SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sysupdate: Add separate polkit actions for cancellation (#42209)

Browse Source 
This allows us to have a separate, more permissive, policy for
cancelling ongoing sysupdate jobs. The new default policy for
cancellation actions is to allow them for the active user, without admin
authentication, because typically the user can just pull the plug on the
computer to cancel a job anyway.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: https://github.com/systemd/systemd/issues/38568
This commit is contained in:
Lennart Poettering
2026-05-22 10:35:49 +02:00
committed by GitHub
parent 24319a9c2c 6c521a279b
commit 469de233a3
3 changed files with 63 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/sysupdate/org.freedesktop.sysupdate1.policy
+45 -2
View File
@@ -29,6 +29,9 @@
a user at the console, and rpm-ostree (generally) needs an "administrative user" at the computer.
Without this default, distributions hoping to use sysupdate as an update mechanism will have to
set the policy to it anyhow.
Cancellation actions are always allowed by default, as the user can typically pull the plug on
the computer to prevent an action completing anyway.
-->
<action id="org.freedesktop.sysupdate1.check">
@@ -41,6 +44,16 @@
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.cancel-check">
<description gettext-domain="systemd">Cancel checking for system updates</description>
<message gettext-domain="systemd">Authentication is required to cancel checking for system updates.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.update">
<description gettext-domain="systemd">Install system updates</description>
<message gettext-domain="systemd">Authentication is required to install system updates.</message>
@@ -51,6 +64,16 @@
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.cancel-update">
<description gettext-domain="systemd">Cancel installing system updates</description>
<message gettext-domain="systemd">Authentication is required to cancel installing system updates.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.update-to-version">
<description gettext-domain="systemd">Install specific system version</description>
<message gettext-domain="systemd">Authentication is required to update the system to a specific (possibly old) version.</message>
@@ -61,9 +84,19 @@
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.cancel-update-to-version">
<description gettext-domain="systemd">Cancel installing specific system version</description>
<message gettext-domain="systemd">Authentication is required to cancel updating the system to a specific (possibly old) version.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.vacuum">
<description gettext-domain="systemd">Cleanup old system updates</description>
<message gettext-domain="systemd">Authentication is required to cleanup old system updates.</message>
<description gettext-domain="systemd">Clean up old system updates</description>
<message gettext-domain="systemd">Authentication is required to clean up old system updates.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
@@ -71,6 +104,16 @@
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.cancel-vacuum">
<description gettext-domain="systemd">Cancel cleaning up old system updates</description>
<message gettext-domain="systemd">Authentication is required to cancel cleanup of old system updates.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
<action id="org.freedesktop.sysupdate1.manage-features">
<description gettext-domain="systemd">Manage optional features</description>
<message gettext-domain="systemd">Authentication is required to manage optional features.</message>
src/sysupdate/sysupdated.c
+4 -4
View File
@@ -595,19 +595,19 @@ static int job_method_cancel(sd_bus_message *msg, void *userdata, sd_bus_error *
case JOB_LIST:
case JOB_DESCRIBE:
case JOB_CHECK_NEW:
action = "org.freedesktop.sysupdate1.check";
action = "org.freedesktop.sysupdate1.cancel-check";
break;
case JOB_ACQUIRE:
case JOB_INSTALL:
if (j->version)
action = "org.freedesktop.sysupdate1.update-to-version";
action = "org.freedesktop.sysupdate1.cancel-update-to-version";
else
action = "org.freedesktop.sysupdate1.update";
action = "org.freedesktop.sysupdate1.cancel-update";
break;
case JOB_VACUUM:
action = "org.freedesktop.sysupdate1.vacuum";
action = "org.freedesktop.sysupdate1.cancel-vacuum";
break;
case JOB_DESCRIBE_FEATURE: