Skip to content

fix(polkit): use /etc/polkit-1/actions for policy on immutable distros#1536

Merged
tdewey-rpi merged 1 commit into
raspberrypi:mainfrom
4RH1T3CT0R7:dev/4rh1t3ct0r/fix-polkit-immutable-distros
Mar 6, 2026
Merged

fix(polkit): use /etc/polkit-1/actions for policy on immutable distros#1536
tdewey-rpi merged 1 commit into
raspberrypi:mainfrom
4RH1T3CT0R7:dev/4rh1t3ct0r/fix-polkit-immutable-distros

Conversation

@4RH1T3CT0R7

@4RH1T3CT0R7 4RH1T3CT0R7 commented Mar 3, 2026

Copy link
Copy Markdown
Contributor
  • On immutable Linux distros (Fedora Silverblue, openSUSE Kalimba, etc.), /usr is mounted read-only, so writing polkit policy files to /usr/share/polkit-1/actions/ fails silently
  • Changed polkit policy path to prefer /etc/polkit-1/actions/ (local override dir, writable on immutable distros) with fallback to /usr/share/polkit-1/actions/ (vendor dir)
  • Both directories are searched when checking for existing policies, so policies installed at either location are found
  • If neither directory exists, creates /etc/polkit-1/actions/ with parent (running as root)

Closes #1413

On immutable Linux distros (Fedora Silverblue, openSUSE Kalimba, etc.),
/usr is mounted read-only, so writing polkit policy files to
/usr/share/polkit-1/actions/ fails. Per the polkit specification,
/etc/polkit-1/actions/ is the correct location for locally-installed
policy overrides.

Change the polkit policy path to prefer /etc/polkit-1/actions/ (writable
local override dir) with fallback to /usr/share/polkit-1/actions/ (vendor
dir). Both directories are searched when checking for existing policies.

Closes raspberrypi#1413
@tdewey-rpi tdewey-rpi force-pushed the dev/4rh1t3ct0r/fix-polkit-immutable-distros branch from 4aee478 to 7353138 Compare March 6, 2026 11:34
@tdewey-rpi tdewey-rpi merged commit 1aef52f into raspberrypi:main Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: Cannot save custom polkit action under /usr which is readonly

2 participants