一些linux配置文件备份

/etc/polkit-1/rules.d/50-custom.rules

js 复制代码

polkit.addRule(function(action, subject) {

    // 1. root 用户直接放行，不受后续规则限制
    if (subject.user === "root") {
        return polkit.Result.YES;
    }

    // 2. 禁用电源操作（关机/重启/挂起/休眠）
    if (action.id.indexOf("power-off") !== -1 ||
        action.id.indexOf("reboot") !== -1 ||
        action.id.indexOf("suspend") !== -1 ||
        action.id.indexOf("hibernate") !== -1 ||
        action.id.indexOf("hybrid-sleep") !== -1) {
        return polkit.Result.NO;
    }

    // 3. 活动本地用户 操作磁盘 udisks2 放行
    if (action.id.match("org.freedesktop.udisks2")) {
        if (subject.local && subject.active) {
            return polkit.Result.YES;
        } else {
            return polkit.Result.AUTH_ADMIN;
        }
    }

    // 4.1. 活动本地用户 wifi 扫描 放行
    if (action.id === "org.freedesktop.NetworkManager.wifi.scan") {
        if (subject.local && subject.active) {
            return polkit.Result.YES;  // 本地活动用户直接放行
        }
    }

    // 4.2 活动本地用户 启用/禁用设备统计 放行
    if (action.id === "org.freedesktop.NetworkManager.enable-disable-statistics") {
        if (subject.local && subject.active) {
            return polkit.Result.YES;
        }
    }

    // 5.严格网络限制
    var networkActions = [
        // NetworkManager
        "org.freedesktop.NetworkManager.checkpoint-rollback",
        "org.freedesktop.NetworkManager.enable-disable-connectivity-check",
        "org.freedesktop.NetworkManager.enable-disable-network",
        "org.freedesktop.NetworkManager.enable-disable-statistics",
        "org.freedesktop.NetworkManager.enable-disable-wifi",
        "org.freedesktop.NetworkManager.enable-disable-wimax",
        "org.freedesktop.NetworkManager.enable-disable-wwan",
        "org.freedesktop.NetworkManager.network-control",
        "org.freedesktop.NetworkManager.reload",
        "org.freedesktop.NetworkManager.settings.modify.global-dns",
        "org.freedesktop.NetworkManager.settings.modify.hostname",
        "org.freedesktop.NetworkManager.settings.modify.own",
        "org.freedesktop.NetworkManager.settings.modify.system",
        "org.freedesktop.NetworkManager.sleep-wake",
        "org.freedesktop.NetworkManager.wifi.scan",
        "org.freedesktop.NetworkManager.wifi.share.open",
        "org.freedesktop.NetworkManager.wifi.share.protected",
        // systemd-networkd
        "org.freedesktop.network1.forcerenew",
        "org.freedesktop.network1.reconfigure",
        "org.freedesktop.network1.reload",
        "org.freedesktop.network1.renew",
        "org.freedesktop.network1.revert-dns",
        "org.freedesktop.network1.revert-ntp",
        "org.freedesktop.network1.set-default-route",
        "org.freedesktop.network1.set-dns-over-tls",
        "org.freedesktop.network1.set-dns-servers",
        "org.freedesktop.network1.set-dnssec",
        "org.freedesktop.network1.set-dnssec-negative-trust-anchors",
        "org.freedesktop.network1.set-domains",
        "org.freedesktop.network1.set-llmnr",
        "org.freedesktop.network1.set-mdns",
        "org.freedesktop.network1.set-ntp-servers",
        "org.freedesktop.network1.set-persistent-storage",
        // systemd-resolved
        "org.freedesktop.resolve1.dump-cache",
        "org.freedesktop.resolve1.dump-server-state",
        "org.freedesktop.resolve1.dump-statistics",
        "org.freedesktop.resolve1.register-service",
        "org.freedesktop.resolve1.reset-statistics",
        "org.freedesktop.resolve1.revert",
        "org.freedesktop.resolve1.set-default-route",
        "org.freedesktop.resolve1.set-dns-over-tls",
        "org.freedesktop.resolve1.set-dns-servers",
        "org.freedesktop.resolve1.set-dnssec",
        "org.freedesktop.resolve1.set-dnssec-negative-trust-anchors",
        "org.freedesktop.resolve1.set-domains",
        "org.freedesktop.resolve1.set-llmnr",
        "org.freedesktop.resolve1.set-mdns",
        "org.freedesktop.resolve1.subscribe-query-results",
        "org.freedesktop.resolve1.unregister-service",
        // ConnMan
        "net.connman.modify",
        "net.connman.secret",
        "net.connman.vpn.modify",
        "net.connman.vpn.secret",
        // 飞行模式 / rfkill
        "org.freedesktop.urfkill.block",
        "org.freedesktop.urfkill.blockidx",
        "org.freedesktop.urfkill.flight_mode",
        // ModemManager
        "org.freedesktop.ModemManager1.Contacts",
        "org.freedesktop.ModemManager1.Control",
        "org.freedesktop.ModemManager1.Device.Control",
        "org.freedesktop.ModemManager1.Firmware",
        "org.freedesktop.ModemManager1.Location",
        "org.freedesktop.ModemManager1.Messaging",
        "org.freedesktop.ModemManager1.Time",
        "org.freedesktop.ModemManager1.USSD",
        "org.freedesktop.ModemManager1.Voice",
        // FirewallD
        "org.fedoraproject.FirewallD1.all",
        "org.fedoraproject.FirewallD1.config",
        "org.fedoraproject.FirewallD1.config.info",
        "org.fedoraproject.FirewallD1.direct",
        "org.fedoraproject.FirewallD1.direct.info",
        "org.fedoraproject.FirewallD1.info",
        "org.fedoraproject.FirewallD1.policies",
        "org.fedoraproject.FirewallD1.policies.info"
    ];

    if (networkActions.indexOf(action.id) !== -1) {
        return polkit.Result.AUTH_ADMIN;  // 所有用户操作网络都需管理员密码
    }
});

// ==================== 强制仅 root 视为管理员 ====================
polkit.addAdminRule(function(action, subject) {
    return ["root"];  // 只有 root 用户能通过 AUTH_ADMIN 认证
});

/etc/systemd/system/remove-kvm-intel.service

js 复制代码

[Unit]
Description=Remove kvm_intel kernel module at boot
After=local-fs.target sysinit.target
Before=multi-user.target

[Service]
Type=oneshot
ExecStart=/sbin/modprobe -r kvm_intel
RemainAfterExit=no
# 如果模块未加载，忽略错误
SuccessExitStatus=0 1

[Install]
WantedBy=multi-user.target