Commit d9d79087 authored by David Zeuthen's avatar David Zeuthen

move authdb write functions to libpolkit-grant

This is primarily to keep libpolkit as minimal as possible as all that
mechanisms will ever need is the ability to read from the authdb.
parent d2a37b57
......@@ -28,37 +28,17 @@ libpolkit_dbus_la_LIBADD = @DBUS_LIBS@ $(top_builddir)/polkit/libpolkit.la $(SEL
libpolkit_dbus_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE)
if POLKIT_AUTHDB_DEFAULT
libexec_PROGRAMS = polkit-explicit-grant-helper polkit-revoke-helper polkit-read-auth-helper
polkit_explicit_grant_helper_SOURCES = polkit-explicit-grant-helper.c
polkit_explicit_grant_helper_CFLAGS = @DBUS_CFLAGS@
polkit_explicit_grant_helper_LDADD = $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
polkit_revoke_helper_SOURCES = polkit-revoke-helper.c
polkit_revoke_helper_CFLAGS = @DBUS_CFLAGS@
polkit_revoke_helper_LDADD = $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
libexec_PROGRAMS = polkit-read-auth-helper
polkit_read_auth_helper_SOURCES = polkit-read-auth-helper.c
polkit_read_auth_helper_CFLAGS = @DBUS_CFLAGS@
polkit_read_auth_helper_LDADD = $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
# polkit-explicit-grant-helper needs to be setgid $POLKIT_GROUP to be
# able to edit authorization files in /var/lib/PolicyKit and
# /var/run/PolicyKit
#
# polkit-revoke-helper needs to be setgid $POLKIT_GROUP to be able to
# edit authorization files in /var/lib/PolicyKit and
# /var/run/PolicyKit
#
# polkit-read-auth-helper needs to be setgid $POLKIT_GROUP to be able
# to read authorization files in /var/lib/PolicyKit and
# /var/run/PolicyKit
#
install-exec-hook:
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-explicit-grant-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-explicit-grant-helper
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-revoke-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-revoke-helper
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-read-auth-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-read-auth-helper
endif
......
......@@ -10,18 +10,28 @@ INCLUDES = \
-DPACKAGE_LOCALE_DIR=\""$(localedir)"\" \
-DPACKAGE_LIB_DIR=\""$(libdir)"\" \
-D_POSIX_PTHREAD_SEMANTICS -D_REENTRANT \
-DPOLKIT_COMPILATION \
@GLIB_CFLAGS@ @DBUS_CFLAGS@
lib_LTLIBRARIES=libpolkit-grant.la
libpolkit_grantincludedir=$(includedir)/PolicyKit/polkit-grant
libpolkit_grantinclude_HEADERS = \
libpolkit_grantinclude_HEADERS = \
polkit-grant.h
libpolkit_grant_la_SOURCES = \
libpolkit_grant_la_SOURCES = \
polkit-grant.h polkit-grant.c
if POLKIT_AUTHDB_DUMMY
libpolkit_grant_la_SOURCES += polkit-authorization-db-dummy-write.c
endif
if POLKIT_AUTHDB_DEFAULT
libpolkit_grant_la_SOURCES += polkit-authorization-db-write.c
endif
libpolkit_grant_la_LIBADD = @GLIB_LIBS@ @DBUS_LIBS@ $(top_builddir)/polkit/libpolkit.la
libpolkit_grant_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE)
......@@ -31,14 +41,22 @@ libpolkit_grant_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE
# adjust the PAM stuff in data/Makefile.am
#
if POLKIT_AUTHDB_DEFAULT
libexec_PROGRAMS = polkit-grant-helper polkit-grant-helper-pam
libexec_PROGRAMS = polkit-grant-helper polkit-grant-helper-pam polkit-explicit-grant-helper polkit-revoke-helper
polkit_grant_helper_SOURCES = polkit-grant-helper.c
polkit_grant_helper_LDADD = @GLIB_LIBS@ @DBUS_LIBS@ $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
polkit_grant_helper_LDADD = @GLIB_LIBS@ @DBUS_LIBS@ $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la $(top_builddir)/polkit-grant/libpolkit-grant.la
polkit_grant_helper_pam_SOURCES = polkit-grant-helper-pam.c
polkit_grant_helper_pam_LDADD = @AUTH_LIBS@
polkit_explicit_grant_helper_SOURCES = polkit-explicit-grant-helper.c
polkit_explicit_grant_helper_CFLAGS = @DBUS_CFLAGS@
polkit_explicit_grant_helper_LDADD = $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
polkit_revoke_helper_SOURCES = polkit-revoke-helper.c
polkit_revoke_helper_CFLAGS = @DBUS_CFLAGS@
polkit_revoke_helper_LDADD = $(top_builddir)/polkit/libpolkit.la $(top_builddir)/polkit-dbus/libpolkit-dbus.la
# polkit-grant-helper needs to be setgid polkituser to be able to
# write cookies to /var/lib/PolicyKit and /var/run/PolicyKit
#
......@@ -48,11 +66,23 @@ polkit_grant_helper_pam_LDADD = @AUTH_LIBS@
# we make it owned by the polkitiuser group and non-readable /
# non-executable to the world
#
# polkit-explicit-grant-helper needs to be setgid $POLKIT_GROUP to be
# able to edit authorization files in /var/lib/PolicyKit and
# /var/run/PolicyKit
#
# polkit-revoke-helper needs to be setgid $POLKIT_GROUP to be able to
# edit authorization files in /var/lib/PolicyKit and
# /var/run/PolicyKit
#
install-exec-hook:
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-grant-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-grant-helper
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-grant-helper-pam
-chmod 4750 $(DESTDIR)$(libexecdir)/polkit-grant-helper-pam
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-explicit-grant-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-explicit-grant-helper
-chgrp $(POLKIT_GROUP) $(DESTDIR)$(libexecdir)/polkit-revoke-helper
-chmod 2755 $(DESTDIR)$(libexecdir)/polkit-revoke-helper
endif
clean-local :
......
/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*- */
/***************************************************************************
*
* polkit-authorization-db.c : Dummy authorization database
*
* Copyright (C) 2007 David Zeuthen, <david@fubar.dk>
*
* Licensed under the Academic Free License version 2.1
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*
**************************************************************************/
#ifdef HAVE_CONFIG_H
# include <config.h>
#endif
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <pwd.h>
#include <glib.h>
#include <polkit/polkit-debug.h>
#include <polkit/polkit-authorization-db.h>
#include <polkit/polkit-utils.h>
#include <polkit/polkit-private.h>
/* PolKitAuthorizationDB structure is defined in polkit/polkit-private.h */
polkit_bool_t
polkit_authorization_db_add_entry_process (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_add_entry_session (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_add_entry_always (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_grant_to_uid (PolKitAuthorizationDB *authdb,
PolKitAction *action,
uid_t uid,
PolKitAuthorizationConstraint *constraint,
PolKitError **error)
{
polkit_error_set_error (error, POLKIT_ERROR_NOT_SUPPORTED, "Not supported");
return FALSE;
}
polkit_bool_t
polkit_authorization_db_revoke_entry (PolKitAuthorizationDB *authdb,
PolKitAuthorization *auth,
PolKitError **error)
{
polkit_error_set_error (error, POLKIT_ERROR_NOT_SUPPORTED, "Not supported");
return FALSE;
}
This diff is collapsed.
......@@ -46,10 +46,7 @@
#include "polkit-utils.h"
#include "polkit-private.h"
struct _PolKitAuthorizationDB
{
int refcount;
};
/* PolKitAuthorizationDB structure is defined in polkit/polkit-private.h */
PolKitAuthorizationDBCapability
polkit_authorization_db_get_capabilities (void)
......@@ -180,52 +177,3 @@ polkit_authorization_db_foreach_for_action_for_uid (PolKitAuthorizationDB
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_add_entry_process (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_add_entry_session (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_add_entry_always (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
return FALSE;
}
polkit_bool_t
polkit_authorization_db_grant_to_uid (PolKitAuthorizationDB *authdb,
PolKitAction *action,
uid_t uid,
PolKitAuthorizationConstraint *constraint,
PolKitError **error)
{
polkit_error_set_error (error, POLKIT_ERROR_NOT_SUPPORTED, "Not supported");
return FALSE;
}
polkit_bool_t
polkit_authorization_db_revoke_entry (PolKitAuthorizationDB *authdb,
PolKitAuthorization *auth,
PolKitError **error)
{
polkit_error_set_error (error, POLKIT_ERROR_NOT_SUPPORTED, "Not supported");
return FALSE;
}
......@@ -49,10 +49,13 @@
/**
* SECTION:polkit-authorization-db
* @title: Authorization Database
* @short_description: An interface to the database storing authorizations
* @short_description: Reading from and writing to the database storing authorizations
*
* This class is used to represent entries in the authorization
* database.
* This class presents an abstraction of the authorization database as
* well as methods for reading and writing to it.
*
* The reading parts are in <literal>libpolkit</literal> and the
* writing parts are in <literal>libpolkit-grant</literal>.
*
* Since: 0.7
**/
......@@ -60,16 +63,14 @@
/**
* PolKitAuthorizationDB:
*
* Objects of this class are used to represent entries in the
* authorization database.
* Objects of this class are used to represent the authorization
* database.
*
* Since: 0.7
**/
struct _PolKitAuthorizationDB
{
int refcount;
GHashTable *uid_to_authlist;
};
struct _PolKitAuthorizationDB;
/* PolKitAuthorizationDB structure is defined in polkit/polkit-private.h */
static void
_free_authlist (GSList *authlist)
......@@ -897,462 +898,3 @@ out:
return ret;
}
/**
* polkit_authorization_db_add_entry_process:
* @authdb: the authorization database
* @action: the action
* @caller: the caller
* @user_authenticated_as: the user that was authenticated
*
* Write an entry to the authorization database to indicate that the
* given caller is authorized for the given action.
*
* Note that this function should only be used by
* <literal>libpolkit-grant</literal> or other sufficiently privileged
* processes that deals with managing authorizations. It should never
* be used by mechanisms or applications. The caller must have
* egid=polkituser and umask set so creating files with mode 0460 will
* work.
*
* Returns: #TRUE if an entry was written to the authorization
* database, #FALSE if the caller of this function is not sufficiently
* privileged.
*
* Since: 0.7
*/
polkit_bool_t
polkit_authorization_db_add_entry_process (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
char *action_id;
uid_t caller_uid;
pid_t caller_pid;
char *grant_line;
polkit_bool_t ret;
polkit_uint64_t pid_start_time;
struct timeval now;
PolKitAuthorizationConstraint *constraint;
char cbuf[256];
g_return_val_if_fail (authdb != NULL, FALSE);
g_return_val_if_fail (action != NULL, FALSE);
g_return_val_if_fail (caller != NULL, FALSE);
if (!polkit_action_get_action_id (action, &action_id))
return FALSE;
if (!polkit_caller_get_pid (caller, &caller_pid))
return FALSE;
if (!polkit_caller_get_uid (caller, &caller_uid))
return FALSE;
pid_start_time = polkit_sysdeps_get_start_time_for_pid (caller_pid);
if (pid_start_time == 0)
return FALSE;
if (gettimeofday (&now, NULL) != 0) {
g_warning ("Error calling gettimeofday: %m");
return FALSE;
}
constraint = polkit_authorization_constraint_get_from_caller (caller);
if (polkit_authorization_constraint_to_string (constraint, cbuf, sizeof (cbuf)) >= sizeof (cbuf)) {
g_warning ("buffer for auth constraint is too small");
return FALSE;
}
grant_line = g_strdup_printf ("process:%d:%Lu:%s:%Lu:%d:%s\n",
caller_pid,
pid_start_time,
action_id,
(polkit_uint64_t) now.tv_sec,
user_authenticated_as,
cbuf);
ret = _polkit_authorization_db_auth_file_add (PACKAGE_LOCALSTATE_DIR "/run/PolicyKit",
TRUE,
caller_uid,
grant_line);
g_free (grant_line);
return ret;
}
/**
* polkit_authorization_db_add_entry_session:
* @authdb: the authorization database
* @action: the action
* @caller: the caller
* @user_authenticated_as: the user that was authenticated
*
* Write an entry to the authorization database to indicate that the
* session for the given caller is authorized for the given action for
* the remainer of the session.
*
* Note that this function should only be used by
* <literal>libpolkit-grant</literal> or other sufficiently privileged
* processes that deals with managing authorizations. It should never
* be used by mechanisms or applications. The caller must have
* egid=polkituser and umask set so creating files with mode 0460 will
* work.
*
* Returns: #TRUE if an entry was written to the authorization
* database, #FALSE if the caller of this function is not sufficiently
* privileged.
*
* Since: 0.7
*/
polkit_bool_t
polkit_authorization_db_add_entry_session (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
uid_t session_uid;
char *action_id;
char *grant_line;
PolKitSession *session;
char *session_objpath;
polkit_bool_t ret;
struct timeval now;
PolKitAuthorizationConstraint *constraint;
char cbuf[256];
g_return_val_if_fail (authdb != NULL, FALSE);
g_return_val_if_fail (action != NULL, FALSE);
g_return_val_if_fail (caller != NULL, FALSE);
if (!polkit_action_get_action_id (action, &action_id))
return FALSE;
if (!polkit_caller_get_ck_session (caller, &session))
return FALSE;
if (!polkit_session_get_ck_objref (session, &session_objpath))
return FALSE;
if (!polkit_session_get_uid (session, &session_uid))
return FALSE;
constraint = polkit_authorization_constraint_get_from_caller (caller);
if (polkit_authorization_constraint_to_string (constraint, cbuf, sizeof (cbuf)) >= sizeof (cbuf)) {
g_warning ("buffer for auth constraint is too small");
return FALSE;
}
if (gettimeofday (&now, NULL) != 0) {
g_warning ("Error calling gettimeofday: %m");
return FALSE;
}
grant_line = g_strdup_printf ("session:%s:%s:%Lu:%d:%s\n",
session_objpath,
action_id,
(polkit_uint64_t) now.tv_sec,
user_authenticated_as,
cbuf);
ret = _polkit_authorization_db_auth_file_add (PACKAGE_LOCALSTATE_DIR "/run/PolicyKit",
TRUE,
session_uid,
grant_line);
g_free (grant_line);
return ret;
}
/**
* polkit_authorization_db_add_entry_always:
* @authdb: the authorization database
* @action: the action
* @caller: the caller
* @user_authenticated_as: the user that was authenticated
*
* Write an entry to the authorization database to indicate that the
* given user is authorized for the given action.
*
* Note that this function should only be used by
* <literal>libpolkit-grant</literal> or other sufficiently privileged
* processes that deals with managing authorizations. It should never
* be used by mechanisms or applications. The caller must have
* egid=polkituser and umask set so creating files with mode 0460 will
* work.
*
* Returns: #TRUE if an entry was written to the authorization
* database, #FALSE if the caller of this function is not sufficiently
* privileged.
*
* Since: 0.7
*/
polkit_bool_t
polkit_authorization_db_add_entry_always (PolKitAuthorizationDB *authdb,
PolKitAction *action,
PolKitCaller *caller,
uid_t user_authenticated_as)
{
uid_t uid;
char *action_id;
char *grant_line;
polkit_bool_t ret;
struct timeval now;
PolKitAuthorizationConstraint *constraint;
char cbuf[256];
g_return_val_if_fail (authdb != NULL, FALSE);
g_return_val_if_fail (action != NULL, FALSE);
g_return_val_if_fail (caller != NULL, FALSE);
if (!polkit_caller_get_uid (caller, &uid))
return FALSE;
if (!polkit_action_get_action_id (action, &action_id))
return FALSE;
if (gettimeofday (&now, NULL) != 0) {
g_warning ("Error calling gettimeofday: %m");
return FALSE;
}
constraint = polkit_authorization_constraint_get_from_caller (caller);
if (polkit_authorization_constraint_to_string (constraint, cbuf, sizeof (cbuf)) >= sizeof (cbuf)) {
g_warning ("buffer for auth constraint is too small");
return FALSE;
}
grant_line = g_strdup_printf ("always:%s:%Lu:%d:%s\n",
action_id,
(polkit_uint64_t) now.tv_sec,
user_authenticated_as,
cbuf);
ret = _polkit_authorization_db_auth_file_add (PACKAGE_LOCALSTATE_DIR "/lib/PolicyKit",
FALSE,
uid,
grant_line);
g_free (grant_line);
return ret;
}
/**
* polkit_authorization_db_revoke_entry:
* @authdb: the authorization database
* @auth: the authorization to revoke
* @error: return location for error
*
* Removes an authorization from the authorization database. This uses
* a privileged helper /usr/libexec/polkit-revoke-helper.
*
* Returns: #TRUE if the authorization was revoked, #FALSE otherwise and error is set
*
* Since: 0.7
*/
polkit_bool_t
polkit_authorization_db_revoke_entry (PolKitAuthorizationDB *authdb,
PolKitAuthorization *auth,
PolKitError **error)
{
GError *g_error;
char *helper_argv[] = {PACKAGE_LIBEXEC_DIR "/polkit-revoke-helper", "", NULL, NULL, NULL};
const char *auth_file_entry;
gboolean ret;
gint exit_status;
ret = FALSE;
g_return_val_if_fail (authdb != NULL, FALSE);
g_return_val_if_fail (auth != NULL, FALSE);
auth_file_entry = _polkit_authorization_get_authfile_entry (auth);
//g_debug ("should delete line '%s'", auth_file_entry);
helper_argv[1] = (char *) auth_file_entry;
helper_argv[2] = "uid";
helper_argv[3] = g_strdup_printf ("%d", polkit_authorization_get_uid (auth));
g_error = NULL;
if (!g_spawn_sync (NULL, /* const gchar *working_directory */
helper_argv, /* gchar **argv */
NULL, /* gchar **envp */
0, /* GSpawnFlags flags */
NULL, /* GSpawnChildSetupFunc child_setup */
NULL, /* gpointer user_data */
NULL, /* gchar **standard_output */
NULL, /* gchar **standard_error */
&exit_status, /* gint *exit_status */
&g_error)) { /* GError **error */
polkit_error_set_error (error,
POLKIT_ERROR_GENERAL_ERROR,
"Error spawning revoke helper: %s",
g_error->message);
g_error_free (g_error);
goto out;