mikkeli
a2d6ad5aaf
/ crosscheck (push) Successful in 0s
The display can shut the Orin down: ack first, systemctl poweroff 2 s later. Refused without --allow-poweroff (only the Orin's unit sets it), without confirm, or with another boot's boot_id (hello now carries it), so a resend after the reboot cannot shut the next boot down. polkit grants the service user logind's power-off; no passwordless sudo involved at runtime. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
13 lines
720 B
Plaintext
13 lines
720 B
Plaintext
# polkit (0.105, local authority): lets the svc-gw user power the host off through
|
|
# logind, with no sudo. svc-gw runs `systemctl poweroff` for the display's
|
|
# `poweroff` command (contracts BOUNDARY.md). Nothing else is granted.
|
|
# Installed to /etc/polkit-1/localauthority/50-local.d/ by scripts/deploy.sh.
|
|
# multiple-sessions: an ssh login is another session; ignore-inhibit: no inhibitor lock
|
|
# (none are taken on this host today) should leave the button silently doing nothing.
|
|
[yukart-gw: power off]
|
|
Identity=unix-user:mikkeli
|
|
Action=org.freedesktop.login1.power-off;org.freedesktop.login1.power-off-multiple-sessions;org.freedesktop.login1.power-off-ignore-inhibit
|
|
ResultAny=yes
|
|
ResultInactive=yes
|
|
ResultActive=yes
|