GitLab

Also provide a convenience function to access it: polkit_auth_obtain().

Negative authorizations is a way to block an entity; previously the
algorithm was something like (ignoring the config file for now)

  Result is_authorized() {
    res = has_implicit_auth();
    if (res == YES) {
      return YES;
    } else if (has_explicit_auth()) {
      return YES;
    }
    return res;
  }

Now it's

  Result is_authorized() {
    res = has_implicit_auth();
    expl = has_explicit_auth();
    is_blocked = has_negative_explicit_auth();

    if (is_blocked)
      return NO;

    if (res == YES) {
      return YES;
    } else if (has_explicit_auth()) {
      return YES;
    }
    return res;
  }

E.g. just a single negative auth will force NO to be returned. I
really, really need to write into the spec how this works; my mental
L1 cache can't contain it anymore. Once it's formally defined we need
to craft a test suite to verify that the code works according to
spec...

This is useful when building a project using polkit in a different
prefix. Lennart asked for it.

Basically, checking auths with polkit is now a one-liner:

    if (polkit_check_auth (getpid (), "com.acme.some-action", NULL) == 0) {
        fprintf (stderr, "Not authorized; go away\n");
        exit (1);
    }

This can be used for making a lot of the legacy UNIX tools PolicyKit
aware. For example, vixie-cron could make crontab(1) (a setuid
program) check whether the calling user is authorized for the action

 org.isc.vixie-cron.edit-own-crontab

This is a nice way to provide least privilege and still put the system
administrator in control via polkit-auth(1), polkit-action(1) and the
GTK+ "Manage Authorizations" utility:

 http://people.redhat.com/davidz/polkitg-auth-1.png
 http://people.redhat.com/davidz/polkitg-auth-2.png
 http://people.redhat.com/davidz/polkitg-auth-3.png

We were modifying the 'uid' parameter in _authdb_get_auths_for_uid();
I bet that if we had unit tests this bug would have been caught
earlier...

https://bugs.freedesktop.org/show_bug.cgi?id=13082

http://bugs.freedesktop.org/show_bug.cgi?id=13113