Initial Commit

2026-09-15 15:24:03 -04:00
commit 4dc7086e7e
605 changed files with 101380 additions and 0 deletions
@@ -0,0 +1,41 @@
+// =====================================================================
+// Who may unfreeze a base image.
+//
+// The check is subject.active - a live, foreground login session of the
+// operator. Deliberately NOT a group membership test: a group is
+// inherited by every process a member starts, including a background
+// service, and the whole point of this gate is that a human is present.
+//
+// `subject.local` was in this rule first and was removed on purpose.
+// This machine's GNOME desktop is normally reached over RDP rather than
+// at the console, and logind does not call such a session local - so the
+// strict form refused the operator at their own desktop while changing
+// nothing about what it excludes. The agent has no session at all;
+// vmd has no session at all; a systemd service has no session at all.
+// `active` already rules out every one of them.
+//
+// The agent is not in this picture at all. It runs as owuivm, which
+// cannot write a base image by file permission, and it has no verb that
+// asks anything else to. This rule is what a person passes through, not
+// a check the agent could fail.
+// =====================================================================
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.freedesktop.systemd1.manage-units") {
+        var unit = action.lookup("unit") || "";
+        if (unit.indexOf("owuivm-maint@") === 0 ||
+            unit.indexOf("owuivm-detach@") === 0 ||
+            unit.indexOf("owuivm-thaw@") === 0 ||
+            unit.indexOf("owuivm-freeze@") === 0 ||
+            // Putting a disc in the library, and renaming a machine.
+            // Neither touches a base image, but both write somewhere the
+            // operator's own account cannot, so they pass the same gate
+            // as everything else here rather than inventing a second one.
+            unit.indexOf("owuivm-insert@") === 0 ||
+            unit.indexOf("owuivm-rename@") === 0) {
+            if (subject.active && subject.user == "@OPERATOR@") {
+                return polkit.Result.YES;
+            }
+            return polkit.Result.NO;
+        }
+    }
+});