From e88efa73069adf9abd9b0e78d10a1367560728d2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 9 Jun 2026 22:29:49 +0200 Subject: [PATCH] nixos/polkit: make pkexec opt-in --- nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++ nixos/modules/security/polkit.nix | 2 ++ 2 files changed, 4 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 3697b3bb2e3e..3a00b506896f 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -28,6 +28,8 @@ - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use. +- `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in. + - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`. - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`. diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix index cc62f22df6bd..3e8b0a3924a7 100644 --- a/nixos/modules/security/polkit.nix +++ b/nixos/modules/security/polkit.nix @@ -26,6 +26,7 @@ in options.security.polkit = { enable = mkEnableOption "polkit"; + enablePkexecWrapper = mkEnableOption "the setuid pkexec wrapper"; package = mkPackageOption pkgs "polkit" { }; @@ -157,6 +158,7 @@ in security.pam.services.polkit-1 = { }; security.wrappers.pkexec = { + enable = cfg.enablePkexecWrapper; setuid = true; owner = "root"; group = "root";