base/polkit: let wheel users use AUTH_KEEP_SELF for systemd actions

base/services/polkit.nix

@@ -6,9 +6,12 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
+    polkit.addRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
+       if (
-            return ["unix-user:"+subject.user];
+           action.id.startsWith("org.freedesktop.systemd1.") &&
+           subject.isInGroup("wheel")
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
          }
      });
   '';