Harden the elevation trust checks and narrow what one authorization applies

client/ui/build/linux/nfpm/nfpm.yaml

@@ -21,6 +21,10 @@ contents:
     dst: "/usr/local/bin/netbird-ui"
   - src: "./build/appicon.png"
     dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
+  # The name the polkit action's icon_name refers to, which the released packages
+  # install as /usr/share/pixmaps/netbird.png.
+  - src: "./build/appicon.png"
+    dst: "/usr/share/icons/hicolor/128x128/apps/netbird.png"
   - src: "./build/linux/netbird-ui.desktop"
     dst: "/usr/share/applications/netbird-ui.desktop"
   # Names the polkit action for the elevation prompt the app raises when an

client/ui/build/linux/polkit/io.netbird.settings.policy

@@ -3,26 +3,17 @@
  "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
 
 <!--
-  Names the polkit action behind the elevation prompt the desktop app raises when
-  an unprivileged user changes an SSH setting the daemon restricts to root (see
-  client/ui/services/guarded.go). Without it pkexec falls back to its generic
-  action, whose dialog offers the user the program path and its flags and asks
-  whether to run all that as the super user: true, but not something anybody can
-  make a decision about.
+  Names the action behind the elevation prompt the desktop app raises for an SSH
+  setting the daemon restricts to root; without it pkexec's generic dialog offers
+  the raw command line instead. The argv1 annotation keeps this wording to the
+  one-shot mode that applies those settings.
 
-  The argv1 annotation keeps the action, and therefore this wording, to the
-  one-shot mode that applies those settings. Anything else run through pkexec
-  falls back to the generic action, as it should.
+  auth_admin rather than auth_admin_keep: each of these settings is its own grant
+  of shell access, so a credential cache would let a second, unasked-for change
+  ride along on the authorization given the first.
 
-  auth_admin rather than auth_admin_keep on purpose: each of these settings is
-  its own grant of shell access on this host, and a five-minute credential cache
-  would let a second, unasked-for change ride along on the authorization the user
-  gave the first.
-
-  There are two actions because the binary lands in a different place depending
-  on how it was packaged: /usr/bin for the released deb and rpm, /usr/local/bin
-  for a locally built package. pkexec selects the action whose exec.path matches
-  the program it was asked to run.
+  exec.path takes no wildcard and the binary's location depends on the package,
+  hence one action per path.
 -->
 <policyconfig>
   <vendor>NetBird</vendor>
@@ -31,7 +22,7 @@
   <action id="io.netbird.settings.apply-privileged">
     <description>Change privileged NetBird settings</description>
     <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird-ui</icon_name>
+    <icon_name>netbird</icon_name>
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
@@ -44,7 +35,7 @@
   <action id="io.netbird.settings.apply-privileged-local">
     <description>Change privileged NetBird settings</description>
     <message>Authentication is required to change NetBird settings that grant SSH access to this computer.</message>
-    <icon_name>netbird-ui</icon_name>
+    <icon_name>netbird</icon_name>
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>