 <page xmlns="http://projectmallard.org/1.0/"
      xmlns:its="http://www.w3.org/2005/11/its"
      type="topic" style="task"
      id="no-change-disks">

  <info>
    <link type="guide" xref="user-settings#lockdown"/>
    <revision pkgversion="3.11" date="2014-08-21" status="draft"/>
    <link type="seealso" xref="dconf-lockdown" />

    <credit type="author copyright">
      <name>Jana Svarova</name>
      <email its:translate="no">jana.svarova@gmail.com</email>
      <years>2014</years>
    </credit>
    
    <desc>This page explains how to prevent users from changing disks partition/format.</desc>
  </info>
  
  <title>Lock down changing disks settings</title>
  
  <p><sys>PolicyKit</sys> enables you to set permissions for individual operations. 
  For <sys>udisks2</sys>, the utility for disk management 
  services, the configuration is located at 
  <file>/usr/share/polkit-1/actions/org.freedesktop.udisks2.policy</file>.
  This file contains a set of actions and default values, which can be 
  overridden by the system administrator.</p>
  
  <steps>
  <title>To prevent users from changing disks settings:</title>
  	<item><p>Create a file with the same content as in <file>/usr/share/polkit-1/actions/org.freedesktop.udisks2.policy</file>.</p>
  	<code>cp /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy /etc/share/polkit-1/actions/org.freedesktop.udisks2.policy</code>
  	</item>
  <note style="important">
  	<p>Do not change the <file>/usr/share/polkit-1/actions/org.freedesktop.udisks2.policy</file> file,
  	your changes will be overwritten by the next package update.</p>
  </note>
  	<item><p>Delete the action you do not need and add the following lines to 
  	the <file>/etc/polkit-1/actions/org.freedesktop.udisks2.policy</file> file:</p>
<screen><![CDATA[
 <action id="org.freedesktop.udisks2.modify-device">
     <description xml:lang="en_GB">Modify the disks settings</description>
     <message>Authentication is required to modify the disks settings</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>
]]></screen>
  <p>Replace <code>no</code> vy <code>auth_admin</code> if you want to ensure
  only the root user is able to carry out the action.</p>
  	</item>
  	<item><p>Save the changes.</p></item>
  </steps>
  <p>When the user tries to change the disks settings, the following message is returned:</p>
  <code>Authentication is required to modify the disks settings</code>
 
  </page>
