SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

polkit: turn "interactive" flag to polkit APIs into a proper flags field (#31715)

Browse Source 
This adds for both the D-Bus and the Varlink flavours of our polkit
client api a flags parameter. And then folds the "bool interactive" flag
that the D-Bus version so far had, into a flag, and also adds support
for it in the Varlink API.

Since this means the Varlink API gained another parameter, let's do what
we already did for the D-Bus API and add a _full() version of the API
that has the flags and the good_uid parameter, and one without both.
This commit is contained in:
Lennart Poettering
2024-03-11 11:57:45 +00:00
committed by GitHub
parent ed01b92e1c
commit 29556b75d8
9 changed files with 34 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/bus-polkit.c
+8 -4
View File
@@ -497,8 +497,8 @@ int bus_verify_polkit_async_full(
sd_bus_message *call,
const char *action,
const char **details,
bool interactive, /* Use only for legacy method calls that have a separate "allow_interactive_authentication" field */
uid_t good_user,
PolkitFlags flags,
Hashmap **registry,
sd_bus_error *ret_error) {
@@ -533,7 +533,7 @@ int bus_verify_polkit_async_full(
return 1;
#if ENABLE_POLKIT
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
bool interactive = FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE);
int c = sd_bus_message_get_allow_interactive_authorization(call);
if (c < 0)
@@ -541,6 +541,7 @@ int bus_verify_polkit_async_full(
if (c > 0)
interactive = true;
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
r = bus_message_new_polkit_auth_call_for_bus(call, action, details, interactive, &pk);
if (r < 0)
return r;
@@ -707,12 +708,13 @@ static bool varlink_allow_interactive_authentication(Varlink *link) {
}
#endif
int varlink_verify_polkit_async(
int varlink_verify_polkit_async_full(
Varlink *link,
sd_bus *bus,
const char *action,
const char **details,
uid_t good_user,
PolkitFlags flags,
Hashmap **registry) {
int r;
@@ -766,7 +768,9 @@ int varlink_verify_polkit_async(
bus = mybus;
}
bool interactive = varlink_allow_interactive_authentication(link);
bool interactive =
FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE) ||
varlink_allow_interactive_authentication(link);
_cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
r = bus_message_new_polkit_auth_call_for_varlink(bus, link, action, details, interactive, &pk);
src/shared/bus-polkit.h
+10 -3
View File
@@ -7,14 +7,21 @@
#include "user-util.h"
#include "varlink.h"
typedef enum PolkitFLags {
POLKIT_ALLOW_INTERACTIVE = 1 << 0, /* Allow interactive auth (typically not required, because can be derived from bus message/link automatically) */
} PolkitFlags;
int bus_test_polkit(sd_bus_message *call, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);
int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, bool interactive, uid_t good_user, Hashmap **registry, sd_bus_error *error);
int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry, sd_bus_error *error);
static inline int bus_verify_polkit_async(sd_bus_message *call, const char *action, const char **details, Hashmap **registry, sd_bus_error *ret_error) {
return bus_verify_polkit_async_full(call, action, details, false, UID_INVALID, registry, ret_error);
return bus_verify_polkit_async_full(call, action, details, UID_INVALID, 0, registry, ret_error);
}
int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, Hashmap **registry);
int varlink_verify_polkit_async_full(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry);
static inline int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, Hashmap **registry) {
return varlink_verify_polkit_async_full(link, bus, action, details, UID_INVALID, 0, registry);
}
/* A JsonDispatch initializer that makes sure the allowInteractiveAuthentication boolean field we want for
* polkit support in Varlink calls is ignored while regular dispatching (and does not result in errors