Where Does Polkit Store Rules and Policies?
Polkit reads admin rules from /etc/polkit-1/rules.d with vendor defaults in /usr/share/polkit-1.
Last updated
Polkit authorizes privileged actions through JavaScript rules in /etc/polkit-1/rules.d. Files there sort lexically and can allow, deny, or require authentication per action. Vendor shipped defaults live separately in /usr/share/polkit-1 and lose to admin files.
Older .pkla files in /etc/polkit-1/localauthority still work on some distros but count as legacy. Debugging starts with polkit log output while reproducing the prompt. Test rules with a second account before locking yourself out.
Where Polkit stores this, by platform
/etc/polkit-1/rules.d
Admin .rules files in JavaScript evaluated in sort order. Vendor defaults in /usr/share/polkit-1 lose to these. Check journal output when a rule misfires.
Frequently asked questions
How do I allow a specific action without a password?
Add a .rules file returning allow for the action and subject match. Keep the match narrow to one group or binary. Verify from a fresh login before calling it done.
Why do edits under /usr/share keep vanishing?
Package upgrades overwrite vendor files there. Admin customizations belong in /etc/polkit-1/rules.d, which upgrades never touch. Move your rules and retest.
Notice an outdated path? Let us know.