--- title: Why polkit (or, how to mount a disk on modern Linux) description: A deep-dive into why polkit (formerly PolicyKit) exists and how it works on modern Linux desktops. Using disk mounting as the central example, it explains why... canonical: https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why polkit (or, how to mount a disk on modern Linux) | daily.dev og:description: A deep-dive into why polkit (formerly PolicyKit) exists and how it works on modern Linux desktops. Using disk mounting as the central example, it explains why... og:url: https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n og:image: https://api.daily.dev/og/posts/zWMs1673N.png og:image:alt: Why polkit (or, how to mount a disk on modern Linux) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why polkit (or, how to mount a disk on modern Linux) **[Collabora Blog](https://daily.dev/sources/collabora)** · 11 min read · 0 upvotes · 0 comments ## Summary A deep-dive into why polkit (formerly PolicyKit) exists and how it works on modern Linux desktops. Using disk mounting as the central example, it explains why the kernel's coarse-grained permission model is insufficient for desktop use cases, why setuid helpers like mount(8) have limitations, and how D-Bus daemons like udisks2 delegate fine-grained authorization decisions to polkit. The post covers polkit's action model, its JavaScript-based policy configuration in /etc/polkit-1/rules.d, and how it enables configurable, context-aware security policies (e.g., distinguishing locally-present users from remote ones, seat-based access) without baking policy into the kernel or individual daemons. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does mounting a USB stick on Linux require a privileged daemon like udisks2 instead of doing it directly? Ordinary users cannot make arbitrary mount syscalls because that would allow privilege escalation (mounting filesystems with setuid executables) or denial of service (unmounting critical paths like /usr). The kernel enforces mechanism, not policy, so user-space must delegate to a privileged daemon like udisks2, which validates the request before performing the mount on the user's behalf. _Linux systems developers navigating privilege boundaries track udisks2 and polkit changes on daily.dev._ ### Where does polkit store its local security policy rules and what language are they written in? Polkit's local security policy is written in JavaScript and stored in /etc/polkit-1/rules.d for local overrides and /usr/share/polkit-1/rules.d for OS-vendor defaults. Older polkit versions used a plugin architecture with files under /etc/polkit-1/localauthority, but in practice everyone used the bundled local authority instead of writing custom plugins. _Developers configuring Linux desktop security policies find polkit rule discussions and updates on daily.dev._ ### How does udisks2 divide filesystem-mount actions when talking to polkit? udisks2 maps filesystem-mounting into four distinct polkit actions: org.freedesktop.udisks2.filesystem-mount (standard removable media), org.freedesktop.udisks2.filesystem-mount-fstab (fstab-listed devices), org.freedesktop.udisks2.filesystem-mount-system (system disks), and org.freedesktop.udisks2.filesystem-mount-other-seat (devices on a different seat). This lets polkit apply different authorization rules to each category without understanding disk hardware itself. _Engineers building Linux desktop or embedded platform stacks keep up with udisks2 and polkit developments on daily.dev._ ## Similar posts on daily.dev - [Tier list of Linux security mechanisms](https://daily.dev/posts/tier-list-of-linux-security-mechanisms-62renvfbz) · Lobsters · 3 upvotes · 0 comments - [Software sandboxing: The basics \(2025\)](https://daily.dev/posts/software-sandboxing-the-basics-2025--auazxdqh6) · Lobsters · 0 upvotes · 0 comments - [prizrak.me blog](https://daily.dev/posts/prizrak-me-blog-mgojl7ak4) · Hacker News · 2 upvotes · 0 comments - [A JavaScript developer's guide to Rails: Authorization with Pundit](https://daily.dev/posts/a-javascript-developer-s-guide-to-rails-authorization-with-pundit-fdknwhtaa) · RUBYLAND · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why polkit (or, how to mount a disk on modern Linux)","url":"https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n"},"datePublished":"2026-08-11T08:55:41.791Z","dateModified":"2026-08-11T09:29:48.659Z","description":"A deep-dive into why polkit (formerly PolicyKit) exists and how it works on modern Linux desktops. Using disk mounting as the central example, it explains why...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"Why polkit (or, how to mount a disk on modern Linux)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-polkit-or-how-to-mount-a-disk-on-modern-linux--zwms1673n#faq","mainEntity":[{"@type":"Question","name":"Why does mounting a USB stick on Linux require a privileged daemon like udisks2 instead of doing it directly?","acceptedAnswer":{"@type":"Answer","text":"Ordinary users cannot make arbitrary mount syscalls because that would allow privilege escalation (mounting filesystems with setuid executables) or denial of service (unmounting critical paths like /usr). The kernel enforces mechanism, not policy, so user-space must delegate to a privileged daemon like udisks2, which validates the request before performing the mount on the user's behalf. Linux systems developers navigating privilege boundaries track udisks2 and polkit changes on daily.dev."}},{"@type":"Question","name":"Where does polkit store its local security policy rules and what language are they written in?","acceptedAnswer":{"@type":"Answer","text":"Polkit's local security policy is written in JavaScript and stored in /etc/polkit-1/rules.d for local overrides and /usr/share/polkit-1/rules.d for OS-vendor defaults. Older polkit versions used a plugin architecture with files under /etc/polkit-1/localauthority, but in practice everyone used the bundled local authority instead of writing custom plugins. Developers configuring Linux desktop security policies find polkit rule discussions and updates on daily.dev."}},{"@type":"Question","name":"How does udisks2 divide filesystem-mount actions when talking to polkit?","acceptedAnswer":{"@type":"Answer","text":"udisks2 maps filesystem-mounting into four distinct polkit actions: org.freedesktop.udisks2.filesystem-mount (standard removable media), org.freedesktop.udisks2.filesystem-mount-fstab (fstab-listed devices), org.freedesktop.udisks2.filesystem-mount-system (system disks), and org.freedesktop.udisks2.filesystem-mount-other-seat (devices on a different seat). This lets polkit apply different authorization rules to each category without understanding disk hardware itself. Engineers building Linux desktop or embedded platform stacks keep up with udisks2 and polkit developments on daily.dev."}}]} ```