Ubuntu – How to non-admin users connect to Wi-Fi networks

network-managerpolicykitxubuntu

I'm trying to configure PolicyKit so that other users are allowed to configure Wi-Fi connections, but my changes don't seem to bring any results at all.

When a non-admin user tries to connect to a new Wi-Fi, I get the System policy prevents modification of network settings for all users box. It asks for the admin user's password.

Ok – that one goes via PolicyKit, so I thought I'll just change the configuration for action org.freedesktop.NetworkManager.settings.modify.system. I created a file /etc/polkit-1/localauthority.conf.d/52-wifi-management.conf with content:

[Wifi management]
Identity=unix-group:netdev
Action=org.freedesktop.NetworkManager.*
ResultAny=no
ResultInactive=no
ResultActive=yes

and added the user to the netdev group.

But that didn't make any difference. There also doesn't seem to be much possibility for debugging the auth process. What's going wrong? How do I make it work as I expect?

Best Answer

Your configuration is correct, but local policy files should be placed inside /etc/polkit-1/localauthority/50-local.d/ and the file extension must be .pkla.

To solve your problem:

sudo mv /etc/polkit-1/localauthority.conf.d/52-wifi-management.conf /etc/polkit-1/localauthority/50-local.d/52-wifi-management.pkla

Related Solutions

Ubuntu – How to set the Software Center to install software for non-root users

You can modify the PolicyKit permissions to allow the users to access the aptdaemon backend that Software Centre uses.

dpkg --listfiles aptdaemon shows that /usr/share/polkit-1/actions/org.debian.apt.policy is the file specifying the actions possible on the aptdaemon backend.

Looking in that file, the < action id=""> tags specify the possible actions. You'd probably want org.debian.apt.install-packages to allow users to install new packages from the archive, and org.debian.apt.update-cache to allow users to update the package lists.

See man pklocalauthority which documents how to set local permissions on PolicyKit actions. Putting the following into /etc/polkit-1/localauthority/50-local.d/10-allow-users-to-install.pkla will allow any user logged in to the local machine to install packages after typing their own password (even when they're not in the admin group) and to update the package cache without typing any password.

[Untrusted Install]
Action=org.debian.apt.install-or-remove-packages
ResultyAny=no
ResultInactive=no
ResultActive=auth_self

[Untrusted Update]
Action=org.debian.apt.update-cache
ResultAny=no
ResultInactive=no
ResultActive=yes

Ubuntu – polkit: disable all users except those in group wheel

I would try the following .pkla

[First disable all users]
Identity=unix-user:*
Action=*
ResultActive=no
ResultInactive=no
ResultAny=no

[Then enable wheel group]
Identity=unix-group:wheel
Action=*
ResultActive=auth_admin
ResultInactive=no
ResultAny=no

in conjunction with a modification of the AdminIdentities, configured in a file under /etc/polkit-1/localauthority.conf.d/.
I have the following two files

50-localauthority.conf

[Configuration]
AdminIdentities=unix-user:0

and

51-ubuntu-admin.conf

[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

The second one override the first, and force to use sudo (and the old admin) group. Remove the second file and you are leaved with a root password request.