simplify PolicyKit permissions a bit

diff --git a/policy/org.freedesktop.devicekit.disks.policy.in b/policy/org.freedesktop.devicekit.disks.policy.in
index a3f592e..07099e4 100644 (file)
--- a/policy/org.freedesktop.devicekit.disks.policy.in
+++ b/policy/org.freedesktop.devicekit.disks.policy.in
@@ -60,18 +60,8 @@ file are instantly applied.
   </action>
 
   <action id="org.freedesktop.devicekit.disks.filesystem-unmount-others">
-    <_description>Unmount a disk mounted by another user</_description>
-    <_message>Authentication is required to unmount disks mounted by another user</_message>
-    <defaults>
-      <allow_any>no</allow_any>
-      <allow_inactive>no</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-  </action>
-
-  <action id="org.freedesktop.devicekit.disks.filesystem-unmount-others-system-internal">
-    <_description>Unmount a system-internal device mounted by another user</_description>
-    <_message>Authentication is required to unmount a device mounted by another user</_message>
+    <_description>Unmount a device mounted by another user</_description>
+    <_message>Authentication is required to unmount devices mounted by another user</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -80,8 +70,8 @@ file are instantly applied.
   </action>
 
   <action id="org.freedesktop.devicekit.disks.filesystem-lsof">
-    <_description>Unmount a disk mounted by another user</_description>
-    <_message>Authentication is required to unmount disks mounted by another user</_message>
+    <_description>List open files</_description>
+    <_message>Authentication is required to list open files on a mounted file system</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -90,8 +80,8 @@ file are instantly applied.
   </action>
 
   <action id="org.freedesktop.devicekit.disks.filesystem-lsof-system-internal">
-    <_description>Unmount a system-internal device mounted by another user</_description>
-    <_message>Authentication is required to unmount a device mounted by another user</_message>
+    <_description>List open files on a system-internal device</_description>
+    <_message>Authentication is required to list open files on a mounted file system</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -109,19 +99,9 @@ file are instantly applied.
     </defaults>
   </action>
 
-  <action id="org.freedesktop.devicekit.disks.drive-eject-system-internal">
-    <_description>Eject a system-internal device</_description>
-    <_message>Authentication is required to eject media from the device</_message>
-    <defaults>
-      <allow_any>no</allow_any>
-      <allow_inactive>no</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-  </action>
-
   <action id="org.freedesktop.devicekit.disks.change">
-    <_description>Change a device</_description>
-    <_message>Authentication is required to change the device</_message>
+    <_description>Modify a device</_description>
+    <_message>Authentication is required to modify the device</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -130,8 +110,8 @@ file are instantly applied.
   </action>
 
   <action id="org.freedesktop.devicekit.disks.change-system-internal">
-    <_description>Change a system-internal device</_description>
-    <_message>Authentication is required to change the device</_message>
+    <_description>Modify a system-internal device</_description>
+    <_message>Authentication is required to modify the device</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -151,11 +131,11 @@ file are instantly applied.
 
   <action id="org.freedesktop.devicekit.disks.drive-smart-selftest">
     <_description>Run S.M.A.R.T. Self Tests</_description>
-    <_message>Authentication is required to run S.M.A.R.T. Self Tests</_message>
+    <_message>Authentication is required to run S.M.A.R.T. self tests</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
-      <allow_active>auth_admin_keep_always</allow_active>
+      <allow_active>auth_admin</allow_active>
     </defaults>
   </action>
 
@@ -189,20 +169,9 @@ file are instantly applied.
     </defaults>
   </action>
 
-  <action id="org.freedesktop.devicekit.disks.luks-lock-others-system-internal">
-    <_description>Lock an encrypted system-internal device unlocked by another user</_description>
-    <_message>Authentication is required to lock an encrypted device unlocked by another user</_message>
-    <defaults>
-      <allow_any>no</allow_any>
-      <allow_inactive>no</allow_inactive>
-      <allow_active>auth_admin</allow_active>
-    </defaults>
-  </action>
-
-
   <action id="org.freedesktop.devicekit.disks.linux-md">
-    <_description>Configure Software RAID (Linux md driver)</_description>
-    <_message>Authentication is required to configure Software RAID devices</_message>
+    <_description>Configure Linux Software RAID</_description>
+    <_message>Authentication is required to configure Linux Software RAID devices</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
@@ -211,27 +180,17 @@ file are instantly applied.
   </action>
 
   <action id="org.freedesktop.devicekit.disks.linux-md-system-internal">
-    <_description>Configure Software RAID (Linux md driver)</_description>
-    <_message>Authentication is required to configure Software RAID devices</_message>
+    <_description>Configure Linux Software RAID on a system-internal device</_description>
+    <_message>Authentication is required to configure Linux Software RAID devices</_message>
     <defaults>
       <allow_any>no</allow_any>
       <allow_inactive>no</allow_inactive>
-      <allow_active>auth_admin_keep_always</allow_active>
+      <allow_active>auth_admin</allow_active>
     </defaults>
   </action>
 
   <action id="org.freedesktop.devicekit.disks.cancel-job-others">
-    <_description>Cancel a job on a device initiated by another user</_description>
-    <_message>Authentication is required to cancel a job initiated by another user</_message>
-    <defaults>
-      <allow_any>no</allow_any>
-      <allow_inactive>no</allow_inactive>
-      <allow_active>auth_self</allow_active>
-    </defaults>
-  </action>
-
-  <action id="org.freedesktop.devicekit.disks.cancel-job-others-system-internal">
-    <_description>Cancel a job on a device initiated by another user</_description>
+    <_description>Cancel a job initiated by another user</_description>
     <_message>Authentication is required to cancel a job initiated by another user</_message>
     <defaults>
       <allow_any>no</allow_any>

diff --git a/src/devkit-disks-device.c b/src/devkit-disks-device.c
index fcb3295..aab3935 100644 (file)
--- a/src/devkit-disks-device.c
+++ b/src/devkit-disks-device.c
@@ -4510,9 +4510,7 @@ devkit_disks_device_filesystem_unmount (DevkitDisksDevice     *device,
         if (uid_of_mount != uid) {
                 if (!devkit_disks_damon_local_check_auth (device->priv->daemon,
                                                           pk_caller,
-                                                          device->priv->device_is_system_internal ?
-                                                     "org.freedesktop.devicekit.disks.filesystem-unmount-others-system-internal" :
-                                                     "org.freedesktop.devicekit.disks.filesystem-unmount-others",
+                                                          "org.freedesktop.devicekit.disks.filesystem-unmount-others",
                                                           context))
                         goto out;
         }
@@ -4780,9 +4778,7 @@ devkit_disks_device_drive_eject (DevkitDisksDevice     *device,
 
         if (!devkit_disks_damon_local_check_auth (device->priv->daemon,
                                                   pk_caller,
-                                                  device->priv->device_is_system_internal ?
-                                                  "org.freedesktop.devicekit.disks.drive-eject-system-internal" :
-                                                  "org.freedesktop.devicekit.disks.drive-eject",
+                                                  "org.freedesktop.devicekit.disks.drive-eject-system-internal",
                                                   context))
                 goto out;
 
@@ -5541,9 +5537,7 @@ devkit_disks_device_job_cancel (DevkitDisksDevice     *device,
         if (device->priv->job_initiated_by_uid != uid) {
                 if (!devkit_disks_damon_local_check_auth (device->priv->daemon,
                                                           pk_caller,
-                                                          device->priv->device_is_system_internal ?
-                                                  "org.freedesktop.devicekit.disks.cancel-job-others-system-internal" :
-                                                  "org.freedesktop.devicekit.disks.cancel-job-others",
+                                                          "org.freedesktop.devicekit.disks.cancel-job-others",
                                                           context))
                         goto out;
         }
@@ -6746,9 +6740,7 @@ devkit_disks_device_luks_lock (DevkitDisksDevice     *device,
         if (unlocked_by_uid != uid) {
                 if (!devkit_disks_damon_local_check_auth (device->priv->daemon,
                                                           pk_caller,
-                                                          device->priv->device_is_system_internal ?
-                                              "org.freedesktop.devicekit.disks.luks-lock-others-system-internal" :
-                                              "org.freedesktop.devicekit.disks.luks-lock-others",
+                                                          "org.freedesktop.devicekit.disks.luks-lock-others",
                                                           context)) {
                         goto out;
                 }

diff --git a/src/org.freedesktop.DeviceKit.Disks.Device.xml b/src/org.freedesktop.DeviceKit.Disks.Device.xml
index 8bbad79..898acd8 100644 (file)
--- a/src/org.freedesktop.DeviceKit.Disks.Device.xml
+++ b/src/org.freedesktop.DeviceKit.Disks.Device.xml
@@ -114,15 +114,7 @@
           <doc:list>
             <doc:item>
               <doc:term>org.freedesktop.devicekit.disks.cancel-job-others</doc:term>
-              <doc:definition>To cancel a job on a
-                <doc:ref type="property" to="Device:device-is-system-internal">non-system-internal</doc:ref>
-                device initiated by another user</doc:definition>
-            </doc:item>
-            <doc:item>
-              <doc:term>org.freedesktop.devicekit.disks.cancel-job-others-system-internal</doc:term>
-              <doc:definition>To cancel a job on a
-                <doc:ref type="property" to="Device:device-is-system-internal">system-internal</doc:ref>
-                device initiated by another user</doc:definition>
+              <doc:definition>To cancel a job initiated by another user</doc:definition>
             </doc:item>
           </doc:list>
         </doc:permission>
@@ -634,15 +626,7 @@
           <doc:list>
             <doc:item>
               <doc:term>org.freedesktop.devicekit.disks.filesystem-unmount-others</doc:term>
-              <doc:definition>To unmount a
-                <doc:ref type="property" to="Device:device-is-system-internal">non-system-internal</doc:ref>
-                device mounted by another user</doc:definition>
-            </doc:item>
-            <doc:item>
-              <doc:term>org.freedesktop.devicekit.disks.filesystem-unmount-others-system-internal</doc:term>
-              <doc:definition>To unmount a
-                <doc:ref type="property" to="Device:device-is-system-internal">system-internal</doc:ref>
-                device mounted by another user</doc:definition>
+              <doc:definition>To unmount a device mounted by another user</doc:definition>
             </doc:item>
           </doc:list>
         </doc:permission>
@@ -809,15 +793,7 @@
           <doc:list>
             <doc:item>
               <doc:term>org.freedesktop.devicekit.disks.luks-lock-others</doc:term>
-              <doc:definition>To lock an encrypted LUKS
-                <doc:ref type="property" to="Device:device-is-system-internal">non-system-internal</doc:ref>
-                device unlocked by another user</doc:definition>
-            </doc:item>
-            <doc:item>
-              <doc:term>org.freedesktop.devicekit.disks.luks-lock-others-system-internal</doc:term>
-              <doc:definition>To lock an encrypted LUKS
-                <doc:ref type="property" to="Device:device-is-system-internal">system-internal</doc:ref>
-                device unlocked by another user</doc:definition>
+              <doc:definition>To lock an encrypted LUKS device unlocked by another user</doc:definition>
             </doc:item>
           </doc:list>
         </doc:permission>
@@ -1130,15 +1106,7 @@
           <doc:list>
             <doc:item>
               <doc:term>org.freedesktop.devicekit.disks.drive-eject</doc:term>
-              <doc:definition>To eject media from a
-                <doc:ref type="property" to="Device:device-is-system-internal">non-system-internal</doc:ref>
-                device</doc:definition>
-            </doc:item>
-            <doc:item>
-              <doc:term>org.freedesktop.devicekit.disks.drive-eject-system-internal</doc:term>
-              <doc:definition>To eject a media from a
-                <doc:ref type="property" to="Device:device-is-system-internal">system-internal</doc:ref>
-                device</doc:definition>
+              <doc:definition>To eject media from a device</doc:definition>
             </doc:item>
           </doc:list>
         </doc:permission>