fix: resolve authorization popup issue for apps not adapted to secure boot - #1216
Merged
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR updates polkit policies for airplane mode and power mode so that active local users can toggle them without admin authorization, while keeping restrictions for inactive/remote sessions. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
fly602
changed the title
fix: resolve authorization popup issue for apps not adapted to secure boot The relevant interfaces have been integrated with secure boot checks. For apps not adapted to secure boot, the call falls back to polkit authentication, which prompts an authorization dialog. However, the taskbar and shortcut daemon were not adapted to secure boot due to project architecture limitations, causing authorization popups on normal operations like toggling airplane mode and power mode. This degrades UX for local users. Note: The current polkit policy is a fallback. Before secure boot was added, this was the existing policy. Since the taskbar plugin and shortcut daemon call these interfaces and are not adapted to secure boot, the interface behavior is temporarily reverted to the old policy to avoid affecting user experience. Future plan: The security design will be re-evaluated to develop a security interface implementation plan that fits the V25 architecture. Log: Authorization popup no longer appears for local users toggling airplane and power modes via taskbar or shortcuts Influence: 1. Verify local active users can toggle airplane mode via shortcut without auth dialog 2. Verify local active users can toggle power mode via taskbar plugin without auth dialog 3. Verify inactive users (e.g., SSH/VNC) are still blocked 4. Ensure no other polkit policies are affected 涉及接口已加入安全启动校验。对于未适配安全启动的应用，则 fallback 到 polkit 鉴权，polkit 会弹出提权弹窗。但任务栏和快捷键因项目架构限制未适配 安全启动，导致触发设置飞行模式和电源模式等常规操作时弹出授权弹窗。 如果是本地用户，影响用户体验。 目前的 polkit 策略是一个回退，在加 security-loader 之前就是这样的策略。 当前由于任务栏插件、快捷键中有相关接口的调用，且未适配安全启动，为了不 影响用户体验，先将接口的行为暂时回退到旧的策略。 后续计划：后续会重新评估安全方案的整体设计，制定更契合 V25 架构的安全 接口的实施方案。 Log: 本地用户通过任务栏/快捷键切换飞行模式和电源模式不再弹出授权弹窗 Influence: 1. 测试本地激活用户使用快捷键切换飞行模式，不应弹出授权弹窗 2. 测试本地激活用户通过任务栏插件切换电源模式，不应弹出授权弹窗 3. 验证非激活用户（如 SSH/VNC 会话）仍无法执行这些操作 4. 确认不影响其他 polkit 策略 PMS: TASK-393313
deepin pr auto review★ 总体评分：40分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 diff --git a/misc/polkit-action/org.deepin.dde.airplane.policy b/misc/polkit-action/org.deepin.dde.airplane.policy
index 14833a94c..0aa41788e 100644
--- a/misc/polkit-action/org.deepin.dde.airplane.policy
+++ b/misc/polkit-action/org.deepin.dde.airplane.policy
@@ -12,7 +12,7 @@
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
- <allow_active>yes</allow_active>
+ <allow_active>auth_admin_keep</allow_active>
</defaults>
</action>
diff --git a/misc/polkit-action/org.deepin.dde.power.policy b/misc/polkit-action/org.deepin.dde.power.policy
index dec4c0b2b..ea6fc4587 100644
--- a/misc/polkit-action/org.deepin.dde.power.policy
+++ b/misc/polkit-action/org.deepin.dde.power.policy
@@ -10,7 +10,7 @@
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
- <allow_active>yes</allow_active>
+ <allow_active>auth_admin_keep</allow_active>
</defaults>
<description xml:lang="en_US">Check Authentication</description>
<message xml:lang="en_US">Authentication is required to perform this action</message> |
|
@fly602: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
zccrs
approved these changes
Aug 19, 2026
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602, zccrs The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: resolve authorization popup issue for apps not adapted to secure boot
The relevant interfaces have been integrated with secure boot checks. For apps
not adapted to secure boot, the call falls back to polkit authentication, which
prompts an authorization dialog. However, the taskbar and shortcut daemon were
not adapted to secure boot due to project architecture limitations, causing
authorization popups on normal operations like toggling airplane mode and power
mode. This degrades UX for local users.
Note: The current polkit policy is a fallback. Before secure boot was added,
this was the existing policy. Since the taskbar plugin and shortcut daemon call
these interfaces and are not adapted to secure boot, the interface behavior is
temporarily reverted to the old policy to avoid affecting user experience.
Future plan: The security design will be re-evaluated to develop a
security interface implementation plan that fits the V25 architecture.
Log: Authorization popup no longer appears for local users toggling airplane
and power modes via taskbar or shortcuts
Influence:
auth dialog
auth dialog
涉及接口已加入安全启动校验。对于未适配安全启动的应用，则 fallback 到
polkit 鉴权，polkit 会弹出提权弹窗。但任务栏和快捷键因项目架构限制未适配
安全启动，导致触发设置飞行模式和电源模式等常规操作时弹出授权弹窗。
如果是本地用户，影响用户体验。
目前的 polkit 策略是一个回退，在加 security-loader 之前就是这样的策略。
当前由于任务栏插件、快捷键中有相关接口的调用，且未适配安全启动，为了不
影响用户体验，先将接口的行为暂时回退到旧的策略。
后续计划：后续会重新评估安全方案的整体设计，制定更契合 V25 架构的安全
接口的实施方案。
Log: 本地用户通过任务栏/快捷键切换飞行模式和电源模式不再弹出授权弹窗
Influence:
PMS: TASK-393313
Summary by Sourcery
Bug Fixes:
Summary by Sourcery
Bug Fixes: