tl;dr I think polkit is the answer but don't understand where the local setting is stored vs. the remote setting. Am I right? If not, what is the correct response. For the record, I'm working with Raspbian Buster.
I've been working on setting up a Raspbian install to allow me to change network settings over ssh via nmcli. This answer about polkit affecting policy when logged in remotely helped me get going along with a look at this systemd github issue to apply it to Raspbian. These pages, however, didn't explain what governs local policy for controlling networking.
I think the answer is polkit (formerly PolicyKit). If so, I suspect ResultInactive and ResultActive to have something to do with it though the man page doesn't validate this theory. The man page for pklocalauthority describes ResultInactive, ResultActive, and ResultAny as follows:
ResultActive The result to return for subjects in an active local session that matches one or more of the given identities. Allowed values are similar to what can be used in the defaults section of .policy files used to define actions, e.g. yes, no, auth_self, auth_self_keep, auth_admin and auth_admin_keep.
ResultInactive Like ResultActive but instead applies to subjects in inactive local sessions.
ResultAny Like ResultActive but instead applies to any subject.
From my research on the Internet about inactive sessions in general, it seems like inactive sessions are what they sound like: sessions where no activity has occurred for some time, and not related to local login and remote login.
The meaning of "Any" is clear but what exactly do "Active" or "Inactive" mean? Are they the difference between being logged in at the terminal and being logged in remotely?
I'm expecting to see a setting that affects whether I'm logged in directly or remotely. Other posts suggested polkit would apply to all situations but still, I may be barking up the wrong tree and it's a different mechanism altogether.
