#!/bin/sh
# Launch Charter Recovery as root (pause / resume / turn off enforcement, and
# thaw the box), passing the parent's X session through pkexec so the dialog can
# draw. pkexec prompts for the parent's (admin) password; 49-charter.rules denies
# the managed child, and charter-recovery itself refuses any non-root caller.
exec pkexec env \
    DISPLAY="${DISPLAY:-:0}" \
    XAUTHORITY="${XAUTHORITY:-$HOME/.Xauthority}" \
    /usr/sbin/charter-recovery
