How to make polkit allow everything (for an awful price)

[Gullible Jones]

Consolekit is rather broken in Debian Wheezy, and doesn't allow you to do stuff you want. This is a crude and hamfisted method for changing that. As a bonus, it lets you mount stuff, etc. without running a ton of consolekit threads.

Warning: I do not know the full security implications of this tweak. It might allow unprivileged users to format drives, or other such idiotic things. DO NOT DO THIS ON ANY PRODUCTION MACHINE!

But yeah. Just put this in /etc/polkit-1/localauthority/50-local.d/allow-everything.pkla...

Code: Select all

[Allow Everything Dammit]
Identity=unix-group:$GROUPNAME
Action=*
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Replace $GROUPNAME with the group name of your choice. Alternatively, you can use unix-user:$USERNAME. Happy automounting.

Again: I do not know ANYTHING of the security implications of this, other than that they are probably bad. Do not blame me if this tweak breaks your Debian installation, or otherwise causes bad things to happen.

[Gullible Jones]

As I thought, it turns out this is a bad idea:

Code: Select all

user@localhost:~$ pkexec su -
root@localhost:~# whoami
root

So yeah, do this if you're totally fed up with Consolekit breakage and don't care about having security worse than OotB Windows XP Home. Otherwise, don't.

Edit: if you just want automounting, use this:

Code: Select all

[Allow Automount]
Identity=unix-group:plugdev
Action=org.freedesktop.udisks.filesystem-mount
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Absolutely bonkers that this should be needed, but whatever.

[gradinaruvasile]

The thing is that sometimes .pkla files wouldnt work for me. But editing the .xml formatted configs (/usr/share/polkit-1/actions/org.freedesktop.*) and inserting there the allow_any tag it worked.

The issue comes from consolekit's new version. It seems these authentication issues arise if the graphical display manager is xdm or slim (or there is no graphical manager and startx is used).
Working gdm's: GDM3 (gnome), KDM (KDE), lightdm (DE independent). I would recommend lightdm for non Gnome/KDE DE's, it is really light and looks well.

[tgnWnfQK]

@Gullible Jones: Thank you very much for pointing to the "if you just want automounting, use this:" solution! It fixed my set up

Is there a bug pending for this behaviour, already?

[rw_norris]

Note that for the current (at time of writing) Debian Unstable has moved to udisks2

So now it's:

[Allow Automount]
Identity=unix-group:plugdev
Action=org.freedesktop.udisks2.filesystem-mount
ResultAny=yes
ResultInactive=yes
ResultActive=yes

for a .pkla type file.