Overview
Polkit is a rules based utility to allow non privileged users to perform system administration. Systemd supports polkit. This document is intended for system engineers to grant select administrative permissions to non-privilege users.
Audience
ITS Staff
Procedure
Operation
Rules files are javascript and stored in /etc/polkit-1/rules.d. In short, during an administrative attempt, the files are executed to test if the current user in the current context is allowed to perform the function. A polkit rule returns polkit.Result.YES explicitly if the function is allowed. In practice, engineers will want to search up a suitable polkit script for a task to start implementing their own rules. Tuning a script for a specific situation will be easier than writing one from scratch.
Example:
In /etc/polkit-1/rules.d:
This script implements the rule that user tomcat is allowed to manage,start,stop and restart service jenkins-agent.
Ansible
CCBC's Ansible playbook "allow_user_service_control" uses a "j2" script which is a template for creating the rules file. The reason for this is to allow Ansible to specify the user and service in the rules script.