Services page doesn't take in account polkit rules

[dfgs]

Cockpit version: 0.117 release 3.fc34.1
OS: Fedora server 34 Kernel Linux 5.13.14-200.fc34.x86_64
Page: Services

Description:

• Given a basic user A, without admin rights
• Given a very permissive polkit rule (1-allow-all.rules)

polkit.addRule(function(action, subject) {
return polkit.Result.YES;
});

user A is now able to do some admin tasks in cockpit (ex change firewall rules), but he is not able to start/stop services. Cockpit asks admin privileges to manage services.

Rule examples in documentation doesn't work as well (https://cockpit-project.org/guide/latest/feature-systemd)

Note: user A is able to manage services from command line (without elevation)

[martinpitt]

Confirmed -- These UI actions currently query superuser.allowed which checks for general admin-ness. The actual API calls ought to work, as it uses superuser: try; but our superuser.allowed check does not check for specific polkit privileges.

[KKoukiou]

Closing in favor of the more generic issue #17346