18 lines
786 B
Plaintext
18 lines
786 B
Plaintext
polkit.addRule(function(action, subject) {
|
|
if (action.id === "org.omarchy.thunderbolt.approve" &&
|
|
subject.active && subject.local && subject.isInGroup("wheel")) {
|
|
return polkit.Result.YES;
|
|
}
|
|
// Bolt's vendor rule grants wheel passwordless management, including enabling
|
|
// automatic approval of every IOMMU device. Keep blanket policy changes behind
|
|
// administrator authentication; the narrow Omarchy action approves one device.
|
|
if (action.id === "org.freedesktop.bolt.manage" && subject.user !== "root") {
|
|
try {
|
|
polkit.spawn(["/usr/bin/test", "-f", "/etc/omarchy/thunderbolt-authorization.enabled"]);
|
|
return polkit.Result.AUTH_ADMIN;
|
|
} catch (error) {
|
|
// Protection is disabled: retain the packaged Bolt permission rules.
|
|
}
|
|
}
|
|
});
|