nixos/polkit: modernize, make pkexec wrapper opt-in

[mweinelt]

The motivation here is that enabling polkit is required for run0, but at that point you don't want pkexec unless you need to.

I grepped for every service that touches security.polkit and if it's package source mentioned pkexec it got the opt in commit.

Is this a follow-up to #156858? You tell me!

cc @K900 for Plasma, because I have no idea where to grep for pkexec.
thanks @theCapypara for providing some info for GNOME already.

Tests run:

• nixosTests.gnome
• nixosTests.libvirtd
• nixosTests.rtkit
• nixosTests.startx
• nixosTests.udisks2

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.

Review dismissed automatically

[K900]

Actually sure looks like Plasma doesn't need it: https://github.com/search?q=org%3AKDE%20pkexec&type=code

(but the installer image still does, to launch Calamares)

[thefossguy]

For the COSMIC module:

-      enablePkexecWrapper = true;
+      # pkexec requires setting values of at least `XDG_RUNTIME_DIR` and `WAYLAND_DISPLAY`
+      # and these values are not sourced automatically on wayland-only sessions
+      # this can only be handled manually, AFAIK, like so:
+      # `env XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR WAYLAND_DISPLAY=$WAYLAND_DISPLAY pkexec $args`
+      # xwayland is the default, and a wayland-only session is an opt-in
+      # therefore, if the user has opted out of xwayland, let the user explicitly handle this
+      enablePkexecWrapper = lib.mkDefault cfg.xwayland.enable;

[LordGrimmauld]

nixpkgs/nixos/tests/lomiri.nix

Lines 670 to 672 in a04cdfd

	# Doing this here, since we need an in-session shell & separately starting a terminal again wastes time
	with subtest("polkit agent works"):
	machine.send_chars("pkexec touch /tmp/polkit-test\n")

So turns out lomiri expects pkexec, but it should work to just replace this by run0 (which also spawns a polkit agent window thingy)

Edit: oops, seems i was a second later than the push with that

[LordGrimmauld]

Alright. Ran the tests, the breaks i ran into all have either been fixed or were caused at some earlier time outside this PR. I agree with the approach and the motivation.

I do expect this to break some peoples system. I think this is acceptable and necessary in this case. I am happy with this PR, though i am not quite sure how trigger-happy i should be with the merge button here. First time i knowingly am approving something i expect will break quite some setups.

We got a go-ahead from cosmic, gnome, plasma afaict. Not sure who else we would need/want to wait for.

[LordGrimmauld]

Some more potential users:

• gamemode
  • https://github.com/search?q=repo%3AFeralInteractive%2Fgamemode%20pkexec&type=code

  • nixpkgs/nixos/modules/programs/gamemode.nix

    Lines 77 to 90 in a799d3e

    	# Use pkexec from the security wrappers to allow users to
    	# run libexec/cpugovctl & libexec/gpuclockctl as root with
    	# the the actions defined in share/polkit-1/actions.
    	#
    	# This uses a link farm to make sure other wrapped executables
    	# aren't included in PATH.
    	environment.PATH = lib.mkForce (
    	pkgs.linkFarm "pkexec" [
    	{
    	name = "pkexec";
    	path = "${config.security.wrapperDir}/pkexec";
    	}
    	]
    	);

• nixos/tests/input-remapper.nix haunted, feel free to ignore
• virtualization.vmware
  • closed source

  • nixpkgs/pkgs/by-name/vm/vmware-workstation/package.nix

    Lines 357 to 361 in 90adbfd

    	# Hardcoded pkexec hack
    	for lib in "lib/vmware/lib/libvmware-mount.so/libvmware-mount.so" "lib/vmware/lib/libvmwareui.so/libvmwareui.so" "lib/vmware/lib/libvmware-fuseUI.so/libvmware-fuseUI.so"
    	do
    	sed -i -e "s,/usr/local/sbin,/run/vmware/bin," "$out/$lib"
    	done

  • nixpkgs/nixos/modules/virtualisation/vmware-host.nix

    Line 19 in a799d3e

    (mkVmwareSymlink "pkexec")

[thefossguy]

I noticed that login in COSMIC was timing out. We have NixOS VM tests that handle session login (via the first-party greeter) and autologin. If in future a similar problem is encountered, I suggest you try to build all 4 nixosTests.cosmic* tests and see the logs yourself. Faster than booting into a scratch VM. :)

On that note, did you figure out why the login was timing out?

[thefossguy]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 530106 --extra-nixpkgs-config '{ allowBroken = true; allowUnfree = true; }' --additional-package nixosTests.cosmic-autologin-noxwayland --additional-package nixosTests.cosmic-noxwayland --additional-package nixosTests.cosmic --additional-package nixosTests.cosmic-autologin
Commit: 9bbf4c97b98a20880013c11086c9937a0383b778

---

aarch64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 4 tests built:

• nixosTests.cosmic
• nixosTests.cosmic-autologin
• nixosTests.cosmic-autologin-noxwayland
• nixosTests.cosmic-noxwayland

[thefossguy]

nixpkgs-review result

Generated using nixpkgs-review.

Command: nixpkgs-review pr 530106 --extra-nixpkgs-config '{ allowBroken = true; allowUnfree = true; }' --additional-package nixosTests.cosmic-autologin-noxwayland --additional-package nixosTests.cosmic-autologin --additional-package nixosTests.cosmic --additional-package nixosTests.cosmic-noxwayland
Commit: 9bbf4c97b98a20880013c11086c9937a0383b778

---

x86_64-linux

⏩ 2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

✅ 4 tests built:

• nixosTests.cosmic
• nixosTests.cosmic-autologin
• nixosTests.cosmic-autologin-noxwayland
• nixosTests.cosmic-noxwayland

[thefossguy]

Sorry about the noise. I ran the NixOS VM tests on this PR and they pass. The above review results are of this PR.

I have an open PR to refactor the tests and add a new test for polkit using pkexec. Created a new PR (#530915) with your changes on top of my changes and they pass there as well.

[LordGrimmauld]

Alright, lets do it. Some things probably will break, but considering this change is necessary and fixing the fallout is trivial, i see no good reason to delay this.