Why?
My services are started via proper unit files or init scripts. I have no need for regular users to do anything special on my servers beyond su
. I am specifically looking for a way to completely shut down polkit without it starting up on it's own when other services are restarted.
I foresee a problem explaining this to auditors in our PCI environment as well. We have to describe the purpose of each service. We do not have a legit use case for polkit in a PCI environment.
Additional note: I did not install polkit. These servers have a very minimal install around 670MB on / It was a systemd update that appears to have installed polkit and the spec apparently has dependencies to all systemd managed services. Once it is installed, I have to rebuild the machine to remove it, just like trying to remove nss
once you install it. My concern is that if I force the unstall, it may have left files that will trip up systemd that assumes it is there.
What I have tried:
Create /etc/polkit-1/rules.d/99-deny-all.rules
with
polkit.addRule(function(action, subject) {
return polkit.Result.YES;
});
Then
systemctl daemon-reload && systemctl daemon-reexec
This does nothing, /usr/lib/polkit-1/polkitd --no-debug
continues to start when other services under systemd are restarted.
[ Update ] As Alexander mentioned, restarting polkit will apply the settings to polkit itself and that is good, but I am looking for a way to tell polkit to not start that does not break other services.
[ update 2 ] This may actually prevent some services from re-starting correctly.
Mask or disable the service:
This causes other services to hang on startup and shutdown, waiting for polkit.
Edit /usr/share/dbus-1/sstem-services/org.freedesktop.PolicyKit1.service
with:
[snip]
Exec=/bin/false
[snip]
Then
systemctl daemon-reload && systemctl daemon-reexec
This does nothing, /usr/lib/polkit-1/polkitd --no-debug
continues to start when other services under systemd are restarted.
I have read the man pages a couple times. It's probably something really simple I am missing. My preference would be for a method that persists after systemd package updates.
The end goal I am looking for is for polkit.service to not start when other daemons are restarted, such as unbound, bind, dhcp, etc.