Update in Debian:
- Do not create an Unlock method.
- Do a sync non-user-interactive authorization check for SetValue only.
- More checks and memory management.
- Call action org.gnome.displaymanager.settings.set instead of .write, .set
  is more used in other actions.

--- a/common/gdm-settings.c
+++ b/common/gdm-settings.c
@@ -36,6 +36,7 @@
 #define DBUS_API_SUBJECT_TO_CHANGE
 #include <dbus/dbus-glib.h>
 #include <dbus/dbus-glib-lowlevel.h>
+#include <polkit/polkit.h>
 
 #include "gdm-settings.h"
 #include "gdm-settings-glue.h"
@@ -118,23 +119,66 @@
 gdm_settings_set_value (GdmSettings *settings,
                         const char  *key,
                         const char  *value,
-                        GError     **error)
+                        DBusGMethodInvocation *context)
 {
-        GError  *local_error;
+        PolkitAuthority *authority;
+        PolkitSubject *subject;
+        PolkitAuthorizationResult *result;
+        char *sender;
+        GError  *error;
         gboolean res;
 
         g_return_val_if_fail (GDM_IS_SETTINGS (settings), FALSE);
         g_return_val_if_fail (key != NULL, FALSE);
 
+        authority = NULL;
+        sender = NULL;
+        result = NULL;
+        error = NULL;
+
         g_debug ("Setting value %s", key);
 
-        local_error = NULL;
+        authority = polkit_authority_get ();
+        sender = dbus_g_method_get_sender (context);
+        if (!sender) {
+                g_debug ("GdmSettings: Can't determinate sender");
+                goto out;
+        }
+
+        subject = polkit_system_bus_name_new (sender);
+        result = polkit_authority_check_authorization_sync (authority, subject, "org.gnome.displaymanager.settings.set",
+                                                            NULL,
+                                                            POLKIT_CHECK_AUTHORIZATION_FLAGS_NONE,
+                                                            NULL, &error);
+        if (!result) {
+                if (error) {
+                        g_debug ("GdmSettings: Error occurred during authorization: %s", error->message);
+                }
+                goto out;
+        }
+
+        res = polkit_authorization_result_get_is_authorized (result);
+        if (!res) {
+                g_debug ("GdmSettings: Client unauthorized, bailing out");
+                goto out;
+        }
+
         res = gdm_settings_backend_set_value (settings->priv->backend,
                                               key,
                                               value,
-                                              &local_error);
-        if (! res) {
-                g_propagate_error (error, local_error);
+                                              &error);
+
+ out:
+        g_object_unref (authority);
+        g_object_unref (subject);
+        g_object_unref (result);
+        g_free (sender);
+
+        if (res) {
+                dbus_g_method_return (context);
+        } else {
+                dbus_g_method_return_error (context, error);
+                g_error_free (error);
         }
 
         return res;
--- a/common/gdm-settings.h
+++ b/common/gdm-settings.h
@@ -23,6 +23,7 @@
 #define __GDM_SETTINGS_H
 
 #include <glib-object.h>
+#include <dbus/dbus-glib.h>
 
 G_BEGIN_DECLS
 
@@ -73,7 +74,7 @@
 gboolean            gdm_settings_set_value                      (GdmSettings *settings,
                                                                  const char  *key,
                                                                  const char  *value,
-                                                                 GError     **error);
+                                                                 DBusGMethodInvocation *context);
 
 G_END_DECLS
 
--- a/common/gdm-settings.xml
+++ b/common/gdm-settings.xml
@@ -6,6 +6,7 @@
       <arg name="value" direction="out" type="s"/>
     </method>
     <method name="SetValue">
+      <annotation name="org.freedesktop.DBus.GLib.Async" value=""/>
       <arg name="key" direction="in" type="s"/>
       <arg name="value" direction="in" type="s"/>
     </method>
--- a/configure.ac
+++ b/configure.ac
@@ -40,6 +40,7 @@
 dnl ---------------------------------------------------------------------------
 
 DBUS_GLIB_REQUIRED_VERSION=0.74
+POLKIT_GOBJECT_REQUIRED_VERSION=0.92
 GLIB_REQUIRED_VERSION=2.22.0
 GTK_REQUIRED_VERSION=2.12.0
 PANGO_REQUIRED_VERSION=1.3.0
@@ -60,6 +61,7 @@
 
 PKG_CHECK_MODULES(COMMON,
         dbus-glib-1 >= $DBUS_GLIB_REQUIRED_VERSION
+        polkit-gobject-1 >= $POLKIT_GOBJECT_REQUIRED_VERSION
         gobject-2.0 >= $GLIB_REQUIRED_VERSION
         gio-2.0 >= $GLIB_REQUIRED_VERSION
 )
@@ -68,6 +70,7 @@
 
 PKG_CHECK_MODULES(DAEMON,
         dbus-glib-1 >= $DBUS_GLIB_REQUIRED_VERSION
+        polkit-gobject-1 >= $POLKIT_GOBJECT_REQUIRED_VERSION
         gobject-2.0 >= $GLIB_REQUIRED_VERSION
         gio-2.0 >= $GLIB_REQUIRED_VERSION
 )
@@ -1392,6 +1395,7 @@
 gui/user-switch-applet/Makefile
 utils/Makefile
 data/gdm.conf
+data/gdm.policy
 data/Makefile
 data/faces/Makefile
 data/greeter-autostart/Makefile
--- a/data/Makefile.am
+++ b/data/Makefile.am
@@ -46,6 +46,8 @@
 schemas_in_files = gdm.schemas.in
 schemas_DATA = $(schemas_in_files:.schemas.in=.schemas)
 
+@INTLTOOL_POLICY_RULE@
+
 gdm.schemas.in: $(srcdir)/gdm.schemas.in.in
 	sed	-e 's,[@]GDMPREFETCHCMD[@],$(GDMPREFETCHCMD),g' \
 		-e 's,[@]GDM_CUSTOM_CONF[@],$(GDM_CUSTOM_CONF),g' \
@@ -78,11 +80,18 @@
 localealiasdir = $(datadir)/gdm
 localealias_DATA = locale.alias
 
+polkitdir = $(datadir)/polkit-1/actions
+polkit_in_files = gdm.policy.in
+polkit_DATA = $(polkit_in_files:.policy.in=.policy)
+check:
+	$(POLKIT_POLICY_FILE_VALIDATE) $(polkit_DATA)
+
 EXTRA_DIST =			\
 	$(schemas_in_files)	\
 	$(schemas_DATA)		\
 	$(dbusconf_in_files)	\
 	$(localealias_DATA)	\
+	$(polkit_in_files)	\
 	gdm.schemas.in.in	\
 	gdm.conf-custom.in 	\
 	Xsession.in 		\
@@ -105,7 +114,8 @@
 	$(NULL)
 
 DISTCLEANFILES =			\
-	$(dbusconf_DATA)			\
+	$(dbusconf_DATA)		\
+	$(polkit_DATA)			\
 	gdm.schemas			\
 	$(NULL)
 
--- a/data/gdm.conf.in
+++ b/data/gdm.conf.in
@@ -34,8 +34,6 @@
     <deny send_destination="org.gnome.DisplayManager"
           send_interface="org.gnome.DisplayManager.LocalDisplayFactory"/>
     <deny send_destination="org.gnome.DisplayManager"
-          send_interface="org.gnome.DisplayManager.Settings"/>
-    <deny send_destination="org.gnome.DisplayManager"
           send_interface="org.gnome.DisplayManager.Slave"/>
     <deny send_destination="org.gnome.DisplayManager"
           send_interface="org.gnome.DisplayManager.Session"/>
@@ -44,6 +42,10 @@
     <allow send_destination="org.gnome.DisplayManager"
            send_interface="org.freedesktop.DBus.Introspectable"/>
 
+    <!-- Controlled by Policykit -->
+    <allow send_destination="org.gnome.DisplayManager"
+           send_interface="org.gnome.DisplayManager.Settings"/>
+
     <allow send_destination="org.gnome.DisplayManager"
            send_interface="org.gnome.DisplayManager.Display"
            send_member="GetId"/>
--- a/po/POTFILES.in
+++ b/po/POTFILES.in
@@ -49,6 +49,7 @@
 daemon/simple-slave-main.c
 daemon/test-session.c
 daemon/xdmcp-chooser-slave-main.c
+data/gdm.policy.in
 data/gdm.schemas.in.in
 data/greeter-autostart/at-spi-registryd-wrapper.desktop.in.in
 data/greeter-autostart/gdm-simple-greeter.desktop.in.in
--- /dev/null
+++ b/data/gdm.policy.in
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+          "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+          "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
+<policyconfig>
+  <vendor>The GNOME Project</vendor>
+  <vendor_url>http://www.gnome.org/</vendor_url>
+  <icon_name>gdm</icon_name>
+
+  <action id="org.gnome.displaymanager.settings.set">
+    <_description>Change login screen configuration</_description>
+    <_message>Privileges are required to change the login screen configuration.</_message>
+    <defaults>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+</policyconfig>
