Update polkit rules to allow sudo users to change wifi config

ubo_app/system/bootstrap.py

@@ -175,7 +175,7 @@ def configure_fan() -> None:
 
 def setup_polkit() -> None:
     """Create the polkit rules file."""
-    with Path('/etc/polkit-1/rules.d/50-ubo.rules').open('w') as file:
+    with Path('/etc/polkit-1/rules.d/10-ubo.rules').open('w') as file:
         file.write(
             Path(__file__)
             .parent.joinpath('polkit.rules')

ubo_app/system/polkit.rules

@@ -1,10 +1,19 @@
 polkit.addRule(function(action, subject) {
-    if ((action.id == "org.freedesktop.login1.reboot" ||
-         action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
-         action.id == "org.freedesktop.login1.power-off" ||
-         action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
-         action.id.startsWith("org.freedesktop.NetworkManager.")) &&
-        subject.user == "{{USERNAME}}") {
-        return polkit.Result.YES;
+    if (subject.user == "{{USERNAME}}") {
+        // Special handling for settings.modify.system when user is in sudo group
+        if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
+            subject.isInGroup("sudo")) {
+            // Ensure we explicitly grant this permission regardless of local/active status
+            return polkit.Result.YES;
+        }
+        // All other NetworkManager and login1 actions
+        if (action.id == "org.freedesktop.login1.reboot" ||
+            action.id == "org.freedesktop.login1.reboot-multiple-sessions" ||
+            action.id == "org.freedesktop.login1.power-off" ||
+            action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
+            action.id.indexOf("org.freedesktop.NetworkManager.") == 0) {
+            return polkit.Result.YES;
+        }
     }
-});
+    return polkit.Result.NOT_HANDLED;
+});

ubo_app/system/system_manager/scripts/set_account.sh

@@ -39,6 +39,16 @@ fi
 echo "${USERNAME}:${PASSWORD}" | chpasswd
 printf "${USERNAME}:${PASSWORD}"
 
+# TODO: Create a seperate script to adding user to sudo group
+# and allowing passwordless sudo. Call this script with explict user action
+# exposed via the UI.
+
+# Add the user to the sudo group
+usermod -aG sudo $USERNAME
+
+# Allow the user to run sudo without a password
+echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/${USERNAME}
+
 # Allow password authentication
 sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
 systemctl restart ssh