Allow live user to launch installer

Authorize only the local active liveuser session for Anaconda's specific
polkit action, avoiding the transient password prompt.

Validate installer polkit rule syntax in the pull request workflow.

2 files changed, 16 insertions, 0 deletions

diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml
index 131ad5b..391afd8 100644
--- a/.github/workflows/validate-installer-iso.yml
+++ b/.github/workflows/validate-installer-iso.yml
@@ -38,3 +38,9 @@ jobs:
             bash -n "$script"
           done
           bash -n system_files/usr/libexec/aerocore-instruments-setup
+
+      - name: Validate installer polkit rules
+        run: |
+          for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do
+            node --check < "$rule"
+          done
diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
new file mode 100644
index 0000000..0ebcfdd
--- /dev/null
+++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
@@ -0,0 +1,10 @@
+// The installer action is privileged by design. Allow only the local,
+// active Live ISO session to launch it without a transient password prompt.
+polkit.addRule(function(action, subject) {
+    if (action.id === "org.fedoraproject.pkexec.liveinst" &&
+        subject.user === "liveuser" &&
+        subject.local === true &&
+        subject.active === true) {
+        return polkit.Result.YES;
+    }
+});