PKLA-ADMIN-IDENTIT(8)

✨ PKLA-ADMIN-IDENTITIES ✨

okay bestie, welcome to pkla-admin-identities(8) — the manual page for the little helper that spills the tea on which users your polkit(8) setup considers administrators 👑

---

🌸 NAME 🌸

pkla-admin-identities — list the polkit administrators that are configured through pklocalauthority 💖

---

🦋 SYNOPSIS 🦋

pkla-admin-identities [--help]

pkla-admin-identities [--config-path config-path]

---

💅 DESCRIPTION 💅

So, pkla-admin-identities reads the config files described below and figures out which users polkit(8) counts as administrators — and it does this using a non-JavaScript config file format, which is also described below. no cap 🫶

Note: the whole "who counts as an administrator" question is actually driven by JavaScript rules, as laid out in polkit(8). pkla-admin-identities gets called by a JavaScript rule file named 49-polkit-pkla-compat.rules; other JavaScript rules with a higher priority may also exist, so the pkla-admin-identities configuration might not actually be the final say in what polkit(8) decides. it's giving "just one voice in the group chat" 😭

The ordering of the JavaScript rule files and the ordering of the pkla-admin-identities configuration files are not integrated — they use totally different rules. The pkla-admin-identities configuration evaluation happens at a single point within the JavaScript rule evaluation order. periodt.

pkla-admin-identities is an internal helper program of pkla-polkit-compat. You really shouldn't need to run it directly, unless you're doing some debugging detective work 🔍

Config is read from files with a .conf extension in the /etc/polkit-1/localauthority.conf.d directory. Every file gets read in lexicographical order (using the C locale), which means later files can override earlier ones. The file 50-localauthority.conf holds the settings provided by the OS vendor. Users and 3rd party packages can drop in configuration files with a priority higher than 60 to change the defaults.

The config file format is simple, bestie. Each configuration file is a key file (also commonly known as an ini file) with a single group called [Configuration]. Only a single key, AdminIdentities, is read. The value of this key is a semi-colon separated list of identities that can be used when administrator authentication is required. Here's the identity tea:

• users are specified by prefixing the user name with unix-user:
• groups of users are specified by prefixing with unix-group:
• netgroups of users are specified with unix-netgroup:

See the section called “EXAMPLE” for an example of a configuration file 👀

pkla-admin-identities outputs the resulting configuration of administrator identities, one identity per line, using the same format (including e.g. the unix-user: prefix). And if no administrator identities are configured in the above-described configuration files, the output will be empty. nothing. zero. void. 💀

---

🎀 OPTIONS 🎀

• -h, --help — write a summary of the available options to standard output and exit successfully. iconic behavior fr fr ✨
• -c, --config-path=config-path — search for configuration files in config-path instead of the default /etc/polkit-1/localauthority.conf.d. go wherever you want queen 🦋

---

🌈 EXIT STATUS 🌈

pkla-admin-identities exits with 0 on success (even if there are no administrator identities — yes, empty is still a success, we love a supportive program 💖), and a non-zero status on error.

---

🍓 FILES 🍓

• /etc/polkit-1/localauthority.conf.d — default directory containing configuration files. the home base 🏠

---

🧚 EXAMPLE 🧚

The following .conf file

[Configuration]
AdminIdentities=unix-group:staff

specifies that any user in the staff UNIX group can be used for authentication when administrator authentication is needed. This file would typically be installed in the /etc/polkit-1/localauthority.conf.d directory and given the name 60-desktop-policy.conf to ensure that it is evaluated after the 50-localauthority.conf file shipped with pkla-polkit-compat. order matters, bestie, it's giving line drama 💅

If the local administrator wants to override this (suppose 60-desktop-policy.conf was shipped as part of the OS) he can simply create a file 99-my-admin-configuration.conf with the following content

[Configuration]
AdminIdentities=unix-user:lisa;unix-user:marge

to specify that only the users lisa and marge can authenticate when administrator authentication is needed. just the two of them, no plus-ones 🙈

---

👑 AUTHOR 👑

Written by David Zeuthen <davidz@redhat.com> with a lot of help from many others. Adapted by Miloslav Trmač <mitr@redhat.com>. legends, honestly 🌟

---

💜 SEE ALSO 💜

polkit(8)

---

and that's the whole page, bestie!! 🫶 this was polkit-pkla-compat, from May 2013 — yeah it's an elder but it still ate 💅✨ bye mwah 😘