diff options
| -rw-r--r-- | .github/workflows/validate-installer-iso.yml | 6 | ||||
| -rw-r--r-- | installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules | 10 |
2 files changed, 16 insertions, 0 deletions
diff --git a/.github/workflows/validate-installer-iso.yml b/.github/workflows/validate-installer-iso.yml index 131ad5b..391afd8 100644 --- a/.github/workflows/validate-installer-iso.yml +++ b/.github/workflows/validate-installer-iso.yml @@ -38,3 +38,9 @@ jobs: bash -n "$script" done bash -n system_files/usr/libexec/aerocore-instruments-setup + + - name: Validate installer polkit rules + run: | + for rule in installer/system_files/overrides/etc/polkit-1/rules.d/*.rules; do + node --check < "$rule" + done diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules new file mode 100644 index 0000000..0ebcfdd --- /dev/null +++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules @@ -0,0 +1,10 @@ +// The installer action is privileged by design. Allow only the local, +// active Live ISO session to launch it without a transient password prompt. +polkit.addRule(function(action, subject) { + if (action.id === "org.fedoraproject.pkexec.liveinst" && + subject.user === "liveuser" && + subject.local === true && + subject.active === true) { + return polkit.Result.YES; + } +}); |