From c1f3f42c14e5bbf1c8181d1469ac58f1d9f7ebf3 Mon Sep 17 00:00:00 2001 From: tranch Date: Wed, 29 Jul 2026 00:28:49 +0800 Subject: Allow live user to launch installer Authorize only the local active liveuser session for Anaconda's specific polkit action, avoiding the transient password prompt. Validate installer polkit rule syntax in the pull request workflow. --- .../overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules (limited to 'installer') diff --git a/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules new file mode 100644 index 0000000..0ebcfdd --- /dev/null +++ b/installer/system_files/overrides/etc/polkit-1/rules.d/10-aerocore-liveinst.rules @@ -0,0 +1,10 @@ +// The installer action is privileged by design. Allow only the local, +// active Live ISO session to launch it without a transient password prompt. +polkit.addRule(function(action, subject) { + if (action.id === "org.fedoraproject.pkexec.liveinst" && + subject.user === "liveuser" && + subject.local === true && + subject.active === true) { + return polkit.Result.YES; + } +}); -- cgit v1.2.3