[rpms/fedora-release] f45: rpmostree.rules: Make updates unprivileged

[rpms/fedora-release] f45: rpmostree.rules: Make updates unprivileged

[@ 2026-08-10 9:36 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/fedora-release
            Branch : f45
            Commit : cd7c9de97339154dba5018d7c606562d28bc098f
            Author : Timothée Ravier <tim@siosm.fr>
            Date   : 2024-07-08T18:19:37+02:00
            Stats  : +4/-3 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/fedora-release/c/cd7c9de97339154dba5018d7c606562d28bc098f?branch=f45

            Log:
            rpmostree.rules: Make updates unprivileged

Triggering an update with rpm-ostree is now an unprivileged operation.

This rule is only installed on desktop systems (Fedora Atomic Desktops)
and not servers (CoreOS, IoT).

See: https://fedoraproject.org/wiki/Changes/UnprivilegedUpdatesAtomicDesktops

---
diff --git a/org.projectatomic.rpmostree1.rules b/org.projectatomic.rpmostree1.rules
index ec13edb..0895bf0 100644
--- a/org.projectatomic.rpmostree1.rules
+++ b/org.projectatomic.rpmostree1.rules
@@ -1,6 +1,8 @@
 polkit.addRule(function(action, subject) {
-    if (action.id == "org.projectatomic.rpmostree1.repo-refresh" &&
-        subject.active == true && subject.local == true) {
+    if ((action.id == "org.projectatomic.rpmostree1.repo-refresh" ||
+         action.id == "org.projectatomic.rpmostree1.upgrade") &&
+        subject.active == true &&
+        subject.local == true) {
             return polkit.Result.YES;
     }
 
@@ -8,7 +10,6 @@ polkit.addRule(function(action, subject) {
          action.id == "org.projectatomic.rpmostree1.install-local-packages" ||
          action.id == "org.projectatomic.rpmostree1.override" ||
          action.id == "org.projectatomic.rpmostree1.deploy" ||
-         action.id == "org.projectatomic.rpmostree1.upgrade" ||
          action.id == "org.projectatomic.rpmostree1.rebase" ||
          action.id == "org.projectatomic.rpmostree1.rollback" ||
          action.id == "org.projectatomic.rpmostree1.bootconfig" ||