base/polkit: let wheel users use AUTH_KEEP_SELF for systemd actions

base/services/polkit.nix

@@ -6,10 +6,13 @@ in
   security.polkit.enable = true;
 
   environment.etc."polkit-1/rules.d/9-nixos-overrides.rules".text = lib.mkIf cfg.enable ''
-    polkit.addAdminRule(function(action, subject) {
+    polkit.addRule(function(action, subject) {
-        if(subject.isInGroup("wheel")) {
+       if (
-            return ["unix-user:"+subject.user];
+           action.id.startsWith("org.freedesktop.systemd1.") &&
-        }
+           subject.isInGroup("wheel")
-    });
+       ) {
+           return polkit.Result.AUTH_SELF_KEEP;
+         }
+     });
   '';
 }