From 2c8e4162f586ad360f0fc4124e1197f38abe1ea2 Mon Sep 17 00:00:00 2001
From: "sec-check[bot]" <sec-check[bot]@users.noreply.github.com>
Date: Sat, 12 Sep 2026 04:40:31 -0400
Subject: [PATCH] [sec-check] fix: tighten org.ublue.privileged.user.setup
 polkit defaults

allow_any/allow_inactive/allow_active=yes made the wheel-only gate in
20-privileged-user-setup.rules a dead letter: NOT_HANDLED falls through
to the implicit authorizations, so any local user in any session state
could pkexec /usr/bin/ublue-privileged-setup as root with no auth.

Set defaults to no/no/auth_admin. Wheel keeps passwordless access via
the existing rules.d rule; everyone else is denied unless an admin
authenticates. Matches the sibling org.frostyard.ChairLift.bootc.policy
hardening shipped in the same directory.

Closes #1107

Signed-off-by: sec-check[bot] <sec-check[bot]@users.noreply.github.com>
---
 .../polkit-1/actions/org.ublue.privileged.user.setup.policy | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy b/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
index ba9f26b71..faad6ba5e 100644
--- a/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
+++ b/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
@@ -11,9 +11,9 @@
     <description>Allows certain user configuration tasks to run as root</description>
     <icon_name>package-x-generic</icon_name>
     <defaults>
-      <allow_any>yes</allow_any>
-      <allow_inactive>yes</allow_inactive>
-      <allow_active>yes</allow_active>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>auth_admin</allow_active>
     </defaults>
     <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/ublue-privileged-setup</annotate>
   </action>