From 5e0c3907aa76d58637b855cecbaee1399a359595 Mon Sep 17 00:00:00 2001
From: zimward <zimward@zimward.moe>
Date: Thu, 18 Jun 2026 12:05:47 +0200
Subject: [PATCH] nixos/polkit: add RFC42 settings

Assisted-by: languagetool 6.6
---
 .../manual/release-notes/rl-2611.section.md    |  2 ++
 nixos/modules/security/polkit.nix              | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index a36490122096..160a67c48eec 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -48,4 +48,6 @@
 
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
+- `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index 360602d621b2..94237502160e 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -16,6 +16,8 @@ let
     ;
 
   cfg = config.security.polkit;
+
+  iniFmt = pkgs.formats.ini { };
 in
 
 {
@@ -30,6 +32,21 @@ in
 
     package = mkPackageOption pkgs "polkit" { };
 
+    settings = mkOption {
+      description = ''
+        Options for polkitd.
+        See {manpage}`polkitd.conf(5)` for available options.
+      '';
+      type = types.submodule {
+        freeformType = iniFmt.type;
+        options.Polkitd.ExpirationSeconds = lib.mkOption {
+          description = "Expiration timeout of authenticated sesssions.";
+          type = types.ints.positive;
+          default = 300; # current polkit upstream default
+        };
+      };
+    };
+
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [
@@ -154,6 +171,7 @@ in
       ${cfg.extraConfig}
     ''; # TODO: validation on compilation (at least against typos)
 
+    environment.etc."polkit-1/polkitd.conf".source = iniFmt.generate "polkitd.conf" cfg.settings;
     security.pam.services.polkit-1 = { };
 
     security.wrappers.pkexec = {