polkitaddRule

polkitaddRule is a convenience utility provided by PolicyKit (polkit) that helps administrators add custom policy rules. It writes a short JavaScript rule snippet into a file in the policy rules directory used by the polkit daemon, making it easier to grant or restrict privileges for specific actions and subjects.

Rule files are typically stored under /etc/polkit-1/rules.d for local, system-wide custom rules, while distribution-provided defaults live in /usr/share/polkit-1/rules.d. Polkit reads all .rules files and applies their policies in order determined by the filenames, usually using numeric prefixes to establish precedence.

Usage is straightforward: polkitaddRule takes the rule content and saves it as a new rule file. An example invocation is:

polkitaddRule 'polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.udisks2.filesystem-mount-system" && subject.isInGroup("wheel")) { return polkit.Result.YES; } });'

The command typically runs with root privileges and writes the snippet to a new file such as 50-custom-rule.rules in the rules.d directory.

Rule syntax is JavaScript-based and uses the polkit global object. A rule defines a function(action, subject) and returns one of polkit.Result.YES, polkit.Result.NO, or other polkit results depending on the conditions evaluated (for example, matching action.id and subject properties).

Security and maintenance: incorrect rules can unintentionally elevate privileges, so test changes in a safe environment and keep rules narrowly scoped. If needed, modify or remove rules and be mindful that local /etc rules generally take precedence over defaults. See also PolicyKit, polkit, polkitd, and the rules.d directory.