Skip to content

Enforce that calling CheckAuthorization() with pidfd also is passed a uid

Luca Boccassi requested to merge bluca/polkit:check_auth_pidfd into master

When unix-process is used and a uid is not passed, it will be derived from the running process. But this is racy, as the identity can change over time (e.g.: setuid binaries can be exec'ed). If the caller can securely fetch the pidfd of a process (e.g.: via SO_PEERPIDFD), then it can also securely fetch the uid (e.g.: via SO_PEERSEC), so enforce that they are passed together to avoid possible races, in case a polkit rule performs authorization based on the uid.

Edited by Luca Boccassi

Merge request reports