nixos/polkit: add RFC42 settings (#532954)

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -52,4 +52,6 @@
 
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
+- `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/security/polkit.nix

@@ -16,6 +16,8 @@ let
     ;
 
   cfg = config.security.polkit;
+
+  iniFmt = pkgs.formats.ini { };
 in
 
 {
@@ -30,6 +32,21 @@ in
 
     package = mkPackageOption pkgs "polkit" { };
 
+    settings = mkOption {
+      description = ''
+        Options for polkitd.
+        See {manpage}`polkitd.conf(5)` for available options.
+      '';
+      type = types.submodule {
+        freeformType = iniFmt.type;
+        options.Polkitd.ExpirationSeconds = lib.mkOption {
+          description = "Expiration timeout of authenticated sesssions.";
+          type = types.ints.positive;
+          default = 300; # current polkit upstream default
+        };
+      };
+    };
+
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [
@@ -154,6 +171,7 @@ in
       ${cfg.extraConfig}
     ''; # TODO: validation on compilation (at least against typos)
 
+    environment.etc."polkit-1/polkitd.conf".source = iniFmt.generate "polkitd.conf" cfg.settings;
     security.pam.services.polkit-1 = { };
 
     security.wrappers.pkexec = {
@@ -173,4 +191,7 @@ in
     users.groups.polkituser = { };
   };
 
+  meta = {
+    maintainers = with lib.maintainers; [ zimward ];
+  };
 }