create core package
This commit is contained in:
aydemir
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/python
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Licensed under the GNU General Public License, version 3.
|
||||
# See the file http://www.gnu.org/licenses/gpl.txt
|
||||
|
||||
from pisi.actionsapi import shelltools
|
||||
from pisi.actionsapi import autotools
|
||||
from pisi.actionsapi import pisitools
|
||||
from pisi.actionsapi import get
|
||||
|
||||
def setup():
|
||||
#Use it for root user instead of wheel group
|
||||
#shelltools.system("sed -i -e 's|unix-group:wheel|unix-user:0|' src/polkitbackend/*-default.rules")
|
||||
# Use it if we have spidermonkey 1.8.7 or newer...
|
||||
#shelltools.system("sed -i -e '/mozjs/s:185:187:g' configure")
|
||||
#look http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/sys-auth/polkit/polkit-0.107.ebuild
|
||||
#shelltools.system("cmd='sed -i -e "/mozjs/s:185:187:g" configure src/polkitbackend/polkitbackendjsauthority.c'")
|
||||
autotools.autoreconf("-fi")
|
||||
autotools.configure("--with-pam-module-dir=/lib/security/ \
|
||||
--with-os-type=PisiLinux \
|
||||
--enable-examples \
|
||||
--enable-introspection \
|
||||
--enable-libsystemd-login=no \
|
||||
--disable-man-pages \
|
||||
--disable-gtk-doc \
|
||||
--disable-static")
|
||||
pisitools.dosed("libtool"," -shared ", " -Wl,--as-needed -shared ")
|
||||
|
||||
def build():
|
||||
shelltools.export('HOME', get.workDIR())
|
||||
autotools.make()
|
||||
|
||||
def install():
|
||||
autotools.rawInstall("DESTDIR=%s/" % get.installDIR())
|
||||
|
||||
pisitools.dodir("/var/lib/polkit-1")
|
||||
shelltools.chmod("%s/var/lib/polkit-1" % get.installDIR(), mode=00700)
|
||||
shelltools.chmod("%s/etc/polkit-1/rules.d" % get.installDIR(), mode=00700)
|
||||
shelltools.chown("%s/etc/polkit-1/rules.d" % get.installDIR(),"polkitd","root") #yada? "polkitd","root"
|
||||
shelltools.chown("%s/var/lib/polkit-1" % get.installDIR(),"polkitd","polkitd")
|
||||
shelltools.chown("%s/usr/share/polkit-1" % get.installDIR(),"polkitd","root") #yada? "polkitd","root"
|
||||
pisitools.dodoc("AUTHORS", "NEWS", "README", "HACKING", "COPYING")
|
||||
@@ -0,0 +1,19 @@
|
||||
# Authorizations/policy for the wheel and user groups.
|
||||
|
||||
# Allow standard users to do some things without being interrupted by password dialogs
|
||||
|
||||
[Desktop User Permissions]
|
||||
Identity=unix-group:users
|
||||
Action=org.gnome.clockapplet.mechanism.settimezone
|
||||
ResultAny=no
|
||||
ResultInactive=no
|
||||
ResultActive=yes
|
||||
|
||||
# Allow administrative users to do a lot of things without being interrupted by password dialogs
|
||||
|
||||
[Desktop Administrator Permissions]
|
||||
Identity=unix-group:wheel
|
||||
Action=org.gnome.clockapplet.mechanism.*;org.freedesktop.devicekit.disks.*;org.freedesktop.RealtimeKit1.*
|
||||
ResultAny=No
|
||||
ResultInactive=no
|
||||
ResultActive=yes
|
||||
@@ -0,0 +1,5 @@
|
||||
# This allows users in the wheel group to authenticate as the administrator.
|
||||
|
||||
[Configuration]
|
||||
AdminIdentities=unix-group:wheel
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
diff -Nuar apolkit-0.107/configure.ac polkit-0.107/configure.ac
|
||||
--- apolkit-0.107/configure.ac 2012-07-06 16:54:35.000000000 +0300
|
||||
+++ polkit-0.107/configure.ac 2012-09-20 12:08:05.612322550 +0300
|
||||
@@ -47,7 +47,7 @@
|
||||
fi
|
||||
AM_CONDITIONAL(MAN_PAGES_ENABLED, test x$enable_man_pages = xyes)
|
||||
|
||||
-GTK_DOC_CHECK([1.3])
|
||||
+
|
||||
|
||||
#### gcc warning flags
|
||||
|
||||
@@ -473,11 +473,6 @@
|
||||
src/polkitagent/Makefile
|
||||
src/programs/Makefile
|
||||
src/examples/Makefile
|
||||
-docs/version.xml
|
||||
-docs/extensiondir.xml
|
||||
-docs/Makefile
|
||||
-docs/polkit/Makefile
|
||||
-docs/man/Makefile
|
||||
po/Makefile.in
|
||||
test/Makefile
|
||||
test/polkit/Makefile
|
||||
diff -Nuar apolkit-0.107/Makefile.in polkit-0.107/Makefile.in
|
||||
--- apolkit-0.107/Makefile.in 2012-07-06 16:54:39.000000000 +0300
|
||||
+++ polkit-0.107/Makefile.in 2012-09-20 12:08:39.781895373 +0300
|
||||
@@ -296,7 +296,7 @@
|
||||
top_build_prefix = @top_build_prefix@
|
||||
top_builddir = @top_builddir@
|
||||
top_srcdir = @top_srcdir@
|
||||
-SUBDIRS = actions data src docs po test
|
||||
+SUBDIRS = actions data src po test
|
||||
NULL =
|
||||
EXTRA_DIST = \
|
||||
HACKING \
|
||||
diff -Nuar apolkit-0.107/Makefile.am polkit-0.107/Makefile.am
|
||||
--- apolkit-0.107/Makefile.am 2012-06-04 20:47:39.000000000 +0300
|
||||
+++ polkit-0.107/Makefile.am 2012-09-22 02:42:01.108243818 +0300
|
||||
@@ -1,6 +1,6 @@
|
||||
## Process this file with automake to produce Makefile.in
|
||||
|
||||
-SUBDIRS = actions data src docs po test
|
||||
+SUBDIRS = actions data src po test
|
||||
@@ -0,0 +1,69 @@
|
||||
'\" t
|
||||
.\" Title: pkaction
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: May 2009
|
||||
.\" Manual: pkaction
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PKACTION" "1" "May 2009" "polkit" "pkaction"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pkaction \- Get details about a registered action
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpkaction\fR\ 'u
|
||||
\fBpkaction\fR [\fB\-\-version\fR] [\fB\-\-help\fR]
|
||||
.HP \w'\fBpkaction\fR\ 'u
|
||||
\fBpkaction\fR [\fB\-\-verbose\fR]
|
||||
.HP \w'\fBpkaction\fR\ 'u
|
||||
\fBpkaction\fR \fB\-\-action\-id\fR\ \fIaction\fR [\fB\-\-verbose\fR]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
|
||||
\fBpkaction\fR
|
||||
is used to obtain information about registered PolicyKit actions\&. If called with
|
||||
\fB\-\-action\-id\fR
|
||||
then all actions are displayed\&. Otherwise the action
|
||||
\fIaction\fR\&. If called without the
|
||||
\fB\-\-verbose\fR
|
||||
option only the name of the action is shown\&. Otherwise details about the actions are shown\&.
|
||||
.SH "RETURN VALUE"
|
||||
.PP
|
||||
On success
|
||||
\fBpkaction\fR
|
||||
returns 0\&. Otherwise a non\-zero value is returned and a diagnostic message is printed on standard error\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpolkit\fR(8),
|
||||
\fBpkcheck\fR(1),
|
||||
\fBpkexec\fR(1)
|
||||
@@ -0,0 +1,151 @@
|
||||
'\" t
|
||||
.\" Title: pkcheck
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: May 2009
|
||||
.\" Manual: pkcheck
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PKCHECK" "1" "May 2009" "polkit" "pkcheck"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pkcheck \- Check whether a process is authorized
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpkcheck\fR\ 'u
|
||||
\fBpkcheck\fR [\fB\-\-version\fR] [\fB\-\-help\fR]
|
||||
.HP \w'\fBpkcheck\fR\ 'u
|
||||
\fBpkcheck\fR [\fB\-\-list\-temp\fR]
|
||||
.HP \w'\fBpkcheck\fR\ 'u
|
||||
\fBpkcheck\fR [\fB\-\-revoke\-temp\fR]
|
||||
.HP \w'\fBpkcheck\fR\ 'u
|
||||
\fBpkcheck\fR \fB\-\-action\-id\fR\ \fIaction\fR {\fB\-\-process\fR\ {\ \fIpid\fR\ |\ \fIpid,pid\-start\-time\fR\ } | \fB\-\-system\-bus\-name\fR\ \fIbusname\fR} [\fB\-\-allow\-user\-interaction\fR] [\fB\-\-enable\-internal\-agent\fR] [\fB\-\-detail\fR\ \fIkey\fR\ \fIvalue\fR...]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
|
||||
\fBpkcheck\fR
|
||||
is used to check whether a process, specified by either
|
||||
\fB\-\-process\fR
|
||||
or
|
||||
\fB\-\-system\-bus\-name\fR, is authorized for
|
||||
\fIaction\fR\&. The
|
||||
\fB\-\-detail\fR
|
||||
option can be used zero or more times to pass details about
|
||||
\fIaction\fR\&. If
|
||||
\fB\-\-allow\-user\-interaction\fR
|
||||
is passed,
|
||||
\fBpkcheck\fR
|
||||
blocks while waiting for authentication\&.
|
||||
.PP
|
||||
The invocation
|
||||
\fBpkcheck \-\-list\-temp\fR
|
||||
will list all temporary authorizations for the current session and
|
||||
\fBpkcheck \-\-revoke\-temp\fR
|
||||
will revoke all temporary authorizations for the current session\&.
|
||||
.PP
|
||||
This command is a simple wrapper around the PolicyKit D\-Bus interface; see the D\-Bus interface documentation for details\&.
|
||||
.SH "RETURN VALUE"
|
||||
.PP
|
||||
If the specified process is authorized,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 0\&. If the authorization result contains any details, these are printed on standard output as key/value pairs using environment style reporting, e\&.g\&. first the key followed by a an equal sign, then the value followed by a newline\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
KEY1=VALUE1
|
||||
KEY2=VALUE2
|
||||
KEY3=VALUE3
|
||||
\&.\&.\&.
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.sp
|
||||
Octects that are not in [a\-zA\-Z0\-9_] are escaped using octal codes prefixed with
|
||||
\fI\e\fR\&. For example, the UTF\-8 string
|
||||
\fIføl,你好\fR
|
||||
will be printed as
|
||||
\fIf\e303\e270l\e54\e344\e275\e240\e345\e245\e275\fR\&.
|
||||
.PP
|
||||
If the specificied process is not authorized,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 1 and a diagnostic message is printed on standard error\&. Details are printed on standard output\&.
|
||||
.PP
|
||||
If the specificied process is not authorized because no suitable authentication agent is available or if the
|
||||
\fB\-\-allow\-user\-interaction\fR
|
||||
wasn\*(Aqt passed,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 2 and a diagnostic message is printed on standard error\&. Details are printed on standard output\&.
|
||||
.PP
|
||||
If the specificied process is not authorized because the authentication dialog / request was dismissed by the user,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 3 and a diagnostic message is printed on standard error\&. Details are printed on standard output\&.
|
||||
.PP
|
||||
If an error occured while checking for authorization,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 127 with a diagnostic message printed on standard error\&.
|
||||
.PP
|
||||
If one or more of the options passed are malformed,
|
||||
\fBpkcheck\fR
|
||||
exits with a return value of 126\&. If stdin is a tty, then this manual page is also shown\&.
|
||||
.SH "NOTES"
|
||||
.PP
|
||||
Since process identifiers can be recycled, the caller should always use
|
||||
\fIpid,pid\-start\-time\fR
|
||||
to specify the process to check for authorization when using the
|
||||
\fB\-\-process\fR
|
||||
option\&. The value of
|
||||
\fIpid\-start\-time\fR
|
||||
can be determined by consulting e\&.g\&. the
|
||||
\fBproc\fR(5)
|
||||
file system depending on the operating system\&. If only
|
||||
\fIpid\fR
|
||||
is passed to the
|
||||
\fB\-\-process\fR
|
||||
option, then
|
||||
\fBpkcheck\fR
|
||||
will look up the start time itself but note that this may be racy\&.
|
||||
.SH "AUTHENTICATION AGENT"
|
||||
.PP
|
||||
|
||||
\fBpkcheck\fR, like any other PolicyKit application, will use the authentication agent registered for the process in question\&. However, if no authentication agent is available, then
|
||||
\fBpkcheck\fR
|
||||
can register its own textual authentication agent if the option
|
||||
\fB\-\-enable\-internal\-agent\fR
|
||||
is passed\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpolkit\fR(8),
|
||||
\fBpkaction\fR(1),
|
||||
\fBpkexec\fR(1)
|
||||
@@ -0,0 +1,285 @@
|
||||
'\" t
|
||||
.\" Title: pkexec
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: May 2009
|
||||
.\" Manual: pkexec
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PKEXEC" "1" "May 2009" "polkit" "pkexec"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pkexec \- Execute a command as another user
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpkexec\fR\ 'u
|
||||
\fBpkexec\fR [\fB\-\-version\fR] [\fB\-\-disable\-internal\-agent\fR] [\fB\-\-help\fR]
|
||||
.HP \w'\fBpkexec\fR\ 'u
|
||||
\fBpkexec\fR [\fB\-\-user\fR\ \fIusername\fR] \fIPROGRAM\fR [\fIARGUMENTS\fR...]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
|
||||
\fBpkexec\fR
|
||||
allows an authorized user to execute
|
||||
\fIPROGRAM\fR
|
||||
as another user\&. If
|
||||
\fIusername\fR
|
||||
is not specified, then the program will be executed as the administrative super user,
|
||||
\fIroot\fR\&.
|
||||
.SH "RETURN VALUE"
|
||||
.PP
|
||||
Upon successful completion, the return value is the return value of
|
||||
\fIPROGRAM\fR\&. If the calling process is not authorized or an authorization could not be obtained through authentication or an error occured,
|
||||
\fBpkexec\fR
|
||||
exits with a return value of 127\&. If the authorization could not be obtained because the user dismissed the authentication dialog,
|
||||
\fBpkexec\fR
|
||||
exits with a return value of 126\&.
|
||||
.SH "AUTHENTICATION AGENT"
|
||||
.PP
|
||||
|
||||
\fBpkexec\fR, like any other PolicyKit application, will use the authentication agent registered for the calling process\&. However, if no authentication agent is available, then
|
||||
\fBpkexec\fR
|
||||
will register its own textual authentication agent\&. This behavior can be turned off by passing the
|
||||
\fB\-\-disable\-internal\-agent\fR
|
||||
option\&.
|
||||
.SH "SECURITY NOTES"
|
||||
.PP
|
||||
Executing a program as another user is a privileged operation\&. By default the required authorization (See
|
||||
the section called \(lqREQUIRED AUTHORIZATIONS\(rq) requires administrator authentication\&. In addition, the authentication dialog presented to the user will display the full path to the program to be executed so the user is aware of what will happen:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[1]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Authenticate [X] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| |
|
||||
| [Icon] Authentication is needed to run `/bin/bash\*(Aq |
|
||||
| as the super user |
|
||||
| |
|
||||
| An application is attempting to perform an |
|
||||
| action that requires privileges\&. Authentication |
|
||||
| as the super user is required to perform this |
|
||||
| action\&. |
|
||||
| |
|
||||
| Password for root: [_________________________] |
|
||||
| |
|
||||
| [V] Details: |
|
||||
| Command: /bin/bash |
|
||||
| Run As: Super User (root) |
|
||||
| Action: org\&.freedesktop\&.policykit\&.exec |
|
||||
| Vendor: The PolicyKit Project |
|
||||
| |
|
||||
| [Cancel] [Authenticate] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
The environment that
|
||||
\fIPROGRAM\fR
|
||||
will run it, will be set to a minimal known and safe environment in order to avoid injecting code through
|
||||
LD_LIBRARY_PATH
|
||||
or similar mechanisms\&. In addition the
|
||||
PKEXEC_UID
|
||||
environment variable is set to the user id of the process invoking
|
||||
\fBpkexec\fR\&. As a result,
|
||||
\fBpkexec\fR
|
||||
will not allow you to run X11 applications as another user since the
|
||||
$DISPLAY
|
||||
and
|
||||
$XAUTHORITY
|
||||
environment variables are not set\&. These two variables will be retained if the
|
||||
\fIorg\&.freedesktop\&.policykit\&.exec\&.allow_gui\fR
|
||||
annotation on an action is set to a nonempty value; this is discouraged, though, and should only be used for legacy programs\&.
|
||||
.SH "REQUIRED AUTHORIZATIONS"
|
||||
.PP
|
||||
By default, the
|
||||
\fIorg\&.freedesktop\&.policykit\&.exec\fR
|
||||
authorization is required unless an action definition file is present for the program in question\&. To require another authorization, it can be specified using the
|
||||
\fIorg\&.freedesktop\&.policykit\&.exec\&.path\fR
|
||||
annotation on an action (See
|
||||
the section called \(lqEXAMPLE\(rq
|
||||
for details)\&.
|
||||
.SH "EXAMPLE"
|
||||
.PP
|
||||
To specify what kind of authorization is needed to execute the program
|
||||
/usr/bin/pk\-example\-frobnicate
|
||||
as another user, simply write an action definition file like this
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
<?xml version="1\&.0" encoding="UTF\-8"?>
|
||||
<!DOCTYPE policyconfig PUBLIC
|
||||
"\-//freedesktop//DTD PolicyKit Policy Configuration 1\&.0//EN"
|
||||
"http://www\&.freedesktop\&.org/standards/PolicyKit/1/policyconfig\&.dtd">
|
||||
<policyconfig>
|
||||
|
||||
<vendor>Examples for the PolicyKit Project</vendor>
|
||||
<vendor_url>http://hal\&.freedesktop\&.org/docs/PolicyKit/</vendor_url>
|
||||
|
||||
<action id="org\&.freedesktop\&.policykit\&.example\&.pkexec\&.run\-frobnicate">
|
||||
<description>Run the PolicyKit example program Frobnicate</description>
|
||||
<description xml:lang="da">Kør PolicyKit eksemplet Frobnicate</description>
|
||||
<message>Authentication is required to run the PolicyKit example program Frobnicate (user=$(user), program=$(program), command_line=$(command_line))</message>
|
||||
<message xml:lang="da">Autorisering er påkrævet for at afvikle PolicyKit eksemplet Frobnicate (user=$(user), program=$(program), command_line=$(command_line))</message>
|
||||
<icon_name>audio\-x\-generic</icon_name>
|
||||
<defaults>
|
||||
<allow_any>no</allow_any>
|
||||
<allow_inactive>no</allow_inactive>
|
||||
<allow_active>auth_self_keep</allow_active>
|
||||
</defaults>
|
||||
<annotate key="org\&.freedesktop\&.policykit\&.exec\&.path">/usr/bin/pk\-example\-frobnicate</annotate>
|
||||
</action>
|
||||
|
||||
</policyconfig>
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
and drop it in the
|
||||
/usr/share/polkit\-1/actions
|
||||
directory under a suitable name (e\&.g\&. matching the namespace of the action)\&. Note that in addition to specifying the program, the authentication message, description, icon and defaults can be specified\&. Note that occurences of the strings
|
||||
$(user),
|
||||
$(program)
|
||||
and
|
||||
$(command_line)
|
||||
in the message will be replaced with respectively the user (of the form "Real Name (username)" or just "username" if there is no real name for the username), the binary to execute (a fully\-qualified path, e\&.g\&. "/usr/bin/pk\-example\-frobnicate") and the command\-line, e\&.g\&. "pk\-example\-frobnicate foo bar"\&. For example, for the action defined above, the following authentication dialog will be shown:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[2]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Authenticate [X] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| |
|
||||
| [Icon] Authentication is required to run the PolicyKit |
|
||||
| example program Frobnicate |
|
||||
| |
|
||||
| An application is attempting to perform an |
|
||||
| action that requires privileges\&. Authentication |
|
||||
| is required to perform this action\&. |
|
||||
| |
|
||||
| Password: [__________________________________] |
|
||||
| |
|
||||
| [V] Details: |
|
||||
| Command: /usr/bin/pk\-example\-frobnicate |
|
||||
| Run As: Super User (root) |
|
||||
| Action: org\&.fd\&.pk\&.example\&.pkexec\&.run\-frobnicate |
|
||||
| Vendor: Examples for the PolicyKit Project |
|
||||
| |
|
||||
| [Cancel] [Authenticate] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
If the user is using the
|
||||
da_DK
|
||||
locale, the dialog looks like this:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[3]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Autorisering [X] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| |
|
||||
| [Icon] Autorisering er påkrævet for at afvikle |
|
||||
| PolicyKit eksemplet Frobnicate |
|
||||
| |
|
||||
| Et program forsøger at udføre en handling der |
|
||||
| kræver privilegier\&. Autorisering er påkrævet\&. |
|
||||
| |
|
||||
| Kodeord: [___________________________________] |
|
||||
| |
|
||||
| [V] Detaljer: |
|
||||
| Bruger: Super User (root) |
|
||||
| Program: /usr/bin/pk\-example\-frobnicate |
|
||||
| Handling: org\&.fd\&.pk\&.example\&.pkexec\&.run\-frobnicate |
|
||||
| Vendor: Examples for the PolicyKit Project |
|
||||
| |
|
||||
| [Annullér] [Autorisering] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
Note that
|
||||
\fBpkexec\fR
|
||||
does no validation of the
|
||||
\fIARGUMENTS\fR
|
||||
passed to
|
||||
\fIPROGRAM\fR\&. In the normal case (where administrator authentication is required every time
|
||||
\fBpkexec\fR
|
||||
is used), this is not a problem since if the user is an administrator he might as well just run
|
||||
\fBpkexec bash\fR
|
||||
to get root\&.
|
||||
.PP
|
||||
However, if an action is used for which the user can retain authorization (or if the user is implicitly authorized), such as with
|
||||
pk\-example\-frobnicate
|
||||
above, this could be a security hole\&. Therefore, as a rule of thumb, programs for which the default required authorization is changed, should never implicitly trust user input (e\&.g\&. like any other well\-written
|
||||
\fIsuid\fR
|
||||
program)\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpolkit\fR(8),
|
||||
\fBpkaction\fR(1),
|
||||
\fBpkcheck\fR(1)
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/pkexec-bash.png
|
||||
.IP " 2." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/pkexec-frobnicate.png
|
||||
.IP " 3." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/pkexec-frobnicate-da.png
|
||||
@@ -0,0 +1,466 @@
|
||||
'\" t
|
||||
.\" Title: pklocalauthority
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: May 2009
|
||||
.\" Manual: pklocalauthority
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PKLOCALAUTHORITY" "8" "May 2009" "polkit" "pklocalauthority"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
pklocalauthority \- PolicyKit Local Authority
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The Local Authority is the default PolicyKit authority implementation\&. Configuration for the Local Authority and information pertaining to authorization decisions are read from local files on the disk\&. One design goal of the Local Authority is to split configuration items into separate files such that 3rd party packages and users won\*(Aqt conflict trying to edit the same files\&. This policy also ensures smooth upgrades when distributing PolicyKit using a package management system\&.
|
||||
.PP
|
||||
Files shipped with PolicyKit and 3rd party packages (e\&.g\&. under package manager control) typically have comments (such as
|
||||
\(lqDO NOT EDIT THIS FILE, it will be overwritten on update\(rq) telling the system administrator that changes will be overwritten on update\&.
|
||||
.SH "ADMINISTRATOR AUTHENTICATION"
|
||||
.PP
|
||||
PolicyKit makes a distinction between
|
||||
\fIuser authentication\fR
|
||||
(to make the user in front of the system prove he really is the user) and
|
||||
\fIadministrator authentication\fR
|
||||
(to make the user in front of the system prove he really is an administrator)\&. Since various operating systems (or even flavors of the same operating system) has different ways of defining "administrator", the Local Authority provides a way to specify what "administrator authentication" means\&.
|
||||
.PP
|
||||
By default, "administrator authentication" is defined as asking for the root password\&. Since some systems, for usability reasons, don\*(Aqt have a root password and instead rely on a group of users being member of an administrative group that gives them super\-user privileges, the Local Authority can be configured to support this use\-case as well\&.
|
||||
.PP
|
||||
Configuration for the Local Authority is read from files in the
|
||||
/etc/polkit\-1/localauthority\&.conf\&.d
|
||||
directory\&. All files are read in lexigraphical order (using the C locale) meaning that later files can override earlier ones\&. The file
|
||||
50\-localauthority\&.conf
|
||||
contains the settings provided by the OS vendor\&. Users and 3rd party packages can drop configuration files with a priority higher than 60 to change the defaults\&. The configuration file format is simple\&. Each configuration file is a
|
||||
\fIkey file\fR
|
||||
(also commonly known as a
|
||||
\fIini file\fR) with a single group called
|
||||
[Configuration]\&. Only a single key,
|
||||
AdminIdentities
|
||||
is read\&. The value of this key is a semi\-colon separated list of identities that can be used when administrator authentication is required\&. Users are specified by prefixing the user name with
|
||||
unix\-user:
|
||||
and groups of users are specified by prefixing with
|
||||
unix\-group:\&. See
|
||||
the section called \(lqEXAMPLES\(rq
|
||||
for an example of a configuration file\&.
|
||||
.SH "DIRECTORY STRUCTURE"
|
||||
.PP
|
||||
The Local Authority reads files with
|
||||
\&.pkla
|
||||
extension from all directories located inside the
|
||||
/etc/polkit\-1/localauthority
|
||||
and
|
||||
/var/lib/polkit\-1/localauthority
|
||||
directories\&. By default, the following sub\-directories are installed\&.
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
/etc/polkit\-1/
|
||||
`\-\- localauthority
|
||||
|\-\- 10\-vendor\&.d
|
||||
|\-\- 20\-org\&.d
|
||||
|\-\- 30\-site\&.d
|
||||
|\-\- 50\-local\&.d
|
||||
`\-\- 90\-mandatory\&.d
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
and
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
/var/lib/polkit\-1/
|
||||
`\-\- localauthority
|
||||
|\-\- 10\-vendor\&.d
|
||||
|\-\- 20\-org\&.d
|
||||
|\-\- 30\-site\&.d
|
||||
|\-\- 50\-local\&.d
|
||||
`\-\- 90\-mandatory\&.d
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
The
|
||||
/etc/polkit\-1/localauthority
|
||||
hierarchy is inteded for local configuration and the
|
||||
/var/lib/polkit\-1/localauthority
|
||||
is intended for 3rd party packages\&.
|
||||
.PP
|
||||
Each
|
||||
\&.pkla
|
||||
file contains one or more authorization entries\&. If the underlying filesystem supports file monitoring, the Local Authority will reload information whenever
|
||||
\&.pkla
|
||||
files are added, removed or changed\&.
|
||||
.PP
|
||||
Each directory is intended for a specific audience
|
||||
.PP
|
||||
\fI10\-vendor\&.d\fR
|
||||
.RS 4
|
||||
Intended for use by the OS vendor\&.
|
||||
.RE
|
||||
.PP
|
||||
\fI20\-org\&.d\fR
|
||||
.RS 4
|
||||
Intended for the organization deploying the OS\&.
|
||||
.RE
|
||||
.PP
|
||||
\fI30\-site\&.d\fR
|
||||
.RS 4
|
||||
Intended for the site deploying the system\&.
|
||||
.RE
|
||||
.PP
|
||||
\fI50\-local\&.d\fR
|
||||
.RS 4
|
||||
Intended for local usage\&.
|
||||
.RE
|
||||
.PP
|
||||
\fI90\-mandatory\&.d\fR
|
||||
.RS 4
|
||||
Intended for the organization deploying the OS\&.
|
||||
.RE
|
||||
.PP
|
||||
and new directories can be added/removed as needed\&.
|
||||
.PP
|
||||
As to regards to the content, each
|
||||
\&.pkla
|
||||
file is a standard
|
||||
\fIkey file\fR
|
||||
and contains key/value pairs in one or more groups with each group representing an authorization entry\&. A
|
||||
\&.pkla
|
||||
file MUST be named by using a scheme to ensure that the name is unique, e\&.g\&. reverse DNS notation or similar\&. For example, if the organization is
|
||||
\(lqAcme Corp\(rq
|
||||
needs to modify policy for the product
|
||||
\(lqFrobnicator\(rq, a name like
|
||||
com\&.acme\&.frobnicator\&.pkla
|
||||
would be suitable\&.
|
||||
.SH "AUTHORIZATION ENTRY"
|
||||
.PP
|
||||
Each group in a
|
||||
\&.pkla
|
||||
file must have a name that is unique within the file it belongs to\&. The following keys are are recognized:
|
||||
.PP
|
||||
\fIIdentity\fR
|
||||
.RS 4
|
||||
A semi\-colon separated list of globs to match identities\&. Each glob should start with
|
||||
unix\-user:
|
||||
or
|
||||
unix\-group:
|
||||
to specify whether to match on a UNIX user name or a UNIX group name\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIAction\fR
|
||||
.RS 4
|
||||
A semi\-colon separated list of globs to match action identifiers\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIResultActive\fR
|
||||
.RS 4
|
||||
The result to return for subjects in an active local session that matches one or more of the given identities\&. Allowed values are similar to what can be used in the
|
||||
\fIdefaults\fR
|
||||
section of
|
||||
\&.policy
|
||||
files used to define actions, e\&.g\&.
|
||||
yes,
|
||||
no,
|
||||
auth_self,
|
||||
auth_self_keep,
|
||||
auth_admin
|
||||
and
|
||||
auth_admin_keep\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIResultInactive\fR
|
||||
.RS 4
|
||||
Like
|
||||
\fIResultActive\fR
|
||||
but instead applies to subjects in inactive local sessions\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIResultAny\fR
|
||||
.RS 4
|
||||
Like
|
||||
\fIResultActive\fR
|
||||
but instead applies to any subject\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIReturnValue\fR
|
||||
.RS 4
|
||||
A semi\-colon separated list of key/value pairs (of the form key=value) that are added to the details of authorization result on positive matches\&.
|
||||
.RE
|
||||
.PP
|
||||
All keys specified above are required except that only at least one of
|
||||
\fIResultAny\fR,
|
||||
\fIResultInactive\fR
|
||||
and
|
||||
\fIResultActive\fR
|
||||
must be present\&. The
|
||||
\fIReturnValue\fR
|
||||
key is optional\&.
|
||||
.SH "EVALUATION ORDER"
|
||||
.PP
|
||||
When a Mechanism requests services from the Authority to check if a given Subject is authorized for a given Action, the authorization entries discussed above are consulted using the following algorithm\&.
|
||||
.PP
|
||||
The authorization entries from all \&.pkla files are ordered using the following rules\&. First all the basename of all sub\-directories (e\&.g\&.
|
||||
\fI30\-site\&.d\fR) from both the
|
||||
/etc/polkit\-1/localauthority
|
||||
and
|
||||
/var/lib/polkit\-1/localauthority
|
||||
directories are enumerated and sorted (using the C locale)\&. If a name exists in both
|
||||
/etc
|
||||
and
|
||||
/var, the one in
|
||||
/etc
|
||||
takes precedence\&. Then all
|
||||
\&.pkla
|
||||
files are read in order from this list of sub\-directories\&. For each
|
||||
\&.pkla
|
||||
file, authorizations from each file are appended in order resulting in an ordered list of authorization entries\&.
|
||||
.PP
|
||||
For example, given the following files
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
/var/lib/polkit\-1
|
||||
└── localauthority
|
||||
├── 10\-vendor\&.d
|
||||
│ └── 10\-desktop\-policy\&.pkla
|
||||
├── 20\-org\&.d
|
||||
├── 30\-site\&.d
|
||||
├── 50\-local\&.d
|
||||
├── 55\-org\&.my\&.company\&.d
|
||||
│ └── 10\-org\&.my\&.company\&.product\&.pkla
|
||||
└── 90\-mandatory\&.d
|
||||
|
||||
/etc/polkit\-1
|
||||
└── localauthority
|
||||
├── 10\-vendor\&.d
|
||||
│ └── 01\-some\-changes\-from\-a\-subvendor\&.pkla
|
||||
├── 20\-org\&.d
|
||||
├── 30\-site\&.d
|
||||
├── 50\-local\&.d
|
||||
├── 55\-org\&.my\&.company\&.d
|
||||
│ └── 10\-org\&.my\&.company\&.product\&.pkla
|
||||
└── 90\-mandatory\&.d
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
the evaluation order of the
|
||||
\&.pkla
|
||||
files is:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04' 1.\h'+01'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP " 1." 4.2
|
||||
.\}
|
||||
|
||||
10\-desktop\-policy\&.pkla
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04' 2.\h'+01'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP " 2." 4.2
|
||||
.\}
|
||||
|
||||
01\-some\-changes\-from\-a\-subvendor\&.pkla
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04' 3.\h'+01'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP " 3." 4.2
|
||||
.\}
|
||||
|
||||
10\-org\&.my\&.company\&.product\&.pkla
|
||||
(the
|
||||
/var
|
||||
one)
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04' 4.\h'+01'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP " 4." 4.2
|
||||
.\}
|
||||
|
||||
10\-org\&.my\&.company\&.product\&.pkla
|
||||
(the
|
||||
/etc
|
||||
one)
|
||||
.RE
|
||||
.PP
|
||||
When the list of authorization entries has been calculated, the authorization check can be made\&. First, the user of the Subject is determined and the groups that the user belongs are looked up\&. For each group identity, the authorization entries are consulted in order\&. If the authorization check matches the data from the authorization check, then the authorization result from
|
||||
\fIRequireAny\fR,
|
||||
\fIRequireInactive\fR
|
||||
or
|
||||
\fIRequireActive\fR
|
||||
is used and
|
||||
\fIReturnValue\fR
|
||||
is added to the authorization result\&.
|
||||
.PP
|
||||
Finally, the authorization entries are consulted using the user identity in the same manner\&.
|
||||
.PP
|
||||
Note that processing continues even after a match\&. This allows for socalled
|
||||
\(lqnegative authorizations\(rq, see
|
||||
the section called \(lqEXAMPLES\(rq
|
||||
for further discussion\&.
|
||||
.SH "EXAMPLES"
|
||||
.PP
|
||||
The following
|
||||
\&.conf
|
||||
file
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
[Configuration]
|
||||
AdminIdentities=unix\-group:desktop_admin_r
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
that any user in the
|
||||
desktop_admin_r
|
||||
UNIX group can be used for authentication when administrator authentication is needed\&. This file would typically be installed in the
|
||||
/etc/polkit\-1/localauthority\&.conf\&.d
|
||||
directory and given the name
|
||||
60\-desktop\-policy\&.conf
|
||||
to ensure that it is evaluted after the
|
||||
50\-localauthority\&.conf
|
||||
file shipped with PolicyKit\&. If the local administrator wants to override this (suppose
|
||||
60\-desktop\-policy\&.conf
|
||||
was shipped as part of the OS) he can simply create a file
|
||||
99\-my\-admin\-configuration\&.conf
|
||||
with the following content
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
[Configuration]
|
||||
AdminIdentities=unix\-user:lisa;unix\-user:marge
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
to specify that only the users
|
||||
lisa
|
||||
and
|
||||
marge
|
||||
can authenticate when administrator authentication is needed\&.
|
||||
.PP
|
||||
The following
|
||||
\&.pkla
|
||||
file grants authorization to all users in the
|
||||
staff
|
||||
group for actions matching the glob
|
||||
com\&.example\&.awesomeproduct\&.*
|
||||
provided they are in an active session on the local console:
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
[Normal Staff Permissions]
|
||||
Identity=unix\-group:staff
|
||||
Action=com\&.example\&.awesomeproduct\&.*
|
||||
ResultAny=no
|
||||
ResultInactive=no
|
||||
ResultActive=yes
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
If the users
|
||||
homer
|
||||
and
|
||||
grimes
|
||||
are member of the
|
||||
staff
|
||||
group but policy requires that an administrator needs to authenticate every time authorization for any action matching
|
||||
com\&.example\&.awesomeproduct\&.*
|
||||
is required, one would add
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
[Exclude Some Problematic Users]
|
||||
Identity=unix\-user:homer;unix\-user:grimes
|
||||
Action=com\&.example\&.awesomeproduct\&.*
|
||||
ResultAny=no
|
||||
ResultInactive=no
|
||||
ResultActive=auth_admin
|
||||
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
and make sure this authorization entry is after the first one\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpolkit\fR(8)
|
||||
@@ -0,0 +1,408 @@
|
||||
'\" t
|
||||
.\" Title: polkit
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: January 2009
|
||||
.\" Manual: polkit
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "POLKIT" "8" "January 2009" "polkit" "polkit"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
polkit \- Authorization Framework
|
||||
.SH "OVERVIEW"
|
||||
.PP
|
||||
PolicyKit provides an authorization API intended to be used by privileged programs (\(lqMECHANISMS\(rq) offering service to unprivileged programs (\(lqCLIENTS\(rq) through some form of IPC mechanism such as D\-Bus or Unix pipes\&. In this scenario, the mechanism typically treats the client as untrusted\&. For every request from a client, the mechanism needs to determine if the request is authorized or if it should refuse to service the client\&. Using the PolicyKit API, a mechanism can offload this decision to a trusted party: The PolicyKit Authority\&.
|
||||
.PP
|
||||
In addition to acting as an authority, PolicyKit allows users to obtain temporary authorization through authenticating either an administrative user or the owner of the session the client belongs to\&. This is useful for scenarios where a mechanism needs to verify that the operator of the system really is the user or really is an administrative user\&.
|
||||
.SH "SYSTEM ARCHITECTURE"
|
||||
.PP
|
||||
The system architecture of PolicyKit is comprised of the
|
||||
\fIAuthority\fR
|
||||
(implemented as a service on the system message bus) and a
|
||||
\fIAuthentication Agent\fR
|
||||
per user session (provided and started by the user session e\&.g\&. GNOME or KDE)\&. Additionally, PolicyKit supports a number of extension points \(en specifically, vendors and/or sites can write extensions to completely control authorization policy\&. In a block diagram, the architecture looks like this:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[1]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Authentication |
|
||||
| Agent |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| libpolkit\-agent\-1 |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
^ +\-\-\-\-\-\-\-\-+
|
||||
| | Client |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +\-\-\-\-\-\-\-\-+
|
||||
| ^
|
||||
| |
|
||||
User Session | |
|
||||
=======================|========================|=============
|
||||
System Context | |
|
||||
| |
|
||||
| +\-\-\-+
|
||||
V |
|
||||
/\-\-\-\-\-\-\-\-\-\-\-\-\e |
|
||||
| System Bus | |
|
||||
\e\-\-\-\-\-\-\-\-\-\-\-\-/ |
|
||||
^ ^ V
|
||||
| | +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ | | Mechanism |
|
||||
| | +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
V +\-\-\-\-> | libpolkit\-gobject\-1 |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+ +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| org\&.freedesktop\&. |
|
||||
| PolicyKit1 |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Backends and |
|
||||
| Extensions |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
For convenience, the
|
||||
libpolkit\-gobject\-1
|
||||
library wraps the PolicyKit D\-Bus API using GObject\&. However, a mechanism can also use the D\-Bus API or the
|
||||
\fBpkcheck\fR(1)
|
||||
command to check authorizations\&.
|
||||
.PP
|
||||
The
|
||||
libpolkit\-agent\-1
|
||||
library provides an abstraction of the native authentication system, e\&.g\&.
|
||||
\fBpam\fR(8)
|
||||
and also facilities registration and communication with the PolicyKit D\-Bus service\&.
|
||||
.PP
|
||||
PolicyKit extensions and authority backends are implemented using the
|
||||
libpolkit\-backend\-1
|
||||
library\&.
|
||||
.PP
|
||||
See the
|
||||
\m[blue]\fBdeveloper documentation\fR\m[]\&\s-2\u[2]\d\s+2
|
||||
for more information about using and extending PolicyKit\&.
|
||||
.PP
|
||||
See
|
||||
\fBpklocalauthority\fR(8)
|
||||
for information about the Local Authority \- the default authority implementation shipped with PolicyKit\&.
|
||||
.SH "AUTHENTICATION AGENTS"
|
||||
.PP
|
||||
An authentication agent is used to make the user of a session prove that the user of the session really is the user (by authenticating as the user) or an administrative user (by authenticating as a administrator)\&. In order to integrate well with the rest of the user session (e\&.g\&. match the look and feel), authentication agents are meant to be provided by the user session that the user uses\&. For example, an authentication agent may look like this:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[3]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Authenticate [X] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| |
|
||||
| [Icon] Authentication is required to run ATA SMART |
|
||||
| self tests |
|
||||
| |
|
||||
| An application is attempting to perform an |
|
||||
| action that requires privileges\&. Authentication |
|
||||
| as the super user is required to perform this |
|
||||
| action\&. |
|
||||
| |
|
||||
| Password for root: [_________________________] |
|
||||
| |
|
||||
| [V] Details: |
|
||||
| Drive: ATA INTEL SSDSA2MH08 (045C) |
|
||||
| Device: /dev/sda |
|
||||
| Action: org\&.fd\&.devicekit\&.disks\&.drive\-ata\-smart\-selftest |
|
||||
| Vendor: The DeviceKit Project |
|
||||
| |
|
||||
| [Cancel] [Authenticate] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
If the system is configured without a
|
||||
\fIroot\fR
|
||||
account it may allow you to select the administrative user who is authenticating:
|
||||
.sp
|
||||
.RS 4
|
||||
[IMAGE]\&\s-2\u[4]\d\s+2
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| Authenticate [X] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
| |
|
||||
| [Icon] Authentication is required to run ATA SMART |
|
||||
| self tests |
|
||||
| |
|
||||
| An application is attempting to perform an |
|
||||
| action that requires privileges\&. Authentication |
|
||||
| as one of the users below is required to |
|
||||
| perform this action\&. |
|
||||
| |
|
||||
| [[Face] Patrick Bateman (bateman) [V]] |
|
||||
| |
|
||||
| Password for bateman: [______________________] |
|
||||
| |
|
||||
| [V] Details: |
|
||||
| Drive: ATA INTEL SSDSA2MH08 (045C) |
|
||||
| Device: /dev/sda |
|
||||
| Action: org\&.fd\&.devicekit\&.disks\&.drive\-ata\-smart\-selftest |
|
||||
| Vendor: The DeviceKit Project |
|
||||
| |
|
||||
| [Cancel] [Authenticate] |
|
||||
+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.RE
|
||||
.PP
|
||||
See
|
||||
\fBpklocalauthority\fR(8)
|
||||
on how to set up the local authority implemention for systems without a
|
||||
root
|
||||
account\&.
|
||||
.SH "DECLARING ACTIONS"
|
||||
.PP
|
||||
A mechanism need to declare a set of
|
||||
\(lqACTIONS\(rq
|
||||
in order to use PolicyKit\&. Actions correspond to operations that clients can request the mechanism to carry out and are defined in XML files that the mechanism installs into the
|
||||
/usr/share/polkit\-1/actions
|
||||
directory\&.
|
||||
.PP
|
||||
PolicyKit actions are namespaced and can only contain the characters
|
||||
[a\-z][0\-9]\&.\-
|
||||
e\&.g\&. lower\-case ASCII, digits, period and hyphen\&. Each XML file can contain more than one action but all actions need to be in the same namespace and the file needs to be named after the namespace and have the extension
|
||||
\&.policy\&.
|
||||
.PP
|
||||
The XML file must have the following doctype declaration
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
<?xml version="1\&.0" encoding="UTF\-8"?>
|
||||
<!DOCTYPE policyconfig PUBLIC "\-//freedesktop//DTD PolicyKit Policy Configuration 1\&.0//EN"
|
||||
"http://www\&.freedesktop\&.org/standards/PolicyKit/1\&.0/policyconfig\&.dtd">
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.PP
|
||||
The
|
||||
\fIpolicyconfig\fR
|
||||
element must be present exactly once\&. Elements that can be used inside
|
||||
\fIpolicyconfig\fR
|
||||
includes:
|
||||
.PP
|
||||
\fIvendor\fR
|
||||
.RS 4
|
||||
The name of the project or vendor that is supplying the actions in the XML document\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIvendor_url\fR
|
||||
.RS 4
|
||||
A URL to the project or vendor that is supplying the actions in the XML document\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIicon_name\fR
|
||||
.RS 4
|
||||
An icon representing the project or vendor that is supplying the actions in the XML document\&. The icon name must adhere to the
|
||||
\m[blue]\fBFreedesktop\&.org Icon Naming Specification\fR\m[]\&\s-2\u[5]\d\s+2\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIaction\fR
|
||||
.RS 4
|
||||
Declares an action\&. The action name is specified using the
|
||||
id
|
||||
attribute and can only contain the characters
|
||||
[a\-z][0\-9]\&.\-
|
||||
e\&.g\&. lower\-case ASCII, digits, period and hyphen\&.
|
||||
.RE
|
||||
.PP
|
||||
Elements that can be used inside
|
||||
\fIaction\fR
|
||||
includes:
|
||||
.PP
|
||||
\fIdescription\fR
|
||||
.RS 4
|
||||
A human readable description of the action, e\&.g\&.
|
||||
\(lqInstall unsigned software\(rq\&.
|
||||
.RE
|
||||
.PP
|
||||
\fImessage\fR
|
||||
.RS 4
|
||||
A human readable message displayed to the user when asking for credentials when authentication is needed, e\&.g\&.
|
||||
\(lqInstalling unsigned software requires authentication\(rq\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIdefaults\fR
|
||||
.RS 4
|
||||
This element is used to specify implicit authorizations for clients\&.
|
||||
.sp
|
||||
Elements that can be used inside
|
||||
\fIdefaults\fR
|
||||
includes:
|
||||
.PP
|
||||
\fIallow_any\fR
|
||||
.RS 4
|
||||
Implicit authorizations that apply to any client\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIallow_inactive\fR
|
||||
.RS 4
|
||||
Implicit authorizations that apply to clients in inactive sessions on local consoles\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIallow_active\fR
|
||||
.RS 4
|
||||
Implicit authorizations that apply to clients in active sessions on local consoles\&. Optional\&.
|
||||
.RE
|
||||
.sp
|
||||
Each of the
|
||||
\fIallow_any\fR,
|
||||
\fIallow_inactive\fR
|
||||
and
|
||||
\fIallow_active\fR
|
||||
elements can contain the following values:
|
||||
.PP
|
||||
no
|
||||
.RS 4
|
||||
Not authorized\&.
|
||||
.RE
|
||||
.PP
|
||||
yes
|
||||
.RS 4
|
||||
Authorized\&.
|
||||
.RE
|
||||
.PP
|
||||
auth_self
|
||||
.RS 4
|
||||
Authentication by the owner of the session that the client originates from is required\&.
|
||||
.RE
|
||||
.PP
|
||||
auth_admin
|
||||
.RS 4
|
||||
Authentication by an administrative user is required\&.
|
||||
.RE
|
||||
.PP
|
||||
auth_self_keep
|
||||
.RS 4
|
||||
Like
|
||||
auth_self
|
||||
but the authorization is kept for a brief period\&.
|
||||
.RE
|
||||
.PP
|
||||
auth_admin_keep
|
||||
.RS 4
|
||||
Like
|
||||
auth_admin
|
||||
but the authorization is kept for a brief period\&.
|
||||
.RE
|
||||
.RE
|
||||
.PP
|
||||
\fIannotate\fR
|
||||
.RS 4
|
||||
Used for annotating an action with a key/value pair\&. The key is specified using the the
|
||||
key
|
||||
attribute and the value is specified using the
|
||||
value
|
||||
attribute\&. This element may appear zero or more times\&. See
|
||||
\fBpkexec\fR(1)
|
||||
for an example of how this can be used\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIvendor\fR
|
||||
.RS 4
|
||||
Used for overriding the vendor on a per\-action basis\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIvendor_url\fR
|
||||
.RS 4
|
||||
Used for overriding the vendor URL on a per\-action basis\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
\fIicon_name\fR
|
||||
.RS 4
|
||||
Used for overriding the icon name on a per\-action basis\&. Optional\&.
|
||||
.RE
|
||||
.PP
|
||||
For localization,
|
||||
\fIdescription\fR
|
||||
and
|
||||
\fImessage\fR
|
||||
elements may occur multiple times with different
|
||||
xml:lang
|
||||
attributes\&.
|
||||
.PP
|
||||
To list installed PolicyKit actions, use the
|
||||
\fBpkaction\fR(1)
|
||||
command\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpklocalauthority\fR(8)
|
||||
\fBpolkitd\fR(8)
|
||||
\fBpkaction\fR(1),
|
||||
\fBpkcheck\fR(1),
|
||||
\fBpkexec\fR(1),
|
||||
.SH "NOTES"
|
||||
.IP " 1." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/polkit-architecture.png
|
||||
.IP " 2." 4
|
||||
developer documentation
|
||||
.RS 4
|
||||
\%file:///usr/share/gtk-doc/html/polkit-1/index.html
|
||||
.RE
|
||||
.IP " 3." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/polkit-authentication-agent-example.png
|
||||
.IP " 4." 4
|
||||
/usr/share/gtk-doc/html/polkit-1/polkit-authentication-agent-example-wheel.png
|
||||
.IP " 5." 4
|
||||
Freedesktop.org Icon Naming Specification
|
||||
.RS 4
|
||||
\%http://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html
|
||||
.RE
|
||||
@@ -0,0 +1,57 @@
|
||||
'\" t
|
||||
.\" Title: polkitd
|
||||
.\" Author: [see the "AUTHOR" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
|
||||
.\" Date: May 2009
|
||||
.\" Manual: polkitd
|
||||
.\" Source: polkit
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "POLKITD" "8" "May 2009" "polkit" "polkitd"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.\" http://bugs.debian.org/507673
|
||||
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
|
||||
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
.ie \n(.g .ds Aq \(aq
|
||||
.el .ds Aq '
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * set default formatting
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" disable hyphenation
|
||||
.nh
|
||||
.\" disable justification (adjust text to left margin only)
|
||||
.ad l
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * MAIN CONTENT STARTS HERE *
|
||||
.\" -----------------------------------------------------------------
|
||||
.SH "NAME"
|
||||
polkitd \- PolicyKit daemon
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBpolkitd\fR\ 'u
|
||||
\fBpolkitd\fR
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
|
||||
\fBpolkitd\fR
|
||||
provides the
|
||||
\fIorg\&.freedesktop\&.PolicyKit1\fR
|
||||
D\-Bus service on the system message bus\&. Users or administrators should never need to start this daemon as it will be automatically started by
|
||||
\fBdbus-daemon\fR(1)
|
||||
whenever an application calls into the service\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
Written by David Zeuthen
|
||||
davidz@redhat\&.com
|
||||
with a lot of help from many others\&.
|
||||
.SH "BUGS"
|
||||
.PP
|
||||
Please send bug reports to either the distribution or the polkit\-devel mailing list, see the link
|
||||
\m[blue]\fB\%http://lists.freedesktop.org/mailman/listinfo/polkit-devel\fR\m[]
|
||||
on how to subscribe\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
|
||||
\fBpolkit\fR(8)
|
||||
@@ -0,0 +1,28 @@
|
||||
Index: polkit-0.99/src/polkit/polkitauthority.c
|
||||
===================================================================
|
||||
--- polkit-0.99.orig/src/polkit/polkitauthority.c
|
||||
+++ polkit-0.99/src/polkit/polkitauthority.c
|
||||
@@ -23,6 +23,8 @@
|
||||
# include "config.h"
|
||||
#endif
|
||||
|
||||
+#include <locale.h>
|
||||
+
|
||||
#include "polkitauthorizationresult.h"
|
||||
#include "polkitcheckauthorizationflags.h"
|
||||
#include "polkitauthority.h"
|
||||
@@ -650,10 +652,13 @@ polkit_authority_enumerate_actions (Polk
|
||||
{
|
||||
g_return_if_fail (POLKIT_IS_AUTHORITY (authority));
|
||||
g_return_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable));
|
||||
+
|
||||
+ char *locale = setlocale(LC_MESSAGES, NULL);
|
||||
+
|
||||
g_dbus_proxy_call (authority->proxy,
|
||||
"EnumerateActions",
|
||||
g_variant_new ("(s)",
|
||||
- ""), /* TODO: use system locale */
|
||||
+ locale ? locale : ""),
|
||||
G_DBUS_CALL_FLAGS_NONE,
|
||||
-1,
|
||||
cancellable,
|
||||
@@ -0,0 +1,130 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE PISI SYSTEM "http://www.pisilinux.org/projeler/pisi/pisi-spec.dtd">
|
||||
<PISI>
|
||||
<Source>
|
||||
<Name>polkit</Name>
|
||||
<Homepage>http://www.freedesktop.org/wiki/Software/PolicyKit</Homepage>
|
||||
<Packager>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Packager>
|
||||
<License>LGPLv2+</License>
|
||||
<IsA>service</IsA>
|
||||
<IsA>library</IsA>
|
||||
<IsA>app:console</IsA>
|
||||
<Summary>PolicyKit Authorization Framework</Summary>
|
||||
<Description>polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.</Description>
|
||||
<Archive sha1sum="374397f1c32fa1290be0fce378fe9bab541ee4bf" type="targz">http://www.freedesktop.org/software/polkit/releases/polkit-0.112.tar.gz</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency>pam-devel</Dependency>
|
||||
<Dependency>dbus-devel</Dependency>
|
||||
<Dependency>glib2-devel</Dependency>
|
||||
<Dependency>expat-devel</Dependency>
|
||||
<Dependency>dbus-glib-devel</Dependency>
|
||||
<Dependency>spidermonkey-devel</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch level="1">disable-docs.patch</Patch>
|
||||
<Patch level="1">use-system-locale-in-gobject-api.diff</Patch>
|
||||
</Patches>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>polkit-devel</Name>
|
||||
<PartOf>system.devel</PartOf>
|
||||
<Summary>Development headers for polkit</Summary>
|
||||
<RuntimeDependencies>
|
||||
<Dependency release="current">polkit</Dependency>
|
||||
<Dependency>glib2-devel</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="header">/usr/include</Path>
|
||||
<Path fileType="data">/usr/lib/pkgconfig</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
|
||||
<Package>
|
||||
<Name>polkit</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>pam</Dependency>
|
||||
<Dependency>dbus</Dependency>
|
||||
<Dependency>glib2</Dependency>
|
||||
<Dependency>expat</Dependency>
|
||||
<Dependency>dbus-glib</Dependency>
|
||||
<Dependency>spidermonkey</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="config">/etc</Path>
|
||||
<Path fileType="library">/usr/lib</Path>
|
||||
<Path fileType="executable">/usr/libexec</Path>
|
||||
<Path fileType="executable">/usr/bin</Path>
|
||||
<Path fileType="executable">/usr/sbin</Path>
|
||||
<Path fileType="localedata">/usr/share/locale</Path>
|
||||
<Path fileType="data">/usr/share/polkit-1</Path>
|
||||
<Path fileType="data">/usr/share/dbus-1</Path>
|
||||
<Path fileType="data">/usr/share/gir-1.0</Path>
|
||||
<Path fileType="data">/var/lib/polkit-1</Path>
|
||||
<Path fileType="data">/lib/systemd</Path>
|
||||
<Path fileType="man">/usr/share/man</Path>
|
||||
<Path fileType="doc">/usr/share/doc</Path>
|
||||
</Files>
|
||||
<AdditionalFiles>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man8/pklocalauthority.8">man/pklocalauthority.8</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man8/polkit.8">man/polkit.8</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man8/polkitd.8">man/polkitd.8</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man1/pkaction.1">man/pkaction.1</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man1/pkcheck.1">man/pkcheck.1</AdditionalFile>
|
||||
<AdditionalFile owner="root" permission="0644" target="/usr/share/man/man1/pkexec.1">man/pkexec.1</AdditionalFile>
|
||||
|
||||
<AdditionalFile owner="root" permission="0644" target="/etc/polkit-1/rules.d/70-desktop-policy.conf">70-desktop-policy.conf</AdditionalFile>
|
||||
<!-- Example policy files from fedora
|
||||
<AdditionalFile owner="root" permission="0644" target="/var/lib/polkit-1/localauthority/10-vendor.d/10-desktop-policy.pkla">10-desktop-policy.pkla</AdditionalFile>
|
||||
-->
|
||||
</AdditionalFiles>
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="6">
|
||||
<Date>2014-06-10</Date>
|
||||
<Version>0.112</Version>
|
||||
<Comment>Release bump.</Comment>
|
||||
<Name>Alihan Öztürk</Name>
|
||||
<Email>alihan@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="5">
|
||||
<Date>2014-05-11</Date>
|
||||
<Version>0.112</Version>
|
||||
<Comment>Release bump.</Comment>
|
||||
<Name>Marcin Bojara</Name>
|
||||
<Email>marcin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="4">
|
||||
<Date>2014-04-01</Date>
|
||||
<Version>0.112</Version>
|
||||
<Comment>Version bump.</Comment>
|
||||
<Name>Serdar Soytetir</Name>
|
||||
<Email>kaptan@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="3">
|
||||
<Date>2013-07-28</Date>
|
||||
<Version>0.111</Version>
|
||||
<Comment>Version bump.</Comment>
|
||||
<Name>Marcin Bojara</Name>
|
||||
<Email>marcin@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="2">
|
||||
<Date>2013-02-11</Date>
|
||||
<Version>0.110</Version>
|
||||
<Comment>Güncellendi.</Comment>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Update>
|
||||
<Update release="1">
|
||||
<Date>2013-01-11</Date>
|
||||
<Version>0.107</Version>
|
||||
<Comment>First release</Comment>
|
||||
<Name>Serdar Soytetir</Name>
|
||||
<Email>kaptan@pisilinux.org</Email>
|
||||
</Update>
|
||||
</History>
|
||||
</PISI>
|
||||
@@ -0,0 +1,14 @@
|
||||
<?xml version="1.0" ?>
|
||||
<PISI>
|
||||
<Source>
|
||||
<Name>polkit</Name>
|
||||
<Summary xml:lang="tr">Sistem bileşenleri için erişim politikası servisi</Summary>
|
||||
<Description xml:lang="tr">polkit, sistem genelindeki bileşenlerin ve masaüstü bileşenlerinin ayarlayabileceği şekilde ilkeler tanımlamak için araçlardan oluşur.</Description>
|
||||
<Description xml:lang="fr">polkit est un cadre de développement (framework) pour définir des politiques à appliquer à des composants du système ainsi que fournir à des parties du bureau la possibilité de les configurer.</Description>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>polkit-devel</Name>
|
||||
<Summary xml:lang="tr">polkit geliştirme başlıkları</Summary>
|
||||
</Package>
|
||||
</PISI>
|
||||
Reference in New Issue
Block a user