SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

polkit: turn "interactive" flag to polkit APIs into a proper flags field (#31715)

Browse Source 
This adds for both the D-Bus and the Varlink flavours of our polkit
client api a flags parameter. And then folds the "bool interactive" flag
that the D-Bus version so far had, into a flag, and also adds support
for it in the Varlink API.

Since this means the Varlink API gained another parameter, let's do what
we already did for the D-Bus API and add a _full() version of the API
that has the flags and the good_uid parameter, and one without both.
This commit is contained in:
Lennart Poettering
2024-03-11 11:57:45 +00:00
committed by GitHub
parent ed01b92e1c
commit 29556b75d8
9 changed files with 34 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/creds/creds.c
-2
View File
@@ -1192,7 +1192,6 @@ static int vl_method_encrypt(Varlink *link, JsonVariant *parameters, VarlinkMeth
/* bus= */ NULL,
"io.systemd.credentials.encrypt",
/* details= */ NULL,
/* good_user= */ UID_INVALID,
polkit_registry);
if (r <= 0)
return r;
@@ -1297,7 +1296,6 @@ static int vl_method_decrypt(Varlink *link, JsonVariant *parameters, VarlinkMeth
/* bus= */ NULL,
"io.systemd.credentials.decrypt",
/* details= */ NULL,
/* good_user= */ UID_INVALID,
polkit_registry);
if (r <= 0)
return r;
src/home/homed-home-bus.c
+2 -3
View File
@@ -97,13 +97,12 @@ static int home_verify_polkit_async(
message,
action,
details,
/* interactive= */ false,
good_uid,
/* flags= */ 0,
&h->manager->polkit_registry,
error);
}
int bus_home_get_record_json(
Home *h,
sd_bus_message *message,
@@ -185,8 +184,8 @@ int bus_home_method_activate(
message,
"org.freedesktop.home1.activate-home",
/* details= */ NULL,
/* interctive= */ false,
h->uid,
/* flags= */ 0,
&h->manager->polkit_registry,
error);
if (r < 0)
src/hostname/hostnamed.c
+4 -5
View File
@@ -1111,8 +1111,8 @@ static int method_set_hostname(sd_bus_message *m, void *userdata, sd_bus_error *
m,
"org.freedesktop.hostname1.set-hostname",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -1157,8 +1157,8 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
m,
"org.freedesktop.hostname1.set-static-hostname",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -1235,8 +1235,8 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
m,
prop == PROP_PRETTY_HOSTNAME ? "org.freedesktop.hostname1.set-static-hostname" : "org.freedesktop.hostname1.set-machine-info",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -1312,8 +1312,8 @@ static int method_get_product_uuid(sd_bus_message *m, void *userdata, sd_bus_err
m,
"org.freedesktop.hostname1.get-product-uuid",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -1651,7 +1651,6 @@ static int vl_method_describe(Varlink *link, JsonVariant *parameters, VarlinkMet
c->bus,
"org.freedesktop.hostname1.get-hardware-serial",
/* details= */ NULL,
/* good_user= */ UID_INVALID,
&c->polkit_registry);
if (r == 0)
return 0; /* No authorization for now, but the async polkit stuff will call us again when it has it */
src/locale/localed.c
+3 -3
View File
@@ -286,8 +286,8 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
m,
"org.freedesktop.locale1.set-locale",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -390,8 +390,8 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
m,
"org.freedesktop.locale1.set-keyboard",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
@@ -509,8 +509,8 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
m,
"org.freedesktop.locale1.set-keyboard",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&c->polkit_registry,
error);
if (r < 0)
src/login/logind-dbus.c
+2 -2
View File
@@ -1442,8 +1442,8 @@ static int method_set_user_linger(sd_bus_message *message, void *userdata, sd_bu
uid == auth_uid ? "org.freedesktop.login1.set-self-linger" :
"org.freedesktop.login1.set-user-linger",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&m->polkit_registry,
error);
if (r < 0)
@@ -1614,8 +1614,8 @@ static int method_attach_device(sd_bus_message *message, void *userdata, sd_bus_
message,
"org.freedesktop.login1.attach-device",
/* details= */ NULL,
interactive,
/* good_user= */ UID_INVALID,
interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
&m->polkit_registry,
error);
if (r < 0)
src/login/logind-session-dbus.c
+3 -3
View File
@@ -162,8 +162,8 @@ int bus_session_method_terminate(sd_bus_message *message, void *userdata, sd_bus
message,
"org.freedesktop.login1.manage",
/* details= */ NULL,
/* interactive= */ false,
s->user->user_record->uid,
/* flags= */ 0,
&s->manager->polkit_registry,
error);
if (r < 0)
@@ -207,8 +207,8 @@ int bus_session_method_lock(sd_bus_message *message, void *userdata, sd_bus_erro
message,
"org.freedesktop.login1.lock-sessions",
/* details= */ NULL,
/* interactive= */ false,
s->user->user_record->uid,
/* flags= */ 0,
&s->manager->polkit_registry,
error);
if (r < 0)
@@ -317,8 +317,8 @@ int bus_session_method_kill(sd_bus_message *message, void *userdata, sd_bus_erro
message,
"org.freedesktop.login1.manage",
/* details= */ NULL,
/* interactive= */ false,
s->user->user_record->uid,
/* flags= */ 0,
&s->manager->polkit_registry,
error);
if (r < 0)
src/login/logind-user-dbus.c
+2 -2
View File
@@ -196,8 +196,8 @@ int bus_user_method_terminate(sd_bus_message *message, void *userdata, sd_bus_er
message,
"org.freedesktop.login1.manage",
/* details= */ NULL,
/* interactive= */ false,
u->user_record->uid,
/* flags= */ 0,
&u->manager->polkit_registry,
error);
if (r < 0)
@@ -223,8 +223,8 @@ int bus_user_method_kill(sd_bus_message *message, void *userdata, sd_bus_error *
message,
"org.freedesktop.login1.manage",
/* details= */ NULL,
/* interactive= */ false,
u->user_record->uid,
/* flags= */ 0,
&u->manager->polkit_registry,
error);
if (r < 0)
src/shared/bus-polkit.c
+8 -4
View File
@@ -497,8 +497,8 @@ int bus_verify_polkit_async_full(
sd_bus_message *call,
const char *action,
const char **details,
bool interactive, /* Use only for legacy method calls that have a separate "allow_interactive_authentication" field */
uid_t good_user,
PolkitFlags flags,
Hashmap **registry,
sd_bus_error *ret_error) {
@@ -533,7 +533,7 @@ int bus_verify_polkit_async_full(
return 1;
#if ENABLE_POLKIT
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
bool interactive = FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE);
int c = sd_bus_message_get_allow_interactive_authorization(call);
if (c < 0)
@@ -541,6 +541,7 @@ int bus_verify_polkit_async_full(
if (c > 0)
interactive = true;
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
r = bus_message_new_polkit_auth_call_for_bus(call, action, details, interactive, &pk);
if (r < 0)
return r;
@@ -707,12 +708,13 @@ static bool varlink_allow_interactive_authentication(Varlink *link) {
}
#endif
int varlink_verify_polkit_async(
int varlink_verify_polkit_async_full(
Varlink *link,
sd_bus *bus,
const char *action,
const char **details,
uid_t good_user,
PolkitFlags flags,
Hashmap **registry) {
int r;
@@ -766,7 +768,9 @@ int varlink_verify_polkit_async(
bus = mybus;
}
bool interactive = varlink_allow_interactive_authentication(link);
bool interactive =
FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE) ||
varlink_allow_interactive_authentication(link);
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
r = bus_message_new_polkit_auth_call_for_varlink(bus, link, action, details, interactive, &pk);
src/shared/bus-polkit.h
+10 -3
View File
@@ -7,14 +7,21 @@
#include "user-util.h"
#include "varlink.h"
typedef enum PolkitFLags {
POLKIT_ALLOW_INTERACTIVE = 1 << 0, /* Allow interactive auth (typically not required, because can be derived from bus message/link automatically) */
} PolkitFlags;
int bus_test_polkit(sd_bus_message *call, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);
int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, bool interactive, uid_t good_user, Hashmap **registry, sd_bus_error *error);
int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry, sd_bus_error *error);
static inline int bus_verify_polkit_async(sd_bus_message *call, const char *action, const char **details, Hashmap **registry, sd_bus_error *ret_error) {
return bus_verify_polkit_async_full(call, action, details, false, UID_INVALID, registry, ret_error);
return bus_verify_polkit_async_full(call, action, details, UID_INVALID, 0, registry, ret_error);
}
int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, Hashmap **registry);
int varlink_verify_polkit_async_full(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry);
static inline int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, Hashmap **registry) {
return varlink_verify_polkit_async_full(link, bus, action, details, UID_INVALID, 0, registry);
}
/* A JsonDispatch initializer that makes sure the allowInteractiveAuthentication boolean field we want for
* polkit support in Varlink calls is ignored while regular dispatching (and does not result in errors