80 lines
4.2 KiB
XML
80 lines
4.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC
|
|
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
|
<policyconfig>
|
|
|
|
<vendor>BastionGuard Security Frontend</vendor>
|
|
<vendor_url>https://codelinsoft.it/BastionGuard</vendor_url>
|
|
|
|
<!-- ============================================================= -->
|
|
<!-- ⚙️ 1. Script di configurazione rete e sicurezza -->
|
|
<!-- ============================================================= -->
|
|
<action id="org.BastionGuard.netsetup">
|
|
<description>Configurazione rete BastionGuard (firewall, DNS, servizi)</description>
|
|
<message>Autorizzazione per applicare le impostazioni di rete e firewall di BastionGuard</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
<annotate key="org.freedesktop.policykit.exec.path">
|
|
/usr/share/BastionGuard/data/scripts/BastionGuard-net-setup.sh /usr/libexec/BastionGuard-helper /usr/bin/nft /usr/bin/firewall-cmd /usr/sbin/ufw
|
|
</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_user_interaction">true</annotate>
|
|
</action>
|
|
|
|
<!-- ============================================================= -->
|
|
<!-- 🧱 2. Installazione e gestione di nftables.conf -->
|
|
<!-- ============================================================= -->
|
|
<action id="org.BastionGuard.nftables">
|
|
<description>Installa e abilita la configurazione nftables di BastionGuard</description>
|
|
<message>Autorizzazione richiesta per configurare nftables e scrivere /etc/nftables.conf</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
<annotate key="org.freedesktop.policykit.exec.path">
|
|
/usr/sbin/nft /usr/bin/nft /usr/bin/cp /bin/systemctl /usr/lib/systemd/systemd
|
|
</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_user_interaction">true</annotate>
|
|
</action>
|
|
|
|
<!-- ============================================================= -->
|
|
<!-- 🧩 3. Gestione dei servizi di sistema -->
|
|
<!-- ============================================================= -->
|
|
<action id="org.BastionGuard.service.manage">
|
|
<description>Riavvio, abilitazione e gestione dei servizi BastionGuard</description>
|
|
<message>Autorizzazione per gestire i servizi BastionGuard tramite systemd</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
<!-- pkexec exec.path is exactly one absolute executable, not a list. -->
|
|
<annotate key="org.freedesktop.policykit.exec.path">/usr/libexec/bastionguard/bastionguard-service</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_user_interaction">true</annotate>
|
|
</action>
|
|
|
|
<!-- ============================================================= -->
|
|
<!-- 🧰 4. Operazioni amministrative generiche (manutenzione) -->
|
|
<!-- ============================================================= -->
|
|
<action id="org.BastionGuard.maintenance">
|
|
<description>Operazioni di manutenzione e setup di BastionGuard</description>
|
|
<message>Autorizzazione richiesta per completare operazioni amministrative di BastionGuard</message>
|
|
<defaults>
|
|
<allow_any>auth_admin_keep</allow_any>
|
|
<allow_inactive>auth_admin_keep</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
<!-- No generic exec.path mapping here: shells and general-purpose tools
|
|
must never receive passwordless pkexec authorization. -->
|
|
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
|
|
<annotate key="org.freedesktop.policykit.exec.allow_user_interaction">true</annotate>
|
|
</action>
|
|
|
|
</policyconfig>
|