@xerz
> welp, Polkit exists because the kernel's policy system (accounts, filesystem permissions and cgroups) ain't enough

what can't you do with that?

my vague feeling is that in 99% of the cases you can solve these things like this (modify as needed):

add a group, add an entry to sudo/doas to allow this group running a command as root without password. add respective users to group. have your stuff call the command via sudo/doas.

> but anyway, I meant "Linux" as in "community-developed Linux-based distributions"

blame polkit if polkit is to blame, please. the kernel folks have their hands full keeping that shit out of their code (e.g. "kdbus").

@bonifartius shouldn't be hard to see that Polkit allowing to orchestrate policies based on actions to configure for users that can be authenticated from any local or remote account is much more flexible than binaries with only TTY text and untyped binary input — which can only be restricted to such a level by each action in Dbus/Polkit becoming its own binary, in turn requiring to create and manage their own users and groups

@xerz this sounds like a sales pitch, but is still missing examples of what i can't do with the kernel api. i can authenticate remote accounts with ssh. sudo policies and users can be created during package installation.

it is no surprise that if one builds windows like things one gets the same set of problems.

@xerz @bonifartius I mean I do agree that this kind of stuff really shouldn't.

But if there's one thing I've learned after years with computers, it's that other platforms like Windows probably have just as many issues, except they're not publicly acknowledged, because PR

@quad @bonifartius I mean, duh? That just means they all need improving, not implying Linux is worse than anyone else at all