docs: reworked the policykit patch submitted by Patrick Dignan

Tweaked the PolicyKit documentation improvement patch submitted
by Patrick Dignan.

Additionally, removed the reference to PolicyKit.conf, which is
no longer used by PolicyKit, plus added a link to the expanded
PolicyKit example page on the wiki.

diff --git a/docs/auth.html.in b/docs/auth.html.in
index ab6c3e94527277f3a0462e6b3455881489cce007..13731eb766fa331b3d23a8696af1cfc4a591e1b7 100644 (file)
--- a/docs/auth.html.in
+++ b/docs/auth.html.in
@@ -65,29 +65,27 @@ auth, but does not require that the client application ultimately run as root.
 Default policy will still allow any application to connect to the RO socket.
 </p>
     <p>
-The default policy can be overridden by the administrator using the PolicyKit
-master configuration file in <code>/etc/PolicyKit/PolicyKit.conf</code>. The
-<code>PolicyKit.conf(5)</code> manual page provides details on the syntax
-available. The two libvirt daemon actions available are named <code>org.libvirt.unix.monitor</code>
-for the RO socket, and <code>org.libvirt.unix.manage</code> for the RW socket.
-</p>
+The default policy can be overridden by creating a new policy file in the
+local override directory <code>/etc/polkit-1/localauthority/50-local.d/</code>.
+Policy files should have a unique name ending with .pkla.  Using reverse DNS
+naming works well. Information on the options available can be found by
+reading the pklocalauthority man page. The two libvirt daemon actions
+available are named <code>org.libvirt.unix.manage</code> for full management
+access, and <code>org.libvirt.unix.monitor</code> for read-only access.
+    </p>
     <p>
-As an example, to allow a user <code>fred</code> full access to the RW socket,
-while requiring <code>joe</code> to authenticate with the admin password,
-would require adding the following snippet to <code>PolicyKit.conf</code>.
-</p>
-    <pre>
-  &lt;match action="org.libvirt.unix.manage"&gt;
-    &lt;match user="fred"&gt;
-      &lt;return result="yes"/&gt;
-    &lt;/match&gt;
-  &lt;/match&gt;
-  &lt;match action="org.libvirt.unix.manage"&gt;
-    &lt;match user="joe"&gt;
-      &lt;return result="auth_admin"/&gt;
-    &lt;/match&gt;
-  &lt;/match&gt;
-</pre>
+As an example, this gives the user <code>fred</code> full management access:
+    </p>
+<pre>[Allow fred libvirt management permissions]
+Identity=unix-user:fred
+Action=org.libvirt.unix.manage
+ResultAny=yes
+ResultInactive=yes
+ResultActive=yes</pre>
+    <p>
+Further examples of PolicyKit setup can be found on the
+<a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">wiki page</a>.
+    </p>
     <h3><a name="ACL_server_username">Username/password auth</a></h3>
     <p>
 The plain TCP socket of the libvirt daemon defaults to using SASL for authentication.