assets/polkit: add policy + example rules

assets/polkit/10-no.ntnu.pvv.roowho2.rules

@@ -0,0 +1,17 @@
+// Example site policy, layered on top of the <defaults> in no.ntnu.pvv.roowho2.policy.
+
+polkit.addRule(function (action, subject) {
+    if (action.id !== "no.ntnu.pvv.roowho2.wall" && action.id !== "no.ntnu.pvv.roowho2.write") {
+        return polkit.Result.NOT_HANDLED;
+    }
+
+    // `wall -g <group>` restricted to members of that same group.
+    if (action.id === "no.ntnu.pvv.roowho2.wall") {
+        var group = action.lookup("group");
+        if (group && !subject.isInGroup(group)) {
+            return polkit.Result.NO;
+        }
+    }
+
+    return polkit.Result.NOT_HANDLED;
+});

assets/polkit/no.ntnu.pvv.roowho2.policy

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>Programvareverkstedet</vendor>
+  <vendor_url>https://git.pvv.ntnu.no/Projects/roowho2</vendor_url>
+
+  <action id="no.ntnu.pvv.roowho2.wall">
+    <description>Broadcast a message to logged in users</description>
+    <message>Authentication is required to broadcast a message to all users</message>
+    <defaults>
+      <allow_any>auth_self</allow_any>
+      <allow_inactive>auth_self</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:roowho2</annotate>
+  </action>
+
+  <action id="no.ntnu.pvv.roowho2.write">
+    <description>Send a message to another user's terminal</description>
+    <message>Authentication is required to send a message to another user</message>
+    <defaults>
+      <allow_any>auth_self</allow_any>
+      <allow_inactive>auth_self</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:roowho2</annotate>
+  </action>
+</policyconfig>

flake.nix

@@ -92,6 +92,7 @@
         fileset = lib.fileset.unions [
           (craneLib.fileset.commonCargoSources ./.)
           ./assets/systemd
+          ./assets/polkit
         ];
       };
 

nix/package.nix

@@ -93,6 +93,9 @@ buildFunction ({
     install -Dm444 assets/systemd/roowho2.service "$out/lib/systemd/system/roowho2.service"
     substituteInPlace "$out/lib/systemd/system/roowho2.service" \
       --replace "/usr/bin/roowhod" "${placeholder "out"}/bin/${mainProgram}"
+
+    install -Dm444 assets/polkit/no.ntnu.pvv.roowho2.policy "$out/share/polkit-1/actions/no.ntnu.pvv.roowho2.policy"
+    install -Dm444 assets/polkit/10-no.ntnu.pvv.roowho2.rules "$out/share/polkit-1/rules.d/10-no.ntnu.pvv.roowho2.rules"
   '';
 
   meta = with lib; {