init

desktop/helper/install.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Installs Kadence's privileged helper and its polkit action.
+#
+# The desktop app itself never runs as root; this one small script is the entire
+# privileged surface, and you can read all of it in a minute.
+#
+#   sudo ./install.sh                     # prompt once per session (recommended)
+#   sudo ./install.sh --passwordless      # no prompt for the invoking user
+#   sudo ./install.sh --uninstall
+set -euo pipefail
+
+HELPER_SRC="$(dirname "$(readlink -f "$0")")/kadence-helper"
+POLICY_SRC="$(dirname "$(readlink -f "$0")")/org.kadence.helper.policy"
+HELPER_DEST="/usr/local/bin/kadence-helper"
+POLICY_DEST="/usr/share/polkit-1/actions/org.kadence.helper.policy"
+RULE_DEST="/etc/polkit-1/rules.d/49-kadence.rules"
+
+TARGET_USER="${SUDO_USER:-${USER:-root}}"
+PASSWORDLESS=0
+UNINSTALL=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --passwordless) PASSWORDLESS=1 ;;
+    --uninstall) UNINSTALL=1 ;;
+    --user) TARGET_USER="$2"; shift ;;
+    -h|--help) sed -n '2,12p' "$0"; exit 0 ;;
+    *) echo "unknown option: $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+if [[ $EUID -ne 0 ]]; then
+  echo "Run me with sudo." >&2
+  exit 1
+fi
+
+if [[ $UNINSTALL -eq 1 ]]; then
+  # Unblock first — leaving a block behind after uninstalling would be rude.
+  [[ -x "$HELPER_DEST" ]] && "$HELPER_DEST" clear || true
+  rm -f "$HELPER_DEST" "$POLICY_DEST" "$RULE_DEST"
+  echo "Removed the helper, its polkit action and any passwordless rule."
+  exit 0
+fi
+
+install -m 0755 -o root -g root "$HELPER_SRC" "$HELPER_DEST"
+install -m 0644 -o root -g root "$POLICY_SRC" "$POLICY_DEST"
+echo "Installed $HELPER_DEST and its polkit action."
+
+if [[ $PASSWORDLESS -eq 1 ]]; then
+  mkdir -p "$(dirname "$RULE_DEST")"
+  cat > "$RULE_DEST" <<RULE
+// Lets $TARGET_USER manage the Kadence block list without a password prompt.
+// Scope: this one action, this one user, this one helper binary.
+polkit.addRule(function (action, subject) {
+    if (action.id == "org.kadence.helper.manage-hosts" &&
+        subject.user == "$TARGET_USER" && subject.local && subject.active) {
+        return polkit.Result.YES;
+    }
+});
+RULE
+  chmod 0644 "$RULE_DEST"
+  echo "Passwordless blocking enabled for '$TARGET_USER' ($RULE_DEST)."
+  echo "Remove that file to go back to prompting."
+fi
+
+echo
+echo "Check it works:  $HELPER_DEST status"