nikon/tuned
1
0
Fork 0
Code Activity Actions

polkit: added the policy to correct package and added fallback method

Browse source 
If there is problem with polkit, it tries to get the UID of the
sender process and in case it's root authorize the request.

Signed-off-by: Jaroslav Škarvada <jskarvad@redhat.com>
This commit is contained in:
Jaroslav Škarvada 2016-06-10 18:07:00 +02:00
parent 68bb447a0f
commit 2a593a46e9
3 changed files with 41 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
tuned.spec
View file

@ -250,13 +250,13 @@ fi
%{_mandir}/man8/tuned*
%dir %{_datadir}/tuned
%{_datadir}/tuned/grub2
%{_datadir}/polkit-1/actions/com.redhat.tuned.policy
%files gtk
%defattr(-,root,root,-)
%{_sbindir}/tuned-gui
%{python_sitelib}/tuned/gtk
%{_datadir}/tuned/ui
%{_datadir}/polkit-1/actions/com.redhat.tuned.policy
%{_datadir}/polkit-1/actions/com.redhat.tuned.gui.policy
%{_datadir}/icons/hicolor/scalable/apps/tuned.svg
%{_datadir}/applications/tuned-gui.desktop

17
tuned/exports/dbus_exporter.py
View file

@ -69,14 +69,19 @@ class DBusExporter(interfaces.ExporterInterface):
action_id = consts.NAMESPACE + "." + method.__name__
caller = args[-1]
log.debug("checking authorization for for action '%s' requested by caller '%s'" % (action_id, caller))
try:
if self._polkit.check_authorization(caller, action_id):
ret = self._polkit.check_authorization(caller, action_id)
if ret == 1:
log.debug("action '%s' requested by caller '%s' was successfully authorized by polkit" % (action_id, caller))
else:
log.info("action '%s' requested by caller '%s' wasn't authorized by polkit, ignoring the request" % (action_id, caller))
elif ret == 2:
log.warn("polkit error, but action '%s' requested by caller '%s' was successfully authorized by fallback method" (action_id, caller))
elif ret == 0:
log.info("action '%s' requested by caller '%s' wasn't authorized, ignoring the request" % (action_id, caller))
args[-1] = ""
except (dbus.exceptions.DBusException, ValueError) as e:
log.error("unable to query polkit to authorize action '%s' requested by caller '%s': %s, ignoring the request" % (action_id, caller, e))
elif ret == -1:
log.warn("polkit error and action '%s' requested by caller '%s' wasn't authorized by fallback method, ignoring the request" (action_id, caller))
args[-1] = ""
else:
log.error("polkit error and unable to use fallback method to authorize action '%s' requested by caller '%s', ignoring the request" (action_id, caller))
args[-1] = ""
return method(*args, **kwargs)

33
tuned/utils/polkit.py
View file

@ -1,16 +1,41 @@
import dbus
import tuned.logs
log = tuned.logs.get()
class polkit():
def __init__(self):
bus = dbus.SystemBus()
proxy = bus.get_object('org.freedesktop.PolicyKit1', '/org/freedesktop/PolicyKit1/Authority')
self._authority = dbus.Interface(proxy, dbus_interface='org.freedesktop.PolicyKit1.Authority')
self._bus = dbus.SystemBus()
self._proxy = self._bus.get_object('org.freedesktop.PolicyKit1', '/org/freedesktop/PolicyKit1/Authority', follow_name_owner_changes = True)
self._authority = dbus.Interface(self._proxy, dbus_interface='org.freedesktop.PolicyKit1.Authority')
def check_authorization(self, sender, action_id):
"""Check authorization, return codes:
1 - authorized
2 - polkit error, but authorized with fallback method
0 - unauthorized
-1 - polkit error and unauthorized by the fallback method
-2 - polkit error and unable to use the fallback method
"""
if sender is None or action_id is None:
return False
details = {}
flags = 1 # AllowUserInteraction flag
cancellation_id = '' # No cancellation id
subject = ('system-bus-name', {'name' : sender})
return self._authority.CheckAuthorization(subject, action_id, details, flags, cancellation_id)[0]
try:
ret = self._authority.CheckAuthorization(subject, action_id, details, flags, cancellation_id)[0]
except (dbus.exceptions.DBusExceptions, ValueError) as e:
log.error("error querying polkit: %s" % e)
# No polkit or polkit error, fallback to always allow root
try:
uid = self._bus.get_unix_user(sender)
except dbus.exceptions.DBusExceptions as e:
log.error("error using falback authorization method: %s" % e)
return -2
if uid == 0:
return 2
else:
return -1
return 1 if ret else 0