23 lines
936 B
Plaintext
23 lines
936 B
Plaintext
 
|
// Installed by the tsunagi packages.
|
||
|
|
//
|
||
|
|
// polkit decides who may configure systemd-resolved by user/group id, not by
|
||
|
|
// capability, so the agent needs this even though it holds CAP_NET_ADMIN. It
|
||
|
|
// grants exactly the four resolve1 actions the agent calls, and nothing else,
|
||
|
|
// to anyone in the "tsunagi" group.
|
||
|
|
//
|
||
|
|
// The packaged service runs as the "tsunagi" user (which is in that group), so
|
||
|
|
// its resolver configuration is allowed. To also run the agent as your own
|
||
|
|
// user, add yourself to the group:
|
||
|
|
//
|
||
|
|
// sudo usermod -aG tsunagi "$USER"
|
||
|
|
polkit.addRule(function(action, subject) {
|
||
|
|
var allowed = [
|
||
|
|
"org.freedesktop.resolve1.set-dns-servers",
|
||
|
|
"org.freedesktop.resolve1.set-domains",
|
||
|
|
"org.freedesktop.resolve1.set-default-route",
|
||
|
|
"org.freedesktop.resolve1.revert"
|
||
|
|
];
|
||
|
|
if (allowed.indexOf(action.id) >= 0 && subject.isInGroup("tsunagi")) {
|
||
|
|
return polkit.Result.YES;
|
||
|
|
}
|
||
|
|
});
|