modules/desktop: add polkit rules for pkexec use

modules/desktop/default.nix

@@ -11,6 +11,7 @@ in {
     ./helix-desktop.nix
     ./open-in-blackbox.nix
     ./bluetooth.nix
+    ./pkexec.nix
   ];
 
   services.xserver = {

modules/desktop/pkexec.nix

@@ -0,0 +1,16 @@
+{
+  security.polkit.extraConfig = /*javascript*/ ''
+    polkit.addRule(function(action, subject) {
+      if (
+        action.id == "org.freedesktop.policykit.exec" &&
+        subject.isInGroup("wheel")
+      ) {
+        if (subject.active) {
+          return polkit.Result.AUTH_SELF_KEEP;
+        } else {
+          return polkit.Result.AUTH_SELF;
+        }
+      }
+    });
+  '';
+}