From 1529fd3b025a7feee2d883caa6c36aec4bb37c0c Mon Sep 17 00:00:00 2001
From: zhangkun2 <zhangkun2@uniontech.com>
Date: Mon, 14 Sep 2026 12:17:47 +0800
Subject: [PATCH] fix(polkit): tighten allow_active to auth_admin_keep for
 power.doAction

Change allow_active from yes to auth_admin_keep in
org.deepin.dde.power.policy to prevent unauthenticated privileged
access from active sessions.

power.doAction already has an AllowCaller whitelist in C++ code,
so whitelisted callers (taskbar, hotkeys) are unaffected and there
is no UX regression.

Log: fix insecure polkit allow_active=yes configuration
Bug: https://pms.uniontech.com/bug-view-372453.html
---
 src/plugin-qt/power/system/misc/org.deepin.dde.power.policy | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy b/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
index cc0f37e6..43f05906 100644
--- a/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
+++ b/src/plugin-qt/power/system/misc/org.deepin.dde.power.policy
@@ -10,7 +10,7 @@
                 <defaults>
                         <allow_any>auth_admin</allow_any>
                         <allow_inactive>auth_admin</allow_inactive>
-                        <allow_active>yes</allow_active>
+                        <allow_active>auth_admin_keep</allow_active>
                 </defaults>
                 <description xml:lang="en_US">Check Authentication</description>
                 <message xml:lang="en_US">Authentication is required to perform this action</message>