<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>

  <!--
    Policy definitions for fwupd actions.
    Copyright 2015 Richard Hughes <richard@hughsie.com>
  -->

  <vendor>System firmware update</vendor>
  <vendor_url>https://github.com/fwupd/fwupd</vendor_url>
  <icon_name>application-x-firmware</icon_name>

  <action id="org.freedesktop.fwupd.quit">
    <description>Stop the fwupd service</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to stop the firmware update service</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.update-internal-trusted">
    <description>Install signed system firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the firmware on this machine</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.update-internal">
    <description>Install unsigned system firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the firmware on this machine</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.update-internal-trusted</annotate>
  </action>

  <action id="org.freedesktop.fwupd.downgrade-internal-trusted">
    <description>Install old version of signed system firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to downgrade the firmware on this machine</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.update-internal</annotate>
  </action>

  <action id="org.freedesktop.fwupd.downgrade-internal">
    <description>Install old version of unsigned system firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to downgrade the firmware on this machine</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.downgrade-internal-trusted</annotate>
  </action>

  <action id="org.freedesktop.fwupd.update-hotplug-trusted">
    <description>Install signed device firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the firmware on a removable device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.update-hotplug">
    <description>Install unsigned device firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the firmware on a removable device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.update-hotplug-trusted</annotate>
  </action>

  <action id="org.freedesktop.fwupd.downgrade-hotplug-trusted">
    <description>Install signed device firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to downgrade the firmware on a removable device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.downgrade-hotplug">
    <description>Install unsigned device firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to downgrade the firmware on a removable device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.downgrade-hotplug-trusted</annotate>
  </action>

  <action id="org.freedesktop.fwupd.device-unlock">
    <description>Unlock the device to allow access</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to unlock a device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.modify-config">
    <description>Modify daemon configuration</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to modify daemon configuration</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.modify-remote</annotate>
  </action>

  <action id="org.freedesktop.fwupd.reset-config">
    <description>Reset daemon configuration</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to reset daemon configuration to defaults</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.modify-config</annotate>
  </action>

  <action id="org.freedesktop.fwupd.modify-device">
    <description>Modify a device property</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to modify a device property</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.device-activate">
    <description>Activate the new firmware on the device</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to switch to the new firmware version</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.clear-results">
    <description>Clear stored firmware update results</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to clear firmware update results</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.verify">
    <description>Verify device firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to verify firmware on a device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.verify-update">
    <description>Update the stored device verification information</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the stored checksums for the device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.verify</annotate>
  </action>

  <action id="org.freedesktop.fwupd.get-remotes">
    <description>Get configured remotes</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to get the list of configured remotes used for firmware updates</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.refresh-remote">
    <description>Update the metadata for a configured remote</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to update the metadata for a configured remote used for firmware updates</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.get-remotes</annotate>
  </action>

  <action id="org.freedesktop.fwupd.enable-remote">
    <description>Modify a configured remote</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to enable or disable a configured remote used for firmware updates</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.get-remotes</annotate>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.clean-remote</annotate>
  </action>

  <action id="org.freedesktop.fwupd.modify-remote">
    <description>Modify a configured remote</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to modify a configured remote used for firmware updates</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.enable-remote</annotate>
  </action>

  <action id="org.freedesktop.fwupd.clean-remote">
    <description>Clean a configured remote</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to delete metadata from a remote</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.get-remotes</annotate>
  </action>

  <action id="org.freedesktop.fwupd.set-approved-firmware">
    <description>Sets the list of approved firmware</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to set the list of approved firmware</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.self-sign">
    <description>Sign data using the client certificate</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to sign data using the client certificate</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.get-bios-settings">
    <description>Get BIOS settings</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to read BIOS settings</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.set-bios-settings">
    <description>Set one or more BIOS settings</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to modify BIOS settings</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.get-bios-settings</annotate>
  </action>

  <action id="org.freedesktop.fwupd.fix-host-security-attr">
    <description>Security hardening for HSI</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to fix a host security issue</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
  </action>

    <action id="org.freedesktop.fwupd.undo-host-security-attr">
    <description>Security hardening for HSI</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to undo the fix for a host security issue</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.emulation-load">
    <description>Load device emulation data</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to load hardware emulation data</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.fwupd.emulation-save">
    <description>Save device emulation data</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to save hardware emulation data</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.emulation-load</annotate>
  </action>

  <action id="org.freedesktop.fwupd.emulation-tag">
    <description>Enable emulation data collection</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to enable emulation data collection</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.imply">org.freedesktop.fwupd.emulation-load</annotate>
  </action>

  <action id="org.freedesktop.fwupd.device-emulate">
    <description>Install firmware on emulated device</description>
    <!-- TRANSLATORS: this is the PolicyKit modal dialog -->
    <message>Authentication is required to install firmware on an emulated device</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

</policyconfig>
