Philip Withnall
6c521a279b
‘cleanup’ is a noun; ‘clean up’ is a verb. Signed-off-by: Philip Withnall <pwithnall@gnome.org>
128 lines
6.6 KiB
XML
128 lines
6.6 KiB
XML
<?xml version="1.0" encoding="UTF-8"?> <!--*-nxml-*-->
|
|
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"https://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
|
|
|
<!--
|
|
SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
This file is part of systemd.
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
-->
|
|
|
|
<policyconfig>
|
|
|
|
<vendor>The systemd Project</vendor>
|
|
<vendor_url>https://systemd.io</vendor_url>
|
|
|
|
<!--
|
|
SECURITY: the default policy allows any user with an active session on the local console to check
|
|
for updates and update the system to the latest version without extra authentication.
|
|
Depending on the use case it might make sense to request authentication here, or add a polkit
|
|
rule to only allow access to these actions for members of a given group.
|
|
|
|
The default policy matches prior art in distributions and system update managers. To update a
|
|
system, for example: packagekit requires only a user with an active session, eos-updater needs
|
|
a user at the console, and rpm-ostree (generally) needs an "administrative user" at the computer.
|
|
Without this default, distributions hoping to use sysupdate as an update mechanism will have to
|
|
set the policy to it anyhow.
|
|
|
|
Cancellation actions are always allowed by default, as the user can typically pull the plug on
|
|
the computer to prevent an action completing anyway.
|
|
-->
|
|
|
|
<action id="org.freedesktop.sysupdate1.check">
|
|
<description gettext-domain="systemd">Check for system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to check for system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.cancel-check">
|
|
<description gettext-domain="systemd">Cancel checking for system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to cancel checking for system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.update">
|
|
<description gettext-domain="systemd">Install system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to install system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.cancel-update">
|
|
<description gettext-domain="systemd">Cancel installing system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to cancel installing system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.update-to-version">
|
|
<description gettext-domain="systemd">Install specific system version</description>
|
|
<message gettext-domain="systemd">Authentication is required to update the system to a specific (possibly old) version.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.cancel-update-to-version">
|
|
<description gettext-domain="systemd">Cancel installing specific system version</description>
|
|
<message gettext-domain="systemd">Authentication is required to cancel updating the system to a specific (possibly old) version.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.vacuum">
|
|
<description gettext-domain="systemd">Clean up old system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to clean up old system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.cancel-vacuum">
|
|
<description gettext-domain="systemd">Cancel cleaning up old system updates</description>
|
|
<message gettext-domain="systemd">Authentication is required to cancel cleanup of old system updates.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="org.freedesktop.sysupdate1.manage-features">
|
|
<description gettext-domain="systemd">Manage optional features</description>
|
|
<message gettext-domain="systemd">Authentication is required to manage optional features.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
</policyconfig>
|