From d9bf382cadd49163245d2723ab62b8be5183d65f Mon Sep 17 00:00:00 2001 From: r-vdp Date: Sun, 31 May 2026 22:33:33 +0300 Subject: [PATCH] nixos/fwupd: allow fwupd-refresh user to refresh metadata via polkit Upstream's intended bypass is TrustedUids in fwupd.conf, but on NixOS the fwupd-refresh uid is allocated at activation time and is not known during evaluation. Add a polkit rule keyed on the user name instead. --- nixos/modules/services/hardware/fwupd.nix | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix index 1c059bf39e64..df674d569fab 100644 --- a/nixos/modules/services/hardware/fwupd.nix +++ b/nixos/modules/services/hardware/fwupd.nix @@ -202,8 +202,8 @@ in systemd = { packages = [ cfg.package ]; - # fwupd-refresh expects a user that we do not create, so just run with DynamicUser - # instead and ensure we take ownership of /var/lib/fwupd + # The upstream unit runs as User=fwupd-refresh; ensure it can take + # ownership of /var/lib/fwupd. services.fwupd-refresh.serviceConfig = { StateDirectory = "fwupd"; # Better for debugging, upstream sets stderr to null for some reason.. @@ -219,7 +219,21 @@ in }; users.groups.fwupd-refresh = { }; - security.polkit.enable = true; + security.polkit = { + enable = true; + # fwupd-refresh.service has no seat, so polkit denies these actions. + # Upstream's TrustedUids needs a static uid which we only allocate at + # activation time, so grant access via a rule on the user name instead. + extraConfig = '' + polkit.addRule(function(action, subject) { + if ((action.id == "org.freedesktop.fwupd.get-remotes" || + action.id == "org.freedesktop.fwupd.refresh-remote") && + subject.user == "fwupd-refresh") { + return polkit.Result.YES; + } + }); + ''; + }; }; meta = {