67e26be2d9
The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally. Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f
11 lines
599 B
Text
11 lines
599 B
Text
// RedFlag Agent — allow the service user to manage transient systemd units only.
|
|
// The agent's single sudo grant is a fixed `systemd-run ... redflag-helper`
|
|
// command shape; systemd-run needs the matching D-Bus permission, which polkit
|
|
// evaluates against the original caller. Scope is manage-transient-units, not
|
|
// manage-units: the agent cannot touch system services it did not create.
|
|
polkit.addRule(function(action, subject) {
|
|
if (action.id == "org.freedesktop.systemd1.manage-transient-units" &&
|
|
subject.user == "redflag-agent") {
|
|
return polkit.Result.YES;
|
|
}
|
|
});
|