Commit bed2fe1c authored by David Zeuthen's avatar David Zeuthen

rewrite authorization database and polkit-grant (now known as polkit-auth)

Also,

 - Rename polkit-list-actions to polkit-action.
 - Add a bash completion script to the polkit commandline tools.

Authorizations are no longer world-readable. So for this to work with
hal you now need to do this as root

 # polkit-auth --user haldaemon --grant org.freedesktop.policykit.read

Distributions needs to do this in the %post scripts or similar.

Sorry for this huge monster patch.
parent e3281015
## Process this file with automake to produce Makefile.in
SUBDIRS = data polkit polkit-dbus polkit-grant doc tools policy
SUBDIRS = data polkit polkit-dbus polkit-grant doc tools policy po
# Creating ChangeLog from git log (taken from cairo/Makefile.am):
ChangeLog: $(srcdir)/ChangeLog
......@@ -21,7 +21,18 @@ $(srcdir)/ChangeLog:
.PHONY: ChangeLog $(srcdir)/ChangeLog
EXTRA_DIST = HACKING mkinstalldirs ChangeLog
EXTRA_DIST = \
HACKING \
mkinstalldirs \
ChangeLog \
intltool-extract.in \
intltool-merge.in \
intltool-update.in
DISTCLEANFILES = \
intltool-extract \
intltool-merge \
intltool-update
# xsltproc barfs on 'make distcheck'; disable for now
DISTCHECK_CONFIGURE_FLAGS=--disable-man-pages
......
......@@ -82,6 +82,8 @@ esac
echo "Running autoconf ..."
autoconf
intltoolize --copy --force --automake || exit 1
conf_flags="--enable-maintainer-mode --enable-gtk-doc"
if test x$NOCONFIGURE = x; then
......
......@@ -25,6 +25,7 @@ AM_PROG_LIBTOOL
AC_PROG_MAKE_SET
AC_PROG_LN_S
AC_SYS_LARGEFILE
AM_PROG_CC_C_O
# Taken from dbus
AC_ARG_ENABLE(ansi, [ --enable-ansi enable -ansi -pedantic gcc flags],enable_ansi=$enableval,enable_ansi=no)
......@@ -366,6 +367,17 @@ AC_DEFINE_UNQUOTED(PAM_FILE_INCLUDE_ACCOUNT, "$PAM_FILE_INCLUDE_ACCOUNT", [pam f
AC_DEFINE_UNQUOTED(PAM_FILE_INCLUDE_PASSWORD, "$PAM_FILE_INCLUDE_PASSWORD", [pam file password])
AC_DEFINE_UNQUOTED(PAM_FILE_INCLUDE_SESSION, "$PAM_FILE_INCLUDE_SESSION", [pam file session])
# ********************
# Internationalisation
# ********************
IT_PROG_INTLTOOL([0.36.0])
GETTEXT_PACKAGE=PolicyKit
AC_SUBST([GETTEXT_PACKAGE])
AM_GLIB_GNU_GETTEXT
AC_DEFINE_UNQUOTED([GETTEXT_PACKAGE],["$GETTEXT_PACKAGE"],[gettext domain])
AC_OUTPUT([
Makefile
data/Makefile
......@@ -381,6 +393,7 @@ doc/Makefile
doc/version.xml
doc/man/Makefile
policy/Makefile
po/Makefile.in
])
dnl ==========================================================================
......@@ -421,13 +434,24 @@ echo "
Building man pages: ${enable_man_pages}
"
echo "NOTE: Remember to create user '${POLKIT_USER}' and group '${POLKIT_GROUP}' before 'make install'"
echo "NOTE: Remember to create user '${POLKIT_USER}' and group '${POLKIT_GROUP}'"
echo " before 'make install'"
echo
echo "NOTE: The directories ${localstatedir}/run/PolicyKit and ${localstatedir}/lib/PolicyKit will be"
echo " owned by group '${POLKIT_GROUP}' and will be of mode 770."
echo
echo "NOTE: ${libexecdir}/polkit-read-auth-helper will be owned by group"
echo " '${POLKIT_GROUP}', and installed with mode 2755 (setgid binary)."
echo
echo "NOTE: ${libexecdir}/polkit-revoke-helper will be owned by group"
echo " '${POLKIT_GROUP}', and installed with mode 2755 (setgid binary)."
echo
echo "NOTE: ${libexecdir}/polkit-grant-helper will be owned by group"
echo " '${POLKIT_USER}', and installed with mode 2755 (setgid binary)."
echo " The directories ${localstatedir}/run/PolicyKit and ${localstatedir}/lib/PolicyKit will be"
echo " owned by user '${POLKIT_USER}' and group '${POLKIT_GROUP}' and will be of mode 775."
echo " '${POLKIT_GROUP}', and installed with mode 2755 (setgid binary)."
echo
echo "NOTE: ${libexecdir}/polkit-grant-helper-pam will be setuid root."
......
......@@ -50,8 +50,8 @@ content_files = \
version.xml \
man/PolicyKit.xml \
man/PolicyKit.conf.xml \
man/polkit-grant.xml \
man/polkit-list-actions.xml \
man/polkit-auth.xml \
man/polkit-action.xml \
man/polkit-policy-file-validate.xml \
man/polkit-config-file-validate.xml \
spec/polkit-spec-configuration.xml \
......
if MAN_PAGES_ENABLED
man_MANS = polkit-grant.1 \
polkit-list-actions.1 \
man_MANS = polkit-auth.1 \
polkit-action.1 \
polkit-config-file-validate.1 \
polkit-policy-file-validate.1 \
PolicyKit.conf.5 \
PolicyKit.8
# TODO:
%.1 %.5 %.8 : %.xml
$(XSLTPROC) -nonet http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl $<
......@@ -17,8 +16,8 @@ endif # MAN_PAGES_ENABLED
EXTRA_DIST= PolicyKit.conf.xml \
PolicyKit.xml \
polkit-config-file-validate.xml \
polkit-grant.xml \
polkit-list-actions.xml \
polkit-auth.xml \
polkit-action.xml \
polkit-policy-file-validate.xml
clean-local:
......
......@@ -279,7 +279,7 @@
the top-level <emphasis>config</emphasis> are omitted in the
following configuration file examples. The actions used may
also be fictional,
use <citerefentry><refentrytitle>polkit-list-actions</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
use <citerefentry><refentrytitle>polkit-action</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
to learn about the actions available on your system.
</para>
......@@ -378,10 +378,10 @@
<refentrytitle>polkit-config-file-validate</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-list-actions</refentrytitle><manvolnum>1</manvolnum>
<refentrytitle>polkit-action</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-grant</refentrytitle><manvolnum>1</manvolnum>
<refentrytitle>polkit-auth</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
</para>
</refsect1>
......
......@@ -55,10 +55,10 @@
<refentrytitle>PolicyKit.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-list-actions</refentrytitle><manvolnum>1</manvolnum>
<refentrytitle>polkit-action</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-grant</refentrytitle><manvolnum>1</manvolnum>
<refentrytitle>polkit-auth</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
</para>
</refsect1>
......
<refentry id="polkit-list-actions.1">
<refentry id="polkit-action.1">
<refentryinfo>
<title>polkit-list-actions</title>
<title>polkit-action</title>
<date>August 2007</date>
<productname>PolicyKit</productname>
</refentryinfo>
<refmeta>
<refentrytitle>polkit-list-actions</refentrytitle>
<refentrytitle>polkit-action</refentrytitle>
<manvolnum>1</manvolnum>
<refmiscinfo class="version"></refmiscinfo>
</refmeta>
<refnamediv>
<refname>polkit-list-actions</refname>
<refname>polkit-action</refname>
<refpurpose>List registered PolicyKit actions</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>polkit-list-actions</command>
<command>polkit-action</command>
<arg><option>--action <replaceable>action</replaceable></option></arg>
<arg><option>--version</option></arg>
<arg><option>--help</option></arg>
......@@ -28,8 +28,8 @@
<refsect1>
<title>DESCRIPTION</title>
<para>
polkit-list-actions is used to list the PolicyKit actions
that are registered on the system.
polkit-action is used to list the PolicyKit actions that are
registered on the system.
</para>
</refsect1>
......@@ -64,6 +64,19 @@
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>COMPLETION</title>
<para>
PolicyKit ships with a collection of shell functions such that
completion on actions works when using the
<citerefentry>
<refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
shell. For polkit-action, completion is enabled for
the <option>--action</option> argument.
</para>
</refsect1>
<refsect1>
<title>BUGS</title>
......@@ -85,7 +98,7 @@
<refentrytitle>PolicyKit.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-grant</refentrytitle><manvolnum>1</manvolnum>
<refentrytitle>polkit-auth</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
</para>
</refsect1>
......
<refentry id="polkit-auth.1">
<refentryinfo>
<title>polkit-auth</title>
<date>August 2007</date>
<productname>PolicyKit</productname>
</refentryinfo>
<refmeta>
<refentrytitle>polkit-auth</refentrytitle>
<manvolnum>1</manvolnum>
<refmiscinfo class="version"></refmiscinfo>
</refmeta>
<refnamediv>
<refname>polkit-auth</refname>
<refpurpose>Manage authorizations</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>polkit-auth</command>
<arg><option>--obtain <replaceable>action</replaceable></option></arg>
<arg><option>--show-obtainable</option></arg>
<arg><option><arg><option>--user <replaceable>user</replaceable></option></arg> --explicit</option></arg>
<arg><option><arg><option>--user <replaceable>user</replaceable></option></arg> --explicit-detail</option></arg>
<arg><option><arg><option>--user <replaceable>user</replaceable></option></arg> --grant <replaceable>action</replaceable></option><arg><option>--constraint <replaceable>constraint</replaceable></option></arg></arg>
<arg><option><arg><option>--user <replaceable>user</replaceable></option></arg> --revoke <replaceable>action</replaceable></option></arg>
<arg><option>--version</option></arg>
<arg><option>--help</option></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>DESCRIPTION</title>
<para>
polkit-auth is used to inspect, obtain, grant and revoke
PolicyKit authorizations. If invoked without any options, the
authorizations of the calling process will be printed.
</para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<variablelist>
<varlistentry>
<term><option>--obtain <replaceable>action</replaceable></option></term>
<listitem>
<para>
Attempt to obtain the authorization to do an action. This
is only useful for implicit authorizations requiring
authentication; e.g. when an appropriate stanza in the
defaults section of the .policy file for the action
specifies
<literal>auth_*</literal>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--show-obtainable</option></term>
<listitem>
<para>
Prints all actions that can be obtained via
authentication and for which an authorization does not
exist.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option><arg><option>--user <replaceable>user</replaceable></option></arg> --explicit</option></term>
<listitem>
<para>
Show explicit authorizations. Duplicates are not
printed. If used with the <option>--user</option> option,
the authorization
<literal>org.freedesktop.policykit.read</literal> is required.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option><arg><option>--user <replaceable>user</replaceable></option></arg> --explicit-detail</option></term>
<listitem>
<para>
Show detailed information about explicit
authorizations. In contrast to
the <literal>--explicit</literal>, duplicates are printed
as several authorizations with different scope and
constraints may exist.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option><arg><option>--user <replaceable>user</replaceable></option></arg> --grant <replaceable>action</replaceable></option><arg><option>--constraint <replaceable>constraint</replaceable></option></arg></term>
<listitem>
<para>
Grant an authorization for an action. This is different
than <literal>--obtain</literal> insofar that
the <literal>defaults</literal> stanza of the .policy file
is not consulted. Optionally, a constraint on the granted
authorization can be specified; allowed values
are: <literal>local</literal>,
<literal>active</literal>, <literal>local+active</literal>.
The authorization needed to grant authorizations is
<literal>org.freedesktop.policykit.grant</literal>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option><arg><option>--user <replaceable>user</replaceable></option></arg> --revoke <replaceable>action</replaceable></option></term>
<listitem>
<para>
Revoke all authorizations for an action. If the user is
not specified the calling user is used. The
authorization <literal>org.freedesktop.policykit.revoke</literal>
is needed to revoke authorizations from other users.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--version</option></term>
<listitem>
<para>
Show version and exit.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--help</option></term>
<listitem>
<para>
Show this information.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>COMPLETION</title>
<para>
PolicyKit ships with a collection of shell functions such that
completion on users and actions works when using the
<citerefentry>
<refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
shell. For completion to properly work for polkit-auth,
arguments should be entered in the order specified in this
manual page; for example. <option>--user</option> should be
specified before <option>--revoke</option> to complete only on
the authorizations the given user has. Note that if the calling
user lacks the <literal>org.freedesktop.policykit.read</literal>
authorization, the completion function will fall back to
completing on all registered actions.
</para>
</refsect1>
<refsect1>
<title>BUGS</title>
<para>
Please send bug reports to either the distribution or the
hal mailing list,
see <ulink url="http://lists.freedesktop.org/mailman/listinfo/hal"/>.
to subscribe.
</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
<citerefentry>
<refentrytitle>PolicyKit</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>PolicyKit.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-action</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
</para>
</refsect1>
</refentry>
<refentry id="polkit-grant.1">
<refentryinfo>
<title>polkit-grant</title>
<date>August 2007</date>
<productname>PolicyKit</productname>
</refentryinfo>
<refmeta>
<refentrytitle>polkit-grant</refentrytitle>
<manvolnum>1</manvolnum>
<refmiscinfo class="version"></refmiscinfo>
</refmeta>
<refnamediv>
<refname>polkit-grant</refname>
<refpurpose>manage PolicyKit privilege grants</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>polkit-grant</command>
<arg><option>--gain <replaceable>action</replaceable></option></arg>
<arg><option>--list</option></arg>
<arg><option>--delete <replaceable>user</replaceable></option></arg>
<arg><option>--version</option></arg>
<arg><option>--help</option></arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>DESCRIPTION</title>
<para>
polkit-grant is used to inspect and manage the privileges
that users obtain through authentication to enable a
mechanism to perform a specific action on their behalf.
</para>
</refsect1>
<refsect1>
<title>OPTIONS</title>
<variablelist>
<varlistentry>
<term><option>--gain <replaceable>action</replaceable></option></term>
<listitem>
<para>
Attempt to gain the privilege for the user to do an
action. This starts an interactive dialog where,
among, other things the user is authenticated.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--list</option></term>
<listitem>
<para>
Lists all the privileges previously granted.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--delete <replaceable>user</replaceable></option></term>
<listitem>
<para>
Delete all privileges granted to a given user. Needs
super user privileges.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--version</option></term>
<listitem>
<para>
Show version and exit.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--help</option></term>
<listitem>
<para>
Show usage information and exit.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>BUGS</title>
<para>
Please send bug reports to either the distribution or the
hal mailing list,
see <ulink url="http://lists.freedesktop.org/mailman/listinfo/hal"/>.
to subscribe.
</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para>
<citerefentry>
<refentrytitle>PolicyKit</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>PolicyKit.conf</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>polkit-list-actions</refentrytitle><manvolnum>1</manvolnum>
</citerefentry>
</para>
</refsect1>
</refentry>
......@@ -90,6 +90,7 @@
<xi:include href="xml/polkit-policy-default.xml"/>
<xi:include href="xml/polkit-policy-cache.xml"/>
<xi:include href="xml/polkit-authorization.xml"/>
<xi:include href="xml/polkit-authorization-constraint.xml"/>
<xi:include href="xml/polkit-authorization-db.xml"/>
</reference>
......@@ -127,8 +128,8 @@
</partintro>
<xi:include href="man/PolicyKit.xml"/>
<xi:include href="man/PolicyKit.conf.xml"/>
<xi:include href="man/polkit-grant.xml"/>
<xi:include href="man/polkit-list-actions.xml"/>
<xi:include href="man/polkit-auth.xml"/>
<xi:include href="man/polkit-action.xml"/>
<xi:include href="man/polkit-policy-file-validate.xml"/>
<xi:include href="man/polkit-config-file-validate.xml"/>
</reference>
......
# please keep this list sorted alphabetically
#
# List of source files containing translatable strings.
# Please keep this file sorted alphabetically.
[encoding: UTF-8]
policy/org.freedesktop.policykit.policy.in
polkit_privilegedir = $(datadir)/PolicyKit/policy
polkit_policydir = $(datadir)/PolicyKit/policy
dist_polkit_privilege_DATA =
dist_polkit_policy_DATA = org.freedesktop.policykit.policy
@INTLTOOL_POLICY_RULE@
check:
for f in $(dist_polkit_privilege_DATA); do \
echo "Validating privilege file: $$f"; \
$(top_builddir)/tools/polkit-policy-file-validate --file $(srcdir)/$$f; \
if [ "$$?" != "0" ]; then \
echo "failed"; \
exit 1; \
fi; \
done
$(top_builddir)/tools/polkit-policy-file-validate $(dist_polkit_policy_DATA)
clean-local :
rm -f *~
DISTCLEANFILES = org.freedesktop.policykit.policy
EXTRA_DIST = org.freedesktop.policykit.policy.in
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<!--
Policy definitions for core PolicyKit actions
Copyright (c) 2007 David Zeuthen <david@fubar.dk>
NOTE: If you make changes to this file, make sure to validate the file
using the polkit-policy-file-validate(1) tool. Changes made to this
file are instantly applied.
-->
<policyconfig>
<action id="org.freedesktop.policykit.read">
<_description>Read authorizations of other users</_description>
<_message>Authentication is required to read authorizations of other users</_message>
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep_always</allow_active>
</defaults>
</action>
<action id="org.freedesktop.policykit.revoke">
<_description>Revoke authorizations from other users</_description>
<_message>Authentication is required to revoke authorizations other users</_message>
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep_always</allow_active>
</defaults>
</action>
<action id="org.freedesktop.policykit.grant">
<_description>Grant authorizations to other users</_description>
<_message>Authentication is required to grant authorizations to other users</_message>
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep_always</allow_active>
</defaults>
</action>
</policyconfig>