doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0139-cli-enable-polkit-authentication-on-command-line.patch

baab13
From d2dcaeddfe015d3fee3817737e1bae72f1ad3316 Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Wed, 1 Jul 2015 13:38:57 +0200
baab13
Subject: [PATCH] cli: enable polkit authentication on command line
baab13
baab13
This patch will allow users to work with all problems without the need
baab13
to run abrt-cli under root account.
baab13
baab13
The polkit aget will run in a separate thread and will interact with a
baab13
user via STDOUT and STDIN, so we should not introduce new threads using
baab13
STDIN or STDOUT and all D-Bus calls should be synchronous.
baab13
baab13
http://www.freedesktop.org/software/polkit/docs/latest/ref-authentication-agent-api.html
baab13
baab13
Related: #1224984
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
baab13
Conflicts:
baab13
	src/cli/Makefile.am
baab13
---
baab13
 configure.ac            |  1 +
baab13
 doc/abrt-cli.txt        | 11 +++++++++--
baab13
 src/cli/Makefile.am     |  2 ++
baab13
 src/cli/abrt-cli-core.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++--
baab13
 src/cli/abrt-cli-core.h |  9 ++++++++-
baab13
 src/cli/abrt-cli.c      | 15 ++++++++++++++-
baab13
 6 files changed, 82 insertions(+), 6 deletions(-)
baab13
baab13
diff --git a/configure.ac b/configure.ac
baab13
index d65bf54..56b8ad8 100644
baab13
--- a/configure.ac
baab13
+++ b/configure.ac
baab13
@@ -104,6 +104,7 @@ PKG_CHECK_MODULES([NSS], [nss])
baab13
 PKG_CHECK_MODULES([LIBREPORT], [libreport])
baab13
 PKG_CHECK_MODULES([LIBREPORT_GTK], [libreport-gtk])
baab13
 PKG_CHECK_MODULES([POLKIT], [polkit-gobject-1])
baab13
+PKG_CHECK_MODULES([POLKIT_AGENT], [polkit-agent-1])
baab13
 PKG_CHECK_MODULES([GIO], [gio-2.0])
baab13
 PKG_CHECK_MODULES([SATYR], [satyr])
baab13
 PKG_CHECK_MODULES([LIBSELINUX], [libselinux])
baab13
diff --git a/doc/abrt-cli.txt b/doc/abrt-cli.txt
baab13
index 399b5fd..0f18784 100644
baab13
--- a/doc/abrt-cli.txt
baab13
+++ b/doc/abrt-cli.txt
baab13
@@ -7,6 +7,8 @@ abrt-cli - List, remove, print, analyze, report problems
baab13
 
baab13
 SYNOPSIS
baab13
 --------
baab13
+'abrt-cli' [--authenticate] COMMAND [COMMAND OPTIONS]
baab13
+
baab13
 'abrt-cli' list    [-vn] [--detailed] [--since NUM] [--until NUM] [DIR]...
baab13
 
baab13
 'abrt-cli' remove  [-v]  DIR...
baab13
@@ -19,8 +21,13 @@ SYNOPSIS
baab13
 
baab13
 'abrt-cli' process [-v]  [--since NUM] DIR...
baab13
 
baab13
-OPTIONS
baab13
--------
baab13
+GLOBAL OPTIONS
baab13
+--------------
baab13
+-a,--authenticate::
baab13
+   Enable PolicyKit authentication to be able to work with the system problems
baab13
+
baab13
+COMMAND OPTIONS
baab13
+---------------
baab13
 -v,--verbose::
baab13
    Be more verbose. Can be given multiple times.
baab13
 
baab13
diff --git a/src/cli/Makefile.am b/src/cli/Makefile.am
baab13
index 9fff5b3..a7c76ef 100644
baab13
--- a/src/cli/Makefile.am
baab13
+++ b/src/cli/Makefile.am
baab13
@@ -17,6 +17,7 @@ abrt_cli_CFLAGS = \
baab13
 	-I$(srcdir)/../include \
baab13
 	-I$(srcdir)/../lib \
baab13
 	$(LIBREPORT_CFLAGS) \
baab13
+	$(POLKIT_AGENT_CFLAGS) \
baab13
 	-DWORKFLOWS_DIR=\"${WORKFLOWS_DIR}\"
baab13
 
baab13
 if SUGGEST_AUTOREPORTING
baab13
@@ -24,6 +25,7 @@ abrt_cli_CFLAGS += -DSUGGEST_AUTOREPORTING=1
baab13
 endif
baab13
 
baab13
 abrt_cli_LDADD = \
baab13
+    $(POLKIT_AGENT_LIBS) \
baab13
     $(LIBREPORT_LIBS) \
baab13
     ../lib/libabrt.la
baab13
 
baab13
diff --git a/src/cli/abrt-cli-core.c b/src/cli/abrt-cli-core.c
baab13
index 46acd01..ca49dbd 100644
baab13
--- a/src/cli/abrt-cli-core.c
baab13
+++ b/src/cli/abrt-cli-core.c
baab13
@@ -20,6 +20,17 @@
baab13
 #include "libabrt.h"
baab13
 #include "abrt-cli-core.h"
baab13
 
baab13
+/* It is not possible to include polkitagent.h without the following define.
baab13
+ * Check out the included header file.
baab13
+ */
baab13
+#define POLKIT_AGENT_I_KNOW_API_IS_SUBJECT_TO_CHANGE
baab13
+#include <polkitagent/polkitagent.h>
baab13
+
baab13
+int g_cli_authenticate;
baab13
+
baab13
+static PolkitAgentListener *s_local_polkit_agent = NULL;
baab13
+static gpointer s_local_agent_handle = NULL;
baab13
+
baab13
 /* Vector of problems: */
baab13
 /* problem_data_vector[i] = { "name" = { "content", CD_FLAG_foo_bits } } */
baab13
 
baab13
@@ -41,7 +52,7 @@ vector_of_problem_data_t *new_vector_of_problem_data(void)
baab13
 
baab13
 vector_of_problem_data_t *fetch_crash_infos(void)
baab13
 {
baab13
-    GList *problems = get_problems_over_dbus(/*don't authorize*/false);
baab13
+    GList *problems = get_problems_over_dbus(g_cli_authenticate);
baab13
     if (problems == ERR_PTR)
baab13
         return NULL;
baab13
 
baab13
@@ -97,7 +108,7 @@ char *find_problem_by_hash(const char *hash, GList *problems)
baab13
 char *hash2dirname(const char *hash)
baab13
 {
baab13
     /* Try loading by dirname hash */
baab13
-    GList *problems = get_problems_over_dbus(/*don't authorize*/false);
baab13
+    GList *problems = get_problems_over_dbus(g_cli_authenticate);
baab13
     if (problems == ERR_PTR)
baab13
         return NULL;
baab13
 
baab13
@@ -112,3 +123,38 @@ char *hash2dirname_if_necessary(const char *input)
baab13
 {
baab13
     return isxdigit_str(input) ? hash2dirname(input) : xstrdup(input);
baab13
 }
baab13
+
baab13
+void initialize_polkit_agent(void)
baab13
+{
baab13
+    GError *error = NULL;
baab13
+    PolkitSubject *subject = polkit_unix_process_new_for_owner(
baab13
+                                getpid(),
baab13
+                                /*start time from /proc*/0,
baab13
+                                getuid());
baab13
+
baab13
+    s_local_polkit_agent = polkit_agent_text_listener_new(NULL, &error);
baab13
+    if (s_local_polkit_agent == NULL)
baab13
+    {
baab13
+        error_msg_and_die("polkit_agent_text_listener_new: %s (%s, %d)\n",
baab13
+                error->message, g_quark_to_string (error->domain), error->code);
baab13
+    }
baab13
+
baab13
+    s_local_agent_handle = polkit_agent_listener_register(s_local_polkit_agent,
baab13
+            POLKIT_AGENT_REGISTER_FLAGS_RUN_IN_THREAD, subject, NULL, NULL, &error);
baab13
+    if (s_local_agent_handle == NULL)
baab13
+    {
baab13
+        error_msg_and_die("polkit_agent_listener_register: %s (%s, %d)\n",
baab13
+                error->message, g_quark_to_string (error->domain), error->code);
baab13
+    }
baab13
+
baab13
+    g_object_unref(subject);
baab13
+}
baab13
+
baab13
+void uninitialize_polkit_agent(void)
baab13
+{
baab13
+    if (s_local_agent_handle != NULL)
baab13
+        polkit_agent_listener_unregister(s_local_agent_handle);
baab13
+
baab13
+    if (s_local_polkit_agent != NULL)
baab13
+        g_object_unref(s_local_polkit_agent);
baab13
+}
baab13
diff --git a/src/cli/abrt-cli-core.h b/src/cli/abrt-cli-core.h
baab13
index d69d463..e2456e6 100644
baab13
--- a/src/cli/abrt-cli-core.h
baab13
+++ b/src/cli/abrt-cli-core.h
baab13
@@ -22,6 +22,10 @@
baab13
 
baab13
 #include "problem_api.h"
baab13
 
baab13
+/* Use authenticate D-Bus methods. The authentication requires a polkit agent
baab13
+ * to finish an authenticated method successfully. */
baab13
+extern int g_cli_authenticate;
baab13
+
baab13
 typedef GPtrArray vector_of_problem_data_t;
baab13
 
baab13
 problem_data_t *get_problem_data(vector_of_problem_data_t *vector, unsigned i);
baab13
@@ -37,6 +41,9 @@ char *hash2dirname(const char *hash);
baab13
 /* If input looks like a hash, returns malloced string, or NULL if not found.
baab13
  * Otherwise returns a copy of the input. */
baab13
 char *hash2dirname_if_necessary(const char *input);
baab13
-
baab13
+/* Initialize a new polkit text agent in a new thread */
baab13
+void initialize_polkit_agent(void);
baab13
+/* Uninitialize the polkit text agent */
baab13
+void uninitialize_polkit_agent(void);
baab13
 
baab13
 #endif /* ABRT_CLI_CORE_H_ */
baab13
diff --git a/src/cli/abrt-cli.c b/src/cli/abrt-cli.c
baab13
index 8e19081..f45523e 100644
baab13
--- a/src/cli/abrt-cli.c
baab13
+++ b/src/cli/abrt-cli.c
baab13
@@ -19,6 +19,7 @@
baab13
 
baab13
 #include "libabrt.h"
baab13
 #include "builtin-cmd.h"
baab13
+#include "abrt-cli-core.h"
baab13
 
baab13
 #define USAGE_OPTS_WIDTH 16
baab13
 #define USAGE_GAP         2
baab13
@@ -75,6 +76,10 @@ static unsigned handle_internal_options(int argc, const char **argv, const char
baab13
         {
baab13
             return skip + argc;
baab13
         }
baab13
+        else if (strcmp(cmd, "-a") == 0 || strcmp(cmd, "--authenticate") == 0)
baab13
+        {
baab13
+            g_cli_authenticate = 1;
baab13
+        }
baab13
         else
baab13
             error_msg_and_die("%s", usage);
baab13
 
baab13
@@ -122,7 +127,7 @@ int main(int argc, const char **argv)
baab13
     argc--;
baab13
 
baab13
     const char *abrt_cli_usage_string = _(
baab13
-        "Usage: abrt-cli [--version] COMMAND [DIR]..."
baab13
+        "Usage: abrt-cli [--authenticate] [--version] COMMAND [DIR]..."
baab13
         );
baab13
 
baab13
     const struct cmd_struct commands[] = {
baab13
@@ -141,8 +146,16 @@ int main(int argc, const char **argv)
baab13
     argc -= skip;
baab13
     argv += skip;
baab13
     if (argc > 0)
baab13
+    {
baab13
+        if (g_cli_authenticate)
baab13
+            initialize_polkit_agent();
baab13
+
baab13
         handle_internal_command(argc, argv, commands);
baab13
 
baab13
+        if (g_cli_authenticate)
baab13
+            uninitialize_polkit_agent();
baab13
+    }
baab13
+
baab13
     /* user didn't specify command; print out help */
baab13
     printf("%s\n\n", abrt_cli_usage_string);
baab13
     list_cmds_help(commands);
baab13
-- 
baab13
2.4.3
baab13