# Allow the pixworker service user/group to queue the root-owned package update
# unit. The update unit owns apt and restart privileges; this rule does not grant
# arbitrary systemctl access.
%pixworker ALL=(root) NOPASSWD: /bin/systemctl start --no-block pixworker-update.service, /usr/bin/systemctl start --no-block pixworker-update.service
%pixworker ALL=(root) NOPASSWD: /bin/systemctl start pixworker-refresh-apt.service, /usr/bin/systemctl start pixworker-refresh-apt.service
