From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Wed, 26 Jun 2024 10:27:10 +0000 (+0200)
Subject: polkit: allow non-local users to block sleep and shutdown
X-Git-Tag: v257-rc1~1042^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F33491%2Fhead;p=thirdparty%2Fsystemd.git

polkit: allow non-local users to block sleep and shutdown

We already had 'auth_admin_keep' for org.freedesktop.login1.reboot and similar
actions. If a user is allowed to perform an action, I think they should be
allowed to _block_ the same action. Guarding this by auth_admin follows the
general principle of not allowing fully unprivileged users to have too much say
over the machine.
---

diff --git a/src/login/org.freedesktop.login1.policy b/src/login/org.freedesktop.login1.policy
index 012ee144832..226bb4cda43 100644
--- a/src/login/org.freedesktop.login1.policy
+++ b/src/login/org.freedesktop.login1.policy
@@ -22,7 +22,7 @@
                 <description gettext-domain="systemd">Allow applications to inhibit system shutdown</description>
                 <message gettext-domain="systemd">Authentication is required for an application to inhibit system shutdown.</message>
                 <defaults>
-                        <allow_any>no</allow_any>
+                        <allow_any>auth_admin_keep</allow_any>
                         <allow_inactive>yes</allow_inactive>
                         <allow_active>yes</allow_active>
                 </defaults>
@@ -44,7 +44,7 @@
                 <description gettext-domain="systemd">Allow applications to inhibit system sleep</description>
                 <message gettext-domain="systemd">Authentication is required for an application to inhibit system sleep.</message>
                 <defaults>
-                        <allow_any>no</allow_any>
+                        <allow_any>auth_admin_keep</allow_any>
                         <allow_inactive>yes</allow_inactive>
                         <allow_active>yes</allow_active>
                 </defaults>