blob: 5bd8e3305d1fb117f77659be195369fba63241a5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
{lib, ...}: let
defaultDenyRule = ''
polkit.addRule(function(action, subject) {
// Log denied actions for debugging
polkit.log("DENY: action=" + action.id + " user=" + subject.user);
return polkit.Result.NO;
});
'';
run0Rules = ''
polkit.addRule(function(action, subject) {
if (subject.isInGroup("wheel") && action.id === "org.freedesktop.systemd1.manage-units") {
return polkit.Result.AUTH_ADMIN_KEEP;
}
});
'';
networkRules = ''
polkit.addRule(function(action, subject) {
// Only allow network modifications for wheel group (admins)
if (action.id.startsWith("org.freedesktop.NetworkManager.") &&
subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
// Allow reading network status for all users
if (action.id == "org.freedesktop.NetworkManager.network-control" ||
action.id == "org.freedesktop.NetworkManager.settings.modify.system") {
if (subject.isInGroup("wheel")) {
return polkit.Result.YES;
}
return polkit.Result.NO;
}
return polkit.Result.NOT_HANDLED;
});
'';
powerRules = ''
polkit.addRule(function(action, subject) {
if (action.id.match("org.freedesktop.login1.")) {
return polkit.Result.YES;
}
});
'';
bluetoothRules = ''
polkit.addRule(function(action, subject) {
// Allow users to manage bluetooth devices
if (action.id.startsWith("org.bluez.") &&
subject.local && subject.active) {
return polkit.Result.YES;
}
return polkit.Result.NOT_HANDLED;
});
'';
in {
security = {
polkit = {
enable = true;
adminIdentities = ["unix-group:wheel"];
extraConfig = lib.concatStringsSep "\n\n" [
run0Rules
networkRules
powerRules
bluetoothRules
defaultDenyRule
];
};
};
}
|
