Allow live user to launch installer

Authorize only the local active liveuser session for Anaconda's specific
polkit action, avoiding the transient password prompt.

Validate installer polkit rule syntax in the pull request workflow.

1 files changed, 10 insertions, 0 deletions

diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
new file mode 100644
index 0000000..0ebcfdd
--- /dev/null
+++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules
@@ -0,0 +1,10 @@
+// The installer action is privileged by design. Allow only the local,
+// active Live ISO session to launch it without a transient password prompt.
+polkit.addRule(function(action, subject) {
+    if (action.id === "org.fedoraproject.pkexec.liveinst" &&
+        subject.user === "liveuser" &&
+        subject.local === true &&
+        subject.active === true) {
+        return polkit.Result.YES;
+    }
+});