On Sun 08 Apr 2018 at 18:50:50 +0200, Mikhail Morfikov wrote: [...] > I've seen that people use something similar to the following rule: > ----------------------------------------- > /etc/polkit-1/localauthority/50-local.d/20-udisks2.pkla > ----------------------------------------- > [Allow morfik to mount devices] > Identity=unix-user:morfik; > Action=org.freedesktop.udisks2.*; > ResultAny=no > ResultInactive=no > ResultActive=yes > ----------------------------------------- > And this is a little bit better than the previous solution because it gives me > the ability to specify users/groups , and only the parties can do some > actions, > like for instance mounting a device (to be viewed via pkaction). The problem > here is that I can't choose which devices should be accessed by the identity > -- > I'm able only to set which actions can be allowed. > > In the polkit manual[1], there's an example that would do exactly what I want. > I'm speaking about this: > ---------------------------------------------------------------------- > polkit.addRule(function(action, subject) { > if (action.id.indexOf("org.freedesktop.udisks2.") == 0 && > action.lookup("drive.vendor") == "SEAGATE" && > action.lookup("drive.model") == "ST3300657SS" && > subject.isInGroup("engineers")) { > return polkit.Result.YES; > } > } > }); > ---------------------------------------------------------------------- > I bet there's also probably something like: > action.lookup("drive.serial") > but I don't really know how to get those values yet. > > Anyways, I don't think the above rule can be used with the polkit version > that's > currently in Debian, which is 0.105 . That rule can be used when you deal with > 0.106+ , and 0.113 is available in the experimental branch, but unfortunately > it > can't be installed due to dependencies problems. > > Is there a way to convert that rule somewhat or is this functionality specific > to the polkit v0.106+? Or maybe is there another way to achieve what I want?
Converting from the JavaScript to the old style? Probably not. Converting the other way? Maybe. https://lists.debian.org/debian-user/2016/01/msg00209.html -- Brian.