<?xml version="1.0" encoding="UTF-8"?> <!--*-nxml-*-->
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
        "https://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">

<!--
  SPDX-License-Identifier: LGPL-2.1-or-later

  This file is part of systemd.

  systemd is free software; you can redistribute it and/or modify it
  under the terms of the GNU Lesser General Public License as published by
  the Free Software Foundation; either version 2.1 of the License, or
  (at your option) any later version.
-->

<policyconfig>

        <vendor>The systemd Project</vendor>
        <vendor_url>https://systemd.io</vendor_url>

        <!--
            SECURITY: the default policy allows any user with an active session on the local console to check
            for updates and update the system to the latest version without extra authentication.
            Depending on the use case it might make sense to request authentication here, or add a polkit
            rule to only allow access to these actions for members of a given group.

            The default policy matches prior art in distributions and system update managers. To update a
            system, for example: packagekit requires only a user with an active session, eos-updater needs
            a user at the console, and rpm-ostree (generally) needs an "administrative user" at the computer.
            Without this default, distributions hoping to use sysupdate as an update mechanism will have to
            set the policy to it anyhow.
        -->

        <action id="org.freedesktop.sysupdate1.check">
                <description gettext-domain="systemd">Check for system updates</description>
                <message gettext-domain="systemd">Authentication is required to check for system updates.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>yes</allow_active>
                </defaults>
        </action>

        <action id="org.freedesktop.sysupdate1.update">
                <description gettext-domain="systemd">Install system updates</description>
                <message gettext-domain="systemd">Authentication is required to install system updates.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>yes</allow_active>
                </defaults>
        </action>

        <action id="org.freedesktop.sysupdate1.update-to-version">
                <description gettext-domain="systemd">Install specific system version</description>
                <message gettext-domain="systemd">Authentication is required to update the system to a specific (possibly old) version.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>auth_admin_keep</allow_active>
                </defaults>
        </action>

        <action id="org.freedesktop.sysupdate1.vacuum">
                <description gettext-domain="systemd">Cleanup old system updates</description>
                <message gettext-domain="systemd">Authentication is required to cleanup old system updates.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>auth_admin_keep</allow_active>
                </defaults>
        </action>

        <action id="org.freedesktop.sysupdate1.manage-features">
                <description gettext-domain="systemd">Manage optional features</description>
                <message gettext-domain="systemd">Authentication is required to manage optional features.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>auth_admin_keep</allow_active>
                </defaults>
        </action>

</policyconfig>
