From ec718b44a11f19aaec28349ac7490042d76379ab Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 3 Mar 2026 18:22:29 +0100 Subject: [PATCH] machined: add comment explaining access to machine objects a bit --- src/machine/machine.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/machine/machine.h b/src/machine/machine.h index d02bb9a965..7941eb365c 100644 --- a/src/machine/machine.h +++ b/src/machine/machine.h @@ -34,6 +34,17 @@ typedef enum KillWhom { } KillWhom; typedef struct Machine { + /* Note: machine objects registered with the --system instance can be allocated by privileged *and* + * unprivileged clients. We generally do this to make DNS-style name resolution work, and since + * that's a system-wide concept, the machine registrations need to be system-wide too. + * + * polkit manages access to machines registered by unprivileged clients. The general rule should be + * that local users (i.e. those with a seat) may register machines, and do basic interaction with + * their own machines without having to authenticate as administrator – however any more complex + * (such as: copying files in + out of a container; or logging in interactively) should only be + * available after administrator authentication, following the logic that users better use their own + * per-user instance of systemd-machined for that. */ + Manager *manager; char *name;