5229e2c774
Symptom: each app restart that didn't go through Stop daemon left
an orphan mycelium running as root, claiming the TUN \"mycelium\",
UDP/9650 (multicast discovery) and TCP/8990 (JSON-RPC, hardcoded
in 0.6.1 — no flag). Subsequent starts panicked with EBUSY or
\"Address in use\" on whichever port the orphan held.
We can't SIGKILL the orphan from user-space (root process). Move
the cleanup into an elevated context that runs in the same pkexec
authentication as the daemon spawn:
/usr/bin/mycellium-bootstrap (new shell script in the .deb)
pkill -9 -x mycelium
ip link del mycelium / mycel0
exec /usr/bin/mycelium \"\$@\"
The polkit policy now annotates this exact path with
auth_admin_keep so a single password prompt covers every
subsequent restart in the user's session.
Sidecar: when /usr/bin/mycellium-bootstrap exists (production
install) we hand pkexec that path instead of the bare daemon.
\`pnpm tauri dev\` falls back to the unwrapped binary path.
29 lines
1.3 KiB
XML
29 lines
1.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC
|
|
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
|
|
"https://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
|
|
<policyconfig>
|
|
<vendor>Threefold</vendor>
|
|
<vendor_url>https://threefold.io</vendor_url>
|
|
|
|
<!--
|
|
Bootstrap action: covers the wrapper that cleans up orphan
|
|
mycelium state and then execs the daemon. pkexec matches the
|
|
binary path against `org.freedesktop.policykit.exec.path` to
|
|
pick this action up; auth_admin_keep then caches the auth for
|
|
the user's session so subsequent restarts don't re-prompt.
|
|
-->
|
|
<action id="tech.threefold.mycellium-ui.bootstrap">
|
|
<description>Run the Mycelium overlay daemon</description>
|
|
<description xml:lang="fr">Lancer le démon de l'overlay Mycelium</description>
|
|
<message>Authentication is required to start the Mycelium overlay daemon.</message>
|
|
<message xml:lang="fr">Une authentification est requise pour démarrer le démon Mycelium.</message>
|
|
<defaults>
|
|
<allow_any>auth_admin</allow_any>
|
|
<allow_inactive>auth_admin</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
<annotate key="org.freedesktop.policykit.exec.path">/usr/bin/mycellium-bootstrap</annotate>
|
|
</action>
|
|
</policyconfig>
|