From d2dcaeddfe015d3fee3817737e1bae72f1ad3316 Mon Sep 17 00:00:00 2001
From: Jakub Filak <jfilak@redhat.com>
Date: Wed, 1 Jul 2015 13:38:57 +0200
Subject: [PATCH] cli: enable polkit authentication on command line
This patch will allow users to work with all problems without the need
to run abrt-cli under root account.
The polkit aget will run in a separate thread and will interact with a
user via STDOUT and STDIN, so we should not introduce new threads using
STDIN or STDOUT and all D-Bus calls should be synchronous.
http://www.freedesktop.org/software/polkit/docs/latest/ref-authentication-agent-api.html
Related: #1224984
Signed-off-by: Jakub Filak <jfilak@redhat.com>
Conflicts:
src/cli/Makefile.am
---
configure.ac | 1 +
doc/abrt-cli.txt | 11 +++++++++--
src/cli/Makefile.am | 2 ++
src/cli/abrt-cli-core.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++--
src/cli/abrt-cli-core.h | 9 ++++++++-
src/cli/abrt-cli.c | 15 ++++++++++++++-
6 files changed, 82 insertions(+), 6 deletions(-)
diff --git a/configure.ac b/configure.ac
index d65bf54..56b8ad8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -104,6 +104,7 @@ PKG_CHECK_MODULES([NSS], [nss])
PKG_CHECK_MODULES([LIBREPORT], [libreport])
PKG_CHECK_MODULES([LIBREPORT_GTK], [libreport-gtk])
PKG_CHECK_MODULES([POLKIT], [polkit-gobject-1])
+PKG_CHECK_MODULES([POLKIT_AGENT], [polkit-agent-1])
PKG_CHECK_MODULES([GIO], [gio-2.0])
PKG_CHECK_MODULES([SATYR], [satyr])
PKG_CHECK_MODULES([LIBSELINUX], [libselinux])
diff --git a/doc/abrt-cli.txt b/doc/abrt-cli.txt
index 399b5fd..0f18784 100644
--- a/doc/abrt-cli.txt
+++ b/doc/abrt-cli.txt
@@ -7,6 +7,8 @@ abrt-cli - List, remove, print, analyze, report problems
SYNOPSIS
--------
+'abrt-cli' [--authenticate] COMMAND [COMMAND OPTIONS]
+
'abrt-cli' list [-vn] [--detailed] [--since NUM] [--until NUM] [DIR]...
'abrt-cli' remove [-v] DIR...
@@ -19,8 +21,13 @@ SYNOPSIS
'abrt-cli' process [-v] [--since NUM] DIR...
-OPTIONS
--------
+GLOBAL OPTIONS
+--------------
+-a,--authenticate::
+ Enable PolicyKit authentication to be able to work with the system problems
+
+COMMAND OPTIONS
+---------------
-v,--verbose::
Be more verbose. Can be given multiple times.
diff --git a/src/cli/Makefile.am b/src/cli/Makefile.am
index 9fff5b3..a7c76ef 100644
--- a/src/cli/Makefile.am
+++ b/src/cli/Makefile.am
@@ -17,6 +17,7 @@ abrt_cli_CFLAGS = \
-I$(srcdir)/../include \
-I$(srcdir)/../lib \
$(LIBREPORT_CFLAGS) \
+ $(POLKIT_AGENT_CFLAGS) \
-DWORKFLOWS_DIR=\"${WORKFLOWS_DIR}\"
if SUGGEST_AUTOREPORTING
@@ -24,6 +25,7 @@ abrt_cli_CFLAGS += -DSUGGEST_AUTOREPORTING=1
endif
abrt_cli_LDADD = \
+ $(POLKIT_AGENT_LIBS) \
$(LIBREPORT_LIBS) \
../lib/libabrt.la
diff --git a/src/cli/abrt-cli-core.c b/src/cli/abrt-cli-core.c
index 46acd01..ca49dbd 100644
--- a/src/cli/abrt-cli-core.c
+++ b/src/cli/abrt-cli-core.c
@@ -20,6 +20,17 @@
#include "libabrt.h"
#include "abrt-cli-core.h"
+/* It is not possible to include polkitagent.h without the following define.
+ * Check out the included header file.
+ */
+#define POLKIT_AGENT_I_KNOW_API_IS_SUBJECT_TO_CHANGE
+#include <polkitagent/polkitagent.h>
+
+int g_cli_authenticate;
+
+static PolkitAgentListener *s_local_polkit_agent = NULL;
+static gpointer s_local_agent_handle = NULL;
+
/* Vector of problems: */
/* problem_data_vector[i] = { "name" = { "content", CD_FLAG_foo_bits } } */
@@ -41,7 +52,7 @@ vector_of_problem_data_t *new_vector_of_problem_data(void)
vector_of_problem_data_t *fetch_crash_infos(void)
{
- GList *problems = get_problems_over_dbus(/*don't authorize*/false);
+ GList *problems = get_problems_over_dbus(g_cli_authenticate);
if (problems == ERR_PTR)
return NULL;
@@ -97,7 +108,7 @@ char *find_problem_by_hash(const char *hash, GList *problems)
char *hash2dirname(const char *hash)
{
/* Try loading by dirname hash */
- GList *problems = get_problems_over_dbus(/*don't authorize*/false);
+ GList *problems = get_problems_over_dbus(g_cli_authenticate);
if (problems == ERR_PTR)
return NULL;
@@ -112,3 +123,38 @@ char *hash2dirname_if_necessary(const char *input)
{
return isxdigit_str(input) ? hash2dirname(input) : xstrdup(input);
}
+
+void initialize_polkit_agent(void)
+{
+ GError *error = NULL;
+ PolkitSubject *subject = polkit_unix_process_new_for_owner(
+ getpid(),
+ /*start time from /proc*/0,
+ getuid());
+
+ s_local_polkit_agent = polkit_agent_text_listener_new(NULL, &error);
+ if (s_local_polkit_agent == NULL)
+ {
+ error_msg_and_die("polkit_agent_text_listener_new: %s (%s, %d)\n",
+ error->message, g_quark_to_string (error->domain), error->code);
+ }
+
+ s_local_agent_handle = polkit_agent_listener_register(s_local_polkit_agent,
+ POLKIT_AGENT_REGISTER_FLAGS_RUN_IN_THREAD, subject, NULL, NULL, &error);
+ if (s_local_agent_handle == NULL)
+ {
+ error_msg_and_die("polkit_agent_listener_register: %s (%s, %d)\n",
+ error->message, g_quark_to_string (error->domain), error->code);
+ }
+
+ g_object_unref(subject);
+}
+
+void uninitialize_polkit_agent(void)
+{
+ if (s_local_agent_handle != NULL)
+ polkit_agent_listener_unregister(s_local_agent_handle);
+
+ if (s_local_polkit_agent != NULL)
+ g_object_unref(s_local_polkit_agent);
+}
diff --git a/src/cli/abrt-cli-core.h b/src/cli/abrt-cli-core.h
index d69d463..e2456e6 100644
--- a/src/cli/abrt-cli-core.h
+++ b/src/cli/abrt-cli-core.h
@@ -22,6 +22,10 @@
#include "problem_api.h"
+/* Use authenticate D-Bus methods. The authentication requires a polkit agent
+ * to finish an authenticated method successfully. */
+extern int g_cli_authenticate;
+
typedef GPtrArray vector_of_problem_data_t;
problem_data_t *get_problem_data(vector_of_problem_data_t *vector, unsigned i);
@@ -37,6 +41,9 @@ char *hash2dirname(const char *hash);
/* If input looks like a hash, returns malloced string, or NULL if not found.
* Otherwise returns a copy of the input. */
char *hash2dirname_if_necessary(const char *input);
-
+/* Initialize a new polkit text agent in a new thread */
+void initialize_polkit_agent(void);
+/* Uninitialize the polkit text agent */
+void uninitialize_polkit_agent(void);
#endif /* ABRT_CLI_CORE_H_ */
diff --git a/src/cli/abrt-cli.c b/src/cli/abrt-cli.c
index 8e19081..f45523e 100644
--- a/src/cli/abrt-cli.c
+++ b/src/cli/abrt-cli.c
@@ -19,6 +19,7 @@
#include "libabrt.h"
#include "builtin-cmd.h"
+#include "abrt-cli-core.h"
#define USAGE_OPTS_WIDTH 16
#define USAGE_GAP 2
@@ -75,6 +76,10 @@ static unsigned handle_internal_options(int argc, const char **argv, const char
{
return skip + argc;
}
+ else if (strcmp(cmd, "-a") == 0 || strcmp(cmd, "--authenticate") == 0)
+ {
+ g_cli_authenticate = 1;
+ }
else
error_msg_and_die("%s", usage);
@@ -122,7 +127,7 @@ int main(int argc, const char **argv)
argc--;
const char *abrt_cli_usage_string = _(
- "Usage: abrt-cli [--version] COMMAND [DIR]..."
+ "Usage: abrt-cli [--authenticate] [--version] COMMAND [DIR]..."
);
const struct cmd_struct commands[] = {
@@ -141,8 +146,16 @@ int main(int argc, const char **argv)
argc -= skip;
argv += skip;
if (argc > 0)
+ {
+ if (g_cli_authenticate)
+ initialize_polkit_agent();
+
handle_internal_command(argc, argv, commands);
+ if (g_cli_authenticate)
+ uninitialize_polkit_agent();
+ }
+
/* user didn't specify command; print out help */
printf("%s\n\n", abrt_cli_usage_string);
list_cmds_help(commands);
--
2.4.3