Is there any specific reason that bitmask must be added to the profile?
On a multi-user system, not all users might be interested in bitmask,
and do not need it in their "PATH".
I prefer only adding packages that are explicitely in the ‘packages’
field of 'operating-system' to the system profile.
One possible reason could be that the polkit policy whitelists a few
binaries, say, /gnu/store/aaa-bitmask/sbin/stuff, so
"pkexec stuff" (equivalent to "pkexec /gnu/store/aaa-bitmask/sbin/stuff")
doesn't require special permissions or a password of any kind.
However, if the user has a slightly different version of bitmask
in their profile, then the store path will be different
(/gnu/store/bbb-bitmask/sbin/stuff), then "pkexec stuff" will try
to use the not-authorised version, which will require passwords
or such.
OpenPGP_signature