+    "org.freedesktop.udisks2.encrypted-unlock": YES,
+    "org.freedesktop.udisks2.eject-media": YES,
+    "org.freedesktop.udisks2.power-off-drive": YES,
+    // required for udisks2 if using udiskie from another seat (e.g. systemd):
+    "org.freedesktop.udisks2.filesystem-mount-other-seat": YES,
+    "org.freedesktop.udisks2.filesystem-unmount-others": YES,
+    "org.freedesktop.udisks2.encrypted-unlock-other-seat": YES,
+    "org.freedesktop.udisks2.eject-media-other-seat": YES,
+    "org.freedesktop.udisks2.power-off-drive-other-seat": YES
+  };
+  if (subject.isInGroup("storage")) {
+    return permission[action.id];
+  }
+});

src/airootfs/etc/polkit-1/rules.d/allow-mount-internal.rules

@@ -0,0 +1,8 @@
+polkit.addRule(function(action, subject) {
+    if ((action.id == "org.freedesktop.udisks2.filesystem-mount-system" ||
+         action.id == "org.freedesktop.udisks.filesystem-mount-system-internal") &&
+        subject.local && subject.active && subject.isInGroup("users"))
+    {
+            return polkit.Result.YES;
+    }
+});

src/airootfs/etc/polkit-1/rules.d/always-allow-wheel.rules

@@ -0,0 +1,7 @@
+polkit.addRule(function(action, subject) {
+    if (/^org\.freedesktop\.udisks\./.test(action.id)
+        && subject.isInGroup("wheel"))
+    {
+        return polkit.Result.YES;
+    }
+});

src/airootfs/etc/polkit-1/rules.d/udisks-no-consolekit.rules

@@ -0,0 +1,10 @@
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.freedesktop.udisks.filesystem-mount") {
+        if (subject.isInGroup("wheel"))
+            return polkit.Result.YES;
+        else
+            return polkit.Result.AUTH_ADMIN_KEEP;
+    } else if (/^org\.freedesktop\.udisks\./.test(action.id)) {
+        return polkit.Result.AUTH_ADMIN_KEEP;
+    }
+});