sam/semaphore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

thinkcenter-xrdp: use modern polkit rules.d JS rule (localauthority path gone on polkit 124)

Browse Source
This commit is contained in:
Samuel James 2026-09-03 13:09:20 +00:00
parent dbef6bc979
commit bbaf1cb184
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
life-church/playbooks/thinkcenter-xrdp.yml
View File

@ -111,17 +111,27 @@
# Cinnamon uses D-Bus/PolicyKit; the common xrdp fix is a polkit rule so the # Cinnamon uses D-Bus/PolicyKit; the common xrdp fix is a polkit rule so the
# RDP session isn't blocked on colord authentication prompts. # RDP session isn't blocked on colord authentication prompts.
# Modern polkit (>=0.106, Mint 22.3 = polkit 124) uses JS rules in
# /etc/polkit-1/rules.d/ — the old /etc/polkit-1/localauthority/*.pkla layout
# no longer exists on this host.
- name: "[polkit] Ensure rules.d directory exists"
ansible.builtin.file:
path: /etc/polkit-1/rules.d
state: directory
mode: "0750"
- name: "[polkit] Allow colord actions in xrdp sessions (avoids auth popup loop)" - name: "[polkit] Allow colord actions in xrdp sessions (avoids auth popup loop)"
ansible.builtin.copy: ansible.builtin.copy:
dest: /etc/polkit-1/localauthority/50-local.d/45-allow-colord.pkla dest: /etc/polkit-1/rules.d/45-allow-colord.rules
mode: "0644" mode: "0644"
content: | content: |
[Allow Colord all Users] // Allow any user to manage color-manager devices/profiles.
Identity=unix-user:* // Prevents the colord authentication popup loop in xrdp/Cinnamon sessions.
Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile polkit.addRule(function(action, subject) {
ResultAny=no if (action.id.indexOf("org.freedesktop.color-manager.") === 0) {
ResultInactive=no return polkit.Result.YES;
ResultActive=yes }
});
register: polkit_rule register: polkit_rule
- name: "[services] Enable + start xrdp and xrdp-sesman" - name: "[services] Enable + start xrdp and xrdp-sesman"