polkit prompt shows multiple users

[nh2]

On 19.09, when you pkexec on NixOS with default settings and your user being part of unix group wheel, you get a prompt whether you want to get admin capabilities via your user or the root user.

This is somewhat inconvenient, because you always have to choose the user by clicking on it (or pressing a number key in the terminal); on other systems like Ubuntu, it somehow figures out that these two are identical and prompts immediately for the password.

In

nixpkgs/nixos/modules/security/polkit.nix

Line 45 in a7aa5db

default = [ "unix-user:0" "unix-group:wheel" ];

we have both [ "unix-user:0" "unix-group:wheel" ] as the default.

Setting it to [ "unix-group:wheel" ] only generates only 1 prompt.

What is the first one good for, should we just remove it from the default, given that adding users to the wheel is the default way of "making them admins"?

Or do we somehow want to depart from the unix group approach of making people admins?

[worldofpeace]

These are the patches used in ubuntu and also debian

• https://git.launchpad.net/ubuntu/+source/policykit-1/tree/debian/patches

The default upstream for addAdminRule is

polkit.addAdminRule(function(action, subject) {
  return ["unix-group:wheel"];
});

So seemingly ubuntu and many other distro's aren't doing what we are doing.

We use

polkit.addAdminRule(function(action, subject) {
  return ["unix-user:0", "unix-group:wheel"];
});

for probably a specific reason at some point in time.

[worldofpeace]

It appears to have been this way for a long time

• 7980c71

My recommendation is we just use the default way it is in polkit.
As far as I can tell, given that adding users to the wheel is the default way of "making them admins" is how it's done in NixOS.

[nh2]

These are the patches used in ubuntu and also debian

Right, most notably https://git.launchpad.net/ubuntu/+source/policykit-1/tree/debian/patches/05_revert-admin-identities-unix-group-wheel.patch?id=e82a9d8125f9d70cea47044d2fb4637ff6305725

which does

-AdminIdentities=unix-group:wheel
+AdminIdentities=unix-user:0

saying

On Red Hat derivatives, every member of group 'wheel' is necessarily privileged. On Debian derivatives, there is no wheel group, and gid 0 (root) is not used in this way. Change the default rule to consider uid 0 to be privileged, instead.

My recommendation is we just use the default way it is in polkit.

Seems reasonable to me as well