Comment 68 for bug 221363

Derek:
The criteria is that you hit this bug on a certain package. ;-)
I think most packages should be fixed, even if a small minority should keep using allow_active: it can only be useful when e.g. managing hardware, sound, mounted devices, etc. In these cases, only the current user should be allowed to run the action. But in most cases, it's too much of a restriction, and if you feel the need for the change, it's probably that it should happen.

One way to find these packages is to run
grep -R "<allow_any>no" /usr/share/polkit-1/actions/
and then check each file and try to guess whether the use of allow_active only is legetimate or not. Then, file a bug uptsream and open a bug watch here.

Ben:
One reason why GDM devs haven't replied can be that upstream's 3.0 uses GSettings for gdmsetup, and doesn't suffer from the bug. Ubuntu would need to check that. Other maintainers might be more responsive.
If you fear that people will make the same mistake in the future, then you can write a simple patch the the Polkit tutorial. Notably, the example config file could have <allow_any>auth_admin</allow_any> instead of "no", or a comment could explain what reasonable defaults are. You can find them at:
http://cgit.freedesktop.org/PolicyKit/tree/docs