Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nixos/polkit: remove root from adminIdentities #75343

Merged
merged 1 commit into from Dec 11, 2019
Merged

nixos/polkit: remove root from adminIdentities #75343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
10 changes: 10 additions & 0 deletions nixos/doc/manual/release-notes/rl-2003.xml
View file
Open in desktop
Expand Up @@ -225,6 +225,16 @@
The fourStore and fourStoreEndpoint modules have been removed.
</para>
</listitem>
<listitem>
<para>
Polkit no longer has the user of uid 0 (root) as an admin identity.
We now follow the upstream default of only having every member of the wheel
group admin privileged. Before it was root and members of wheel.
worldofpeace marked this conversation as resolved.
Show resolved Hide resolved
The positive outcome of this is pkexec GUI popups or terminal prompts
will no longer require the user to choose between two essentially equivalent
choices (whether to perform the action as themselves with wheel permissions, or as the root user).
</para>
</listitem>
</itemizedlist>
</section>

Expand Down
5 changes: 2 additions & 3 deletions nixos/modules/security/polkit.nix
View file
Open in desktop
Expand Up @@ -42,15 +42,14 @@ in

security.polkit.adminIdentities = mkOption {
type = types.listOf types.str;
default = [ "unix-user:0" "unix-group:wheel" ];
default = [ "unix-group:wheel" ];
example = [ "unix-user:alice" "unix-group:admin" ];
description =
''
Specifies which users are considered “administrators”, for those
actions that require the user to authenticate as an
administrator (i.e. have an <literal>auth_admin</literal>
value). By default, this is the <literal>root</literal>
user and all users in the <literal>wheel</literal> group.
value). By default, this is all users in the <literal>wheel</literal> group.
'';
};

Expand Down