polkit rule: determine if user is an admin?

Question

polkit is configured using rules files, written in javascript.

You write custom functions, and pass them as the argument to polkit.addRule(). When a polkit action is performed, the functions are called in order, until one returns a result. (Otherwise the defaults are used).

Your rule function is called with two parameters: the name of the action, and a subject object.

You can use subject.isInGroup("wheel") to test whether the user is in the "wheel" group.

The polkit defaults use a concept of whether a user is an "administrator" or not. What this concept means can be modified using polkit.addAdminRule(), in a somewhat weird way. The default for this varies between distributions. In some distributions, administrators are placed in the "wheel" group. In other distributions, the "sudo" group are considered to be administrators.

Is it possible to write a function for polkit.addRule() in a portable style, which tests whether the subject is in the distribution's administrator group, instead of hard-coding the "wheel" or "sudo" group?

Answer 1

It is not possible.

This is not a massively common type of security policy - whether for polkit or anything else. A lot of stuff either uses a group, or a polkit password prompt.

I've only noticed this type of policy being used for PackageKit. (I guess the administrator group is specified by the distribution, when it compiles PackageKit).