This file is indexed.

/usr/share/polkit-1/actions/org.freedesktop.Flatpak.policy is in flatpak 0.11.3-3.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>

  <!--
    Policy definitions for Flatpak system actions.
    Copyright (c) 2016 Alexander Larsson <alexl@redhat.com>
  -->

  <vendor>The Flatpak Project</vendor>
  <vendor_url>https://cgit.freedesktop.org/xdg-app/xdg-app/</vendor_url>
  <icon_name>package-x-generic</icon_name>

  <action id="org.freedesktop.Flatpak.app-install">
    <!-- SECURITY:
          - Normal users do not need authentication to install signed applications
            from signed repositories, as this cannot exploit a system.
          - Paranoid users (or parents!) can change this to 'auth_admin' or
            'auth_admin_keep'.
     -->
    <description>Install signed application</description>
    <message>Authentication is required to install software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.runtime-install">
    <!-- SECURITY:
          - Normal users do not need authentication to install signed applications
            from signed repositories, as this cannot exploit a system.
          - Paranoid users (or parents!) can change this to 'auth_admin' or
            'auth_admin_keep'.
     -->
    <description>Install signed runtime</description>
    <message>Authentication is required to install software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.app-update">
    <!-- SECURITY:
          - Normal users do not require admin authentication to update an
            app as the commit will be signed, and the action is required
            to update the system when unattended.
          - Changing this to anything other than 'yes' will break unattended
            updates.
     -->
    <description>Update signed application</description>
    <message>Authentication is required to update software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.runtime-update">
    <!-- SECURITY:
          - Normal users do not require admin authentication to update a
            runtime as the commit will be signed, and the action is required
            to update the system when unattended.
          - Changing this to anything other than 'yes' will break unattended
            updates.
     -->
    <description>Update signed runtime</description>
    <message>Authentication is required to update software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.update-remote">
    <!-- SECURITY:
          - Normal users do not need authentication to update metadata
            from signed repositories.
     -->
    <description>Update remote metadata</description>
    <message>Authentication is required to update remote info</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.modify-repo">
    <!-- SECURITY:
          - Normal users do not need authentication to modify the
            OSTree repository
     -->
    <description>Update system repository</description>
    <message>Authentication is required to update the system repository</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.install-bundle">
    <description>Install bundle</description>
    <message>Authentication is required to install software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.runtime-uninstall">
    <description>Uninstall runtime</description>
    <message>Authentication is required to uninstall software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.app-uninstall">
    <description>Uninstall app</description>
    <message>Authentication is required to uninstall software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.configure-remote">
    <description>Configure Remote</description>
    <message>Authentication is required to configure software repositories</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.configure">
    <description>Configure</description>
    <message>Authentication is required to configure software installation</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.Flatpak.appstream-update">
    <!-- SECURITY:
          - Normal users do not require admin authentication to update
            appstream data as it will be signed, and the action is required
            to update the system when unattended.
          - Changing this to anything other than 'yes' will break unattended
            updates.
     -->
    <description>Update appstream</description>
    <message>Authentication is required to update software</message>
    <icon_name>package-x-generic</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

</policyconfig>