fix: add flatpak polkit rule for RDP sessions and keep snapd

Author: Derek

ansible/roles/dfe_developer/tasks/desktop.yml

@@ -40,13 +40,11 @@
 
 # Remove unwanted packages that come as recommends
 # - gnome-initial-setup: We suppress this anyway
-# - snapd: We don't use snaps, prefer apt/flatpak
 # - ubuntu-report, whoopsie, apport-gtk: Telemetry/crash reporting
 - name: Remove unwanted packages (Ubuntu)
   ansible.builtin.apt:
     name:
       - gnome-initial-setup
-      - snapd
       - ubuntu-report
       - whoopsie
       - apport-gtk
@@ -55,14 +53,6 @@
     purge: true
   when: ansible_facts['distribution'] == 'Ubuntu'
 
-# Prevent snapd from being reinstalled as a dependency
-- name: Hold snapd package to prevent reinstall
-  ansible.builtin.dpkg_selections:
-    name: snapd
-    selection: hold
-  when: ansible_facts['distribution'] == 'Ubuntu'
-  failed_when: false
-
 - name: Install LibreOffice (Ubuntu)
   ansible.builtin.apt:
     name: libreoffice

ansible/roles/dfe_rdp/tasks/main.yml

@@ -17,6 +17,11 @@
     - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
     - not dfe_has_gnome
 
+- name: Configure polkit rules for RDP sessions
+  ansible.builtin.include_tasks:
+    file: polkit.yml
+  tags: ['polkit']
+
 - name: Configure RDP certificates
   ansible.builtin.include_tasks:
     file: certificates.yml

ansible/roles/dfe_rdp/tasks/polkit.yml

@@ -0,0 +1,25 @@
+---
+# Polkit rules for RDP sessions
+# Allow wheel users to manage Flatpak without repeated auth prompts over RDP
+# See docs/POLKIT-RDP.md for details
+
+- name: Allow wheel users to manage Flatpak on remote sessions
+  ansible.builtin.copy:
+    dest: /etc/polkit-1/rules.d/49-flatpak-wheel.rules
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      polkit.addRule(function(action, subject) {
+          if ((action.id == "org.freedesktop.Flatpak.app-install" ||
+               action.id == "org.freedesktop.Flatpak.runtime-install" ||
+               action.id == "org.freedesktop.Flatpak.app-uninstall" ||
+               action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
+               action.id == "org.freedesktop.Flatpak.modify-repo") &&
+              subject.active == true &&
+              subject.isInGroup("wheel")) {
+                  return polkit.Result.YES;
+          }
+          return polkit.Result.NOT_HANDLED;
+      });
+  when: ansible_facts['distribution'] in ['Fedora', 'Ubuntu']