<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "https://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>

  <!--
    Policy definitions for System Color Manager actions.
    Copyright (c) 2010 Richard Hughes <richard@hughsie.com>
  -->

  <vendor>System Color Manager</vendor>
  <vendor_url>https://www.freedesktop.org/projects/system-color-manager/</vendor_url>
  <icon_name>application-vnd.iccprofile</icon_name>

  <action id="org.freedesktop.color-manager.create-device">
    <!-- SECURITY:
          - Normal users should not have to authenticate to add devices
     -->
    <description>Create a color managed device</description>
    <message>Authentication is required to create a color managed device</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.create-profile">
    <!-- SECURITY:
          - Normal users should not have to authenticate to add profiles
     -->
    <description>Create a color profile</description>
    <message>Authentication is required to create a color profile</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.delete-device">
    <!-- SECURITY:
          - Normal users should not have to authenticate to delete devices
     -->
    <description>Remove a color managed device</description>
    <message>Authentication is required to remove a color managed device</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.delete-profile">
    <!-- SECURITY:
          - Normal users should not have to authenticate to delete profiles
     -->
    <description>Remove a color profile</description>
    <message>Authentication is required to remove a color profile</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.modify-device">
    <!-- SECURITY:
          - Normal users should not have to authenticate to modify devices
     -->
    <description>Modify color settings for a device</description>
    <message>Authentication is required to modify the color settings for a device</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.modify-profile">
    <!-- SECURITY:
          - Normal users should not have to authenticate to modify profiles
     -->
    <description>Modify a color profile</description>
    <message>Authentication is required to modify a color profile</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.install-system-wide">
    <!-- SECURITY:
          - Normal users require admin authentication to install files system
            wide to apply color profiles for sessions that have not explicitly
            chosen profiles to apply.
          - This should not be set to 'yes' as unprivileged users could then
            set a profile set to all-white or all-black and thus make the
            other sessions unusable.
     -->
    <description>Install system color profiles</description>
    <message>Authentication is required to install the color profile for all users</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.device-inhibit">
    <!-- SECURITY:
          - Normal users should not have to authenticate to profile
            devices.
     -->
    <description>Inhibit color profile selection</description>
    <message>Authentication is required to disable profile matching for a device</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

  <action id="org.freedesktop.color-manager.sensor-lock">
    <!-- SECURITY:
          - Normal users should not have to authenticate to use the
            colorimeter device.
     -->
    <description>Use color sensor</description>
    <message>Authentication is required to use the color sensor</message>
    <icon_name>application-vnd.iccprofile</icon_name>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.owner">unix-user:@DAEMON_USER@</annotate>
  </action>

</policyconfig>

