Centos – Proper method to disable polkit.service on CentOS 7

Why?

My services are started via proper unit files or init scripts. I have no need for regular users to do anything special on my servers beyond su. I am specifically looking for a way to completely shut down polkit without it starting up on it's own when other services are restarted.

I foresee a problem explaining this to auditors in our PCI environment as well. We have to describe the purpose of each service. We do not have a legit use case for polkit in a PCI environment.

Additional note: I did not install polkit. These servers have a very minimal install around 670MB on / It was a systemd update that appears to have installed polkit and the spec apparently has dependencies to all systemd managed services. Once it is installed, I have to rebuild the machine to remove it, just like trying to remove nss once you install it. My concern is that if I force the unstall, it may have left files that will trip up systemd that assumes it is there.

What I have tried:

Create /etc/polkit-1/rules.d/99-deny-all.rules with

polkit.addRule(function(action, subject) {
    return polkit.Result.YES;
});

Then

systemctl daemon-reload && systemctl daemon-reexec

This does nothing, /usr/lib/polkit-1/polkitd --no-debug continues to start when other services under systemd are restarted.

[ Update ] As Alexander mentioned, restarting polkit will apply the settings to polkit itself and that is good, but I am looking for a way to tell polkit to not start that does not break other services.

[ update 2 ] This may actually prevent some services from re-starting correctly.

Mask or disable the service:

This causes other services to hang on startup and shutdown, waiting for polkit.

Edit /usr/share/dbus-1/sstem-services/org.freedesktop.PolicyKit1.service with:

[snip]
Exec=/bin/false
[snip]

Then

systemctl daemon-reload && systemctl daemon-reexec

This does nothing, /usr/lib/polkit-1/polkitd --no-debug continues to start when other services under systemd are restarted.

I have read the man pages a couple times. It's probably something really simple I am missing. My preference would be for a method that persists after systemd package updates.

The end goal I am looking for is for polkit.service to not start when other daemons are restarted, such as unbound, bind, dhcp, etc.