From d47686efd9a9e5753d6cb757e1523c38d238118a Mon Sep 17 00:00:00 2001
From: nocode <suzuku295@gmail.com>
Date: Wed, 8 Jul 2026 23:58:03 +0200
Subject: [PATCH] feat(polkit): add gameboot polkit policy for fws-gameboot
 execution

Add PolicyKit policy configuration that authorizes gameboot launchers (desktop entries) to execute /usr/local/bin/fws-gameboot via pkexec.

The policy allows active users (physically present) to switch to Windows without password prompt since the switch is non-destructive (FWS hibernates and restores the session on return). Remote or inactive sessions require admin authentication.
---
 .../polkit-1/actions/org.fws.gameboot.policy  | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 configs/releng/airootfs/usr/share/polkit-1/actions/org.fws.gameboot.policy

diff --git a/configs/releng/airootfs/usr/share/polkit-1/actions/org.fws.gameboot.policy b/configs/releng/airootfs/usr/share/polkit-1/actions/org.fws.gameboot.policy
new file mode 100644
index 0000000..def8a03
--- /dev/null
+++ b/configs/releng/airootfs/usr/share/polkit-1/actions/org.fws.gameboot.policy
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
+<!--
+  FWS — autorise les lanceurs gameboot (entrées .desktop « Jouer à … ») à
+  exécuter /usr/local/bin/fws-gameboot via pkexec.
+
+  allow_active = yes : AUCUN mot de passe pour l'utilisateur physiquement présent
+  (poste gaming perso). La bascule n'est PAS destructive — FWS hiberne, la
+  session est préservée et restaurée au retour. auth_admin pour les sessions
+  inactives/distantes.
+-->
+<policyconfig>
+  <vendor>FWS</vendor>
+  <action id="org.fws.gameboot">
+    <description>Basculer vers Windows pour jouer (gameboot)</description>
+    <description xml:lang="en">Switch to Windows to play (gameboot)</description>
+    <message>Authentification requise pour basculer vers Windows</message>
+    <message xml:lang="en">Authentication is required to switch to Windows</message>
+    <icon_name>fws-gameboot</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/bin/fws-gameboot</annotate>
+  </action>
+</policyconfig>