summaryrefslogtreecommitdiffstats
path: root/src/shared/bus-polkit.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* polkit: map POLKIT_ALWAYS_QUERY to new polkit flagLuca Boccassi2024-07-181-12/+9
| | | | | | | | | | | polkitd by default just waves through requests from a root process. A new POLKIT_CHECK_AUTHORIZATION_FLAGS_ALWAYS_CHECK flag was added to main (will be part of v125 when it ships) that forces it to go through the policy checks for root too. Previous versions will just ignore it. Change the flags handling slightly so that we pass this or the interactive flags through, as the values match what polkit expects.
* sd-varlink: make our internal Varlink API public as sd-varlink.[ch]Lennart Poettering2024-07-161-18/+19
| | | | | | | | | | It's time. sd-json was already done earlier in this cycle, let's now make sd-varlink public too. This is mostly just a search/replace job of epical proportions. I left some functions internal (mostly IDL handling), and I turned some static inline calls into regular calls.
* hostnamed: if polkit authentication fails for Varlink Describe() call, don't ↵Lennart Poettering2024-06-271-5/+7
| | | | | | | | | | | | | reply to client with an error The logic of the Describe() call was supposed to be: if we can acquire the PK priv to get the product UUID then let's return the product UUID, and if we cannot then return the data without it. This didn't work however, since the polkit varlink glue would immediately propagate the error it acquired from polkit its own client. Let's turn this off, optionally, so that hostnamed can handle this nicely.
* libsystemd: turn json.[ch] into a public APILennart Poettering2024-06-121-5/+5
| | | | | | | | | | | | | | | This is preparation for making our Varlink API a public API. Since our Varlink API is built on top of our JSON API we need to make that public first (it's a nice API, but JSON APIs there are already enough, this is purely about the Varlink angle). I made most of the json.h APIs public, and just placed them in sd-json.h. Sometimes I wasn't so sure however, since the underlying data structures would have to be made public too. If in doubt I didn#t risk it, and moved the relevant API to src/libsystemd/sd-json/json-util.h instead (without any sd_* symbol prefixes). This is mostly a giant search/replace patch.
* core: Pass NULL error in dump_impl()Daan De Meyer2024-04-291-3/+2
| | | | | | | | | | | | | If mac_selinux_access_check() or bus_verify_bypass_dump_ratelimit_async() fail, we goto "ratelimited" where we set a custom D-BUS error. In "ratelimited", we call sd_bus_error_setf() which eventually hits an assert_return(!bus_error_is_dirty()). Avoid hitting this assertion by passing NULL as the error to mac_selinux_access_check() and bus_verify_bypass_dump_ratelimit_async() since we will override the error immediately anyway if either fails. We modify both functions as well to allow passing a NULL error and fix the argument name as well while we're at it.
* bus-polkit: fix return value for `varlink_allow_interactive_authentication()`Antonio Alvarez Feijoo2024-04-121-2/+4
| | | | Follow-up for d04c1a1c8e7c95daa483d8d52d5fc4c25fbc67f2
* polkit: add another flag that controls how to treat the PK absent caseLennart Poettering2024-03-131-29/+53
| | | | | | | | | | | | | Typically if PK is not present we want to treat this as "denied". But sometimes it makes sense to treat this case as "allowed". In particular the combination POLKIT_ALWAYS_QUERY and POLKIT_DEFAULT_ALLOW makes a lot of sense: it means we can enable PK logic for actions where we so far bypassed the checks for root. With the new combination we can have a default policy of allowing some operation but still provide an effective hook to disable it. Also add some debug logging about PK operations and results as they are ongoing.
* polkit: add new POLKIT_ALWAYS_QUERY flagLennart Poettering2024-03-131-8/+13
| | | | | | | | | When this flag is set we'll disable the local shortcut that skips polkit checks for clients that are privileged, and assumes they are authenticated. Or in other words: if this flag is set, we'll query PK not matter what, regardless if it's root we talk about or any other user.
* polkit: allow checking if we already acquired some actionLennart Poettering2024-03-131-4/+35
| | | | | | | This adds a new helper that basically just wraps async_polkit_query_have_action() and allows calling this without actually triggering a PK authentication operation: it just checks if we aleady have acquired an action or not.
* polkit: turn "interactive" flag to polkit APIs into a proper flags field ↵Lennart Poettering2024-03-111-4/+8
| | | | | | | | | | | | (#31715) This adds for both the D-Bus and the Varlink flavours of our polkit client api a flags parameter. And then folds the "bool interactive" flag that the D-Bus version so far had, into a flag, and also adds support for it in the Varlink API. Since this means the Varlink API gained another parameter, let's do what we already did for the D-Bus API and add a _full() version of the API that has the flags and the good_uid parameter, and one without both.
* polkit: trivial simplificationLennart Poettering2024-03-111-5/+1
|
* bus-polkit: don't return positive in varlink_verify_polkit_async() just ↵Lennart Poettering2024-01-161-4/+3
| | | | | | | | | because we already sent an error reply A positive return value means "access granted", hence if we already reply to the method call don't accidentally return positive. Follow-up for: d04c1a1c8e7c95daa483d8d52d5fc4c25fbc67f2
* bus-polkit: explicitly cast away return value we ignoreLennart Poettering2024-01-161-1/+1
|
* bus-polkit: treat various well-known PK errors as deniedLennart Poettering2024-01-161-2/+7
| | | | | | | | Various recognizable errors from https://www.freedesktop.org/software/polkit/docs/latest/eggdbus-interface-org.freedesktop.PolicyKit1.Authority.html#eggdbus-errordomain-org.freedesktop.PolicyKit1.Error. should be considered access failures, hence treat them like that.
* bus-polkit: fix memory leakLennart Poettering2024-01-081-4/+8
| | | | | | | We need to destroy the hashmap entry keyed by the varlink object in case this is a varlink request. Follow-up for: d04c1a1c8e7c95daa483d8d52d5fc4c25fbc67f2
* bus-polkit: port polkit_registry to use value destructors in hash_opsLennart Poettering2024-01-031-11/+10
|
* bus-polkit: add support for authenticating varlink peers via polkitLennart Poettering2024-01-031-22/+264
| | | | | | | | | | | | | This extends our current polkit logic, so that we can in a very similar fashion as we already can authenticate dbus peers authenticate varlink connection peers. polkit natively speaks dbus and can authentication dbus peers. To get the same level of support for varlink we'll use authentication by pidfd+uid. This requires polkit v124, and if that's not available it will fallback to authorizing root only as before. Co-authored-by: Luca Boccassi <bluca@debian.org>
* polkit: simplify bus_verify_polkit_async() + drop auth-by-cap dbus featureLennart Poettering2023-12-211-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This simplifies bus_verify_polkit_async() and related calls quite a bit: 1. This removes any support for authentication-by-Linux-capability. This is ultimately a kdbus leftover: with classic AF_UNIX transports we cannot authenticate by capabilities securely (because we cannot acquire it from the peer without races), hence we never actually did. Since the necessary kernel work didn't materialize in the last 10y, and is unlikely to be added, let's just kill this context. We cannot quite remove the caps stuff from sd-bus for API compat, but for our polkit logic let's kill it. 2. The "good_uid" and "interactive" params are only necessary in very few cases, hence let's move them to a new call bus_verify_polkit_async_full() and make bus_verify_polkit_async() a wrapper around it without those two parameters. This also fixes a bunch of wrong uses of the "interactive" bool. The bool makes no sense today as the ALLOW_INTERACTIVE_AUTHORIZATION field in the D-Bus message header replaces it fully. We only need it to implement method calls we introduced prior to that header field becoming available in D-Bus. And it should only be used on such old method calls, and otherwise always be set to false. This does not change behaviour in any way. Just simplifies stuff. Fixes: #21586
* hostname: Make sure we pass error to bus_verify_polkit_async()Daan De Meyer2023-08-241-0/+1
| | | | Fixes #28943
* Merge pull request #28832 from dtardon/list-clearLuca Boccassi2023-08-171-4/+1
|\ | | | | Add LIST_CLEAR() helper that empties the list
| * tree-wide: use LIST_CLEAR()David Tardon2023-08-171-4/+1
| |
* | bus-polkit: don't propagate error from polkitDavid Tardon2023-08-171-7/+10
|/ | | | | | | | | An error reply from polkit is a valid case and should not be propagated as failure of async_polkit_callback(). It should only be saved here. It'll be returned by bus_verify_polkit_async() later, when it's called for the same method again. Follow-up for #26365.
* Merge pull request #28736 from poettering/polkit-tweaksLennart Poettering2023-08-101-10/+6
|\ | | | | some minor polkit handling tweaks
| * polkit: move asserts up, so that they cover all reply codepathsLennart Poettering2023-08-091-7/+5
| |
| * polkit: use LIST_POP where appropriateLennart Poettering2023-08-091-3/+1
| |
* | tree-wide: drop _pure_ + _const_ from local, static functionsLennart Poettering2023-08-091-1/+1
|/ | | | | | | | | | | This is supposed to be a help for compilers to apply optimizations on functions where they can't determine whether they are const/pure on their own. For static, local functions the compiler can do this on its own easily however, hence the decoration with pure/const is just noise. Let's drop it, and let the compiler to its thing better. (Use it for exported functions, since compilers can't 'reach-over' into other modules to determine if they are pure, except if LTO is used)
* bus-polkit: avoid extra variableDavid Tardon2023-07-131-6/+6
|
* bus-polkit: allow to auth. a bus call for multiple actionsDavid Tardon2023-07-131-53/+87
| | | | | | | | | In #20155, verify_shutdown_creds() needs to authenticate for both org.freedesktop.login1.hibernate-multiple-sessions and org.freedesktop.login1.hibernate-ignore-inhibit . Previously, the second authentication attempt would fail with -ESTALE. Fixes #20155.
* bus-polkit: parse reply from polkit on receiveDavid Tardon2023-07-131-44/+77
| | | | ... and store just the result.
* bus-polkit: extract action into a separate structDavid Tardon2023-07-131-7/+24
| | | | This is a preparation for later commits.
* bus-polkit: describe async. polkit verificationDavid Tardon2023-07-131-0/+74
|
* bus-polkit: refactor a bit to avoid gotoDavid Tardon2023-07-131-11/+20
|
* bus-polkit: drop unused argumentDavid Tardon2023-07-131-3/+1
|
* bus-polkit: use automatic cleanupDavid Tardon2023-07-131-13/+10
|
* bus-polkit: put function params to a single lineDavid Tardon2023-06-191-4/+1
|
* bus-polkit: drop unnecessary elseDavid Tardon2023-06-191-2/+2
|
* bus-polkit: merge variable declarationsDavid Tardon2023-06-191-2/+1
|
* bus-polkit: decrease indentationDavid Tardon2023-06-191-28/+27
|
* bus-polkit: extract creation of polkit call to a functionDavid Tardon2023-06-191-56/+47
|
* bus-polkit: move verification to a separate functionDavid Tardon2023-06-191-42/+58
|
* bus-polkit: return NULL from _free functionDavid Tardon2023-06-161-3/+4
|
* bus-polkit: add an assertDavid Tardon2023-06-161-1/+1
|
* tree-wide: use ASSERT_PTR moreDavid Tardon2022-09-131-2/+1
|
* tree-wide: Simplify variable declarations behind #ifdefJan Janssen2022-04-231-7/+4
|
* strv: make iterator in STRV_FOREACH() declaread in the loopYu Watanabe2022-03-191-1/+0
| | | | This also avoids multiple evaluations in STRV_FOREACH_BACKWARDS()
* polkit: make bus_verify_polkit_async_registry_free() return Hashmap* with NULLYu Watanabe2021-12-141-2/+5
|
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* various: treat BUS_ERROR_NO_SUCH_UNIT the same as SD_BUS_ERROR_SERVICE_UNKNOWNZbigniew Jędrzejewski-Szmek2020-08-241-3/+3
| | | | | | | | | | | | | | | | We return BUS_ERROR_NO_SUCH_UNIT a.k.a. org.freedesktop.systemd1.NoSuchUnit in various places. In #16813: Aug 22 06:14:48 core sudo[2769199]: pam_systemd_home(sudo:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found. Aug 22 06:14:48 core dbus-daemon[5311]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found. Aug 22 06:14:48 core dbus-daemon[5311]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.6564' (uid=0 pid=2769199 comm="sudo su ") This particular error comes from bus_unit_validate_load_state() in pid1: case UNIT_NOT_FOUND: return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not found.", u->id); It seems possible that we should return a different error, but it doesn't really matter: if we change pid1 to return a different error, we still need to handle BUS_ERROR_NO_SUCH_UNIT as in this patch to handle pid1 with current code.
* polkit: remove unused variableYu Watanabe2020-02-051-1/+0
| | | | Follow-up for 637486261528e8aa3da9f26a4487dc254f4b7abb.
* Fix typo in function nameZbigniew Jędrzejewski-Szmek2020-02-041-1/+1
|
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 03:16:37 +0100