Set Debian PolKit policy for PackageKit
Forwarded: not-needed
Author: Matthias Klumpp <matthias@tenstral.net>
Last-Update: 2012-08-14
--- a/policy/org.freedesktop.packagekit.policy.in
+++ b/policy/org.freedesktop.packagekit.policy.in
@@ -131,7 +131,7 @@
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>yes</allow_active>
+      <allow_active>auth_admin_keep</allow_active>
     </defaults>
   </action>
 
@@ -170,7 +170,7 @@
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>yes</allow_active>
+      <allow_active>auth_admin_keep</allow_active>
     </defaults>
   </action>
 
@@ -273,7 +273,7 @@
 
   <action id="org.freedesktop.packagekit.trigger-offline-update">
     <!-- SECURITY:
-          - Normal users are able to ask updates to be installed at
+          - Administrators are able to ask updates to be installed at
             early boot time without a password.
      -->
     <_description>Trigger offline updates</_description>
@@ -282,7 +282,7 @@
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
-      <allow_active>yes</allow_active>
+      <allow_active>auth_admin_keep</allow_active>
     </defaults>
   </action>
 
--- a/policy/org.freedesktop.packagekit.rules
+++ b/policy/org.freedesktop.packagekit.rules
@@ -1,7 +1,8 @@
 polkit.addRule(function(action, subject) {
-    if (action.id == "org.freedesktop.packagekit.package-install" &&
+    if ((action.id == "org.freedesktop.packagekit.upgrade-system" ||
+         action.id == "org.freedesktop.packagekit.trigger-offline-update") &&
         subject.active == true && subject.local == true &&
-        subject.isInGroup("wheel")) {
+        subject.isInGroup("sudo")) {
             return polkit.Result.YES;
     }
 });
