From 498aab6ea8d5c7bca2a5420da5f70ebbafa9ee2c Mon Sep 17 00:00:00 2001
From: zimward <zimward@zimward.moe>
Date: Thu, 18 Jun 2026 14:24:32 +0200
Subject: [PATCH] nixos/run0: add options for persistent authentication

Co-authored-by: Grimmauld <soeren@benjos.de>
Assisted-by: languagetool 6.6
---
 .../manual/release-notes/rl-2611.section.md   |  2 ++
 nixos/modules/security/run0.nix               | 32 +++++++++++++++----
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 331b6a919479..c7a615694fe1 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -50,6 +50,8 @@
 
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
+- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
diff --git a/nixos/modules/security/run0.nix b/nixos/modules/security/run0.nix
index 295215aa5a0a..478fae3db67d 100644
--- a/nixos/modules/security/run0.nix
+++ b/nixos/modules/security/run0.nix
@@ -13,6 +13,7 @@ let
     mkOption
     mkPackageOption
     mkAliasOptionModule
+    optionalString
     ;
 
   cfg = config.security.run0;
@@ -21,6 +22,12 @@ in
   options.security.run0 = {
     enable = mkEnableOption "support for run0";
 
+    persistentAuth.enable = mkEnableOption ''
+      persistent authentication for sessions.
+      Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
+    '';
+    persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
+
     wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
@@ -67,13 +74,24 @@ in
 
       security.polkit = {
         enable = true;
-        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
-          polkit.addRule(function(action, subject) {
-            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-              return polkit.Result.YES;
-            }
-          });
-        '';
+        extraConfig = lib.concatLines [
+          (optionalString (!cfg.wheelNeedsPassword) ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+              }
+            });
+          '')
+          (optionalString cfg.persistentAuth.enable ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
+                optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
+              }) {
+                return polkit.Result.AUTH_ADMIN_KEEP;
+              }
+            });
+          '')
+        ];
       };
 
       environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;