From 244942b8a6f3d7c0d0f0416b9324214afa9e73c8 Mon Sep 17 00:00:00 2001 From: Philip Withnall Date: Wed, 20 May 2026 17:08:03 +0100 Subject: [PATCH] sysupdate: Add separate polkit actions for cancellation This allows us to have a separate, more permissive, policy for cancelling ongoing sysupdate jobs. The new default policy for cancellation actions is to allow them for the active user, without admin authentication, because typically the user can just pull the plug on the computer to cancel a job anyway. Signed-off-by: Philip Withnall Fixes: https://github.com/systemd/systemd/issues/38568 --- man/org.freedesktop.sysupdate1.xml | 19 +++++--- .../org.freedesktop.sysupdate1.policy | 43 +++++++++++++++++++ src/sysupdate/sysupdated.c | 8 ++-- 3 files changed, 61 insertions(+), 9 deletions(-) diff --git a/man/org.freedesktop.sysupdate1.xml b/man/org.freedesktop.sysupdate1.xml index 6c0e86df9f..fea301167e 100644 --- a/man/org.freedesktop.sysupdate1.xml +++ b/man/org.freedesktop.sysupdate1.xml @@ -412,26 +412,35 @@ node /org/freedesktop/sysupdate1/target/host { List(), Describe(), and CheckNew() use the polkit action org.freedesktop.sysupdate1.check. - By default, this action is permitted without administrator authentication. + By default, this action is permitted without administrator authentication. Cancellation of these + methods uses the polkit action org.freedesktop.sysupdate1.cancel-check. + By default, this cancellation action is permitted without administrator authentication. Acquire() and Install() use the polkit action org.freedesktop.sysupdate1.update when no version is specified. By default, this action is permitted without administrator authentication. When a version is specified, org.freedesktop.sysupdate1.update-to-version is - used instead. By default, this alternate action requires administrator authentication. + used instead. By default, this alternate action requires administrator authentication. Cancellation of + these methods uses the polkit actions + org.freedesktop.sysupdate1.cancel-update and + org.freedesktop.sysupdate1.cancel-update-to-version. + By default, these cancellation actions are permitted without administrator authentication. Vacuum() uses the polkit action org.freedesktop.sysupdate1.vacuum. By default, this action requires - administrator authentication. + administrator authentication. Cancellation of this method uses the polkit action + org.freedesktop.sysupdate1.cancel-vacuum. + By default, this cancellation action is permitted without administrator authentication. SetFeatureEnabled() uses the polkit action org.freedesktop.sysupdate1.manage-features. By default, this action - requires administrator authentication. + requires administrator authentication. Cancellation is not supported for this method. GetAppStream(), GetVersion(), ListFeatures(), and DescribeFeature() - are unauthenticated and may be called by anybody. + are unauthenticated and may be called by anybody. Cancellation is not supported for these methods, or + is always allowed without administrator authentication. All methods called on this interface expose additional variables to the polkit rules. class contains the class of the Target being acted upon, and name diff --git a/src/sysupdate/org.freedesktop.sysupdate1.policy b/src/sysupdate/org.freedesktop.sysupdate1.policy index 8b7fa420c2..2d3abdc742 100644 --- a/src/sysupdate/org.freedesktop.sysupdate1.policy +++ b/src/sysupdate/org.freedesktop.sysupdate1.policy @@ -29,6 +29,9 @@ a user at the console, and rpm-ostree (generally) needs an "administrative user" at the computer. Without this default, distributions hoping to use sysupdate as an update mechanism will have to set the policy to it anyhow. + + Cancellation actions are always allowed by default, as the user can typically pull the plug on + the computer to prevent an action completing anyway. --> @@ -41,6 +44,16 @@ + + Cancel checking for system updates + Authentication is required to cancel checking for system updates. + + auth_admin + auth_admin + yes + + + Install system updates Authentication is required to install system updates. @@ -51,6 +64,16 @@ + + Cancel installing system updates + Authentication is required to cancel installing system updates. + + auth_admin + auth_admin + yes + + + Install specific system version Authentication is required to update the system to a specific (possibly old) version. @@ -61,6 +84,16 @@ + + Cancel installing specific system version + Authentication is required to cancel updating the system to a specific (possibly old) version. + + auth_admin + auth_admin + yes + + + Cleanup old system updates Authentication is required to cleanup old system updates. @@ -71,6 +104,16 @@ + + Cancel cleaning up old system updates + Authentication is required to cancel cleanup of old system updates. + + auth_admin + auth_admin + yes + + + Manage optional features Authentication is required to manage optional features. diff --git a/src/sysupdate/sysupdated.c b/src/sysupdate/sysupdated.c index 3d696baa75..359fb50b91 100644 --- a/src/sysupdate/sysupdated.c +++ b/src/sysupdate/sysupdated.c @@ -595,19 +595,19 @@ static int job_method_cancel(sd_bus_message *msg, void *userdata, sd_bus_error * case JOB_LIST: case JOB_DESCRIBE: case JOB_CHECK_NEW: - action = "org.freedesktop.sysupdate1.check"; + action = "org.freedesktop.sysupdate1.cancel-check"; break; case JOB_ACQUIRE: case JOB_INSTALL: if (j->version) - action = "org.freedesktop.sysupdate1.update-to-version"; + action = "org.freedesktop.sysupdate1.cancel-update-to-version"; else - action = "org.freedesktop.sysupdate1.update"; + action = "org.freedesktop.sysupdate1.cancel-update"; break; case JOB_VACUUM: - action = "org.freedesktop.sysupdate1.vacuum"; + action = "org.freedesktop.sysupdate1.cancel-vacuum"; break; case JOB_DESCRIBE_FEATURE: