F44 Change Proposal: Atomic Desktops: Drop compatibility for pkla polkit rules [SelfContained]

Project Discussion Change Proposals
, ,
1

Atomic Desktops: Drop compatibility for pkla polkit rules

Wiki

Announced

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Summary :open_book:

Remove support for deprecated pkla polkit rules from all Fedora Atomic Desktops. All other ostree/bootable container images dropped it already.

Owner :open_book:

Detailed Description :open_book:

Compatibility support for the legacy pkla format of pokit rules has been moved to Recommends in f306ce1 polkit hogs cpu on every login/logout which landed in Fedora 41. At the exception of the Fedora Atomic Desktops, all ostree/bootable container systems disable recommends thus they dropped the polkit-pkla-compat package with the update to Fedora 41 (see for Fedora CoreOS). This change does it for the Atomic Destkops.

Feedback :open_book:

This was initially suggested in F37: Make pkexec and pkla-compat optional which was rejected at the time (see discussion in Change proposal: Make pkexec and pkla-compat optional).

Since then:

  • the polkit-pkla-compat package has been made optional by the polkit maintainer
  • this change reduces the scope to Atomic Desktops only where we currently don’t include any package using pkla legacy rules and leaves pkexec as is

Users that still want to use pkla rules can layer the polkit-pkla-compat package on their systems or build derived images.

However, it’s likely that the ecosystem has moved on at this point:

Benefit to Fedora :open_book:

Remove support for obsolete configuration files for a privileged component of the OS and align Atomic Desktops will other ostree/bootable container images.

Scope :open_book:

  • Proposal owners: Will exclude polkit-pkla-compat from Atomic Desktops
  • Other developers: Convert remaining pkla rules to the new format as needed for the remaining packages.
  • Release engineering: N/A
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with the Fedora Strategy: General improvement for Atomic Desktops

Upgrade/compatibility impact :open_book:

Systems that still rely on pkla rules will need to have those rules converted to the new polkit format.

Early Testing (Optional) :open_book:

Do you require ‘QA Blueprint’ support? N

How To Test :open_book:

Remove the polkit-pkla-compat locally or from the container image. Verify normal operation of privileged operations.

User Experience :open_book:

Nothing specific to note.

Dependencies :open_book:

None.

Contingency Plan :open_book:

  • Contingency mechanism: (What to do? Who will do it?) Revert the change. The Atomic Desktops maintainers will do it.
  • Contingency deadline: N/A (not a System Wide Change) but Beta/Final freeze
  • Blocks release? N/A (not a System Wide Change) but No, can be easily reverted

Documentation :open_book:

See release notes.

Release Notes :open_book:

Support for the legacy pkla format for polkit rules has been removed from all Fedora Atomic Desktops. If you have applications that still rely on those rules, you can re-install the package (by overlaying it or by building your own container image).

Last edited by @siosm 2026-01-26T11:36:26Z

Last edited by @siosm 2026-01-26T11:36:26Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

Does Atomic Desktop include the libvirt package ? That still ships pkla files for configuring auth policy for access to libvirt daemons.

4

We do not include the libvirt package in any Atomic Desktops but it’s indeed a commonly layered package. Maybe packages using pkla polkit rules should start depending on polkit-pkla-compat.

5

Hum, where is this rule? I’ve only found new polkit rules: https://src.fedoraproject.org/rpms/libvirt/blob/rawhide/f/libvirt.spec#_2111

6

Sorry, ignore me. I’m getting confused between the PKLA files and the policy files.

1 Like
7

This change proposal has now been submitted to FESCo with ticket #3553 for voting.

To find out more, please visit our Changes Policy documentation.