polkitfix.md

How to Add Multiple Users in a Single Polkit Rule

Create a new file in the /etc/polkit-1/rules.d/ directory, for example, 50-pcsc-multiple-users.rules.

Use the following JavaScript code, replacing "user1", "user2", and "user3" with the actual usernames of the individuals who need access. You can add as many users as you need.

polkit.addRule(function(action, subject) {
  if (action.id == "org.debian.pcsc-lite.access_pcsc" && (subject.user == "user1" || subject.user == "user2" || subject.user == "user3")) {
    return polkit.Result.YES;
  }
});


polkit.addRule(function(action, subject) {
  if (action.id == "org.debian.pcsc-lite.access_pcsc" && subject.isInGroup("pcsc-users")) {
    return polkit.Result.YES;
  }
});

polkit.addRule(function(action, subject) {
  if (action.id == "org.debian.pcsc-lite.access_pcsc" && (subject.isInGroup("group1") || subject.isInGroup("group2") || subject.isInGroup("group3"))) {
    return polkit.Result.YES;
  }
});

The || operator in the code acts as an "OR" condition. This tells the system: "If the user is user1 OR user2 OR user3, then grant permission."

After creating and saving the file, restart the pcscd service to apply the new rule:

sudo systemctl restart pcscd.service

Disadvantages of This Approach

While this method works, it's not as easy to maintain.

• Scalability: If you need to add or remove a user, you must manually edit this file. If you have dozens of users, this becomes tedious and prone to errors.
• Centralized Management: This method doesn't allow for centralized management of permissions. If you were to grant access to another service or device in the future, you'd have to create a new list of users for that service as well, while a group-based system would just require adding a single line to the rule.

For these reasons, the group method is generally recommended for managing multiple users. However, for a small, static number of users, this method is a perfectly valid solution.