| This is an automatically generated e-mail. To reply, visit: http://reviewboard-openlmi.rhcloud.com/r/1893/ |
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 12 | polkit does not have any mean to ask directly the user for confirmation and/or to type in its password. This is done by *desktop session*, which registers a *polkit agent*, a tiny [DBus API](http://www.freedesktop.org/software/polkit/docs/latest/eggdbus-interface-org.freedesktop.PolicyKit1.AuthenticationAgent.html), which polkit uses to confirm an action. The desktop's polkit agent then pops up an window "Action XYZ requires authentication, please provide your password." To prevent cheating, polkit requires that the final confirmation of action is sent from process with uid=0. Therefore the polkit agent (running as the user) executes small SUID *polkit helper*, which checks the password and tells polkit that the action has been confirmed. |
||
s/any mean/any means/
s/its password/his\/her password/
s/an window/a window/
s/action is sent/action be sent/
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 25 | 2. The provider process must *start a PAM session* and register its own *polkit agent*. PAM session must be started while the process still runs as root, before it changes its UID to the remote user. Therefore it must be done in our `/usr/libexec/pegases/<providername>-cimprovagt` script, like this: |
||
Does this mean that every provider will be basically forking at least twice whenever run?
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 37 | /usr/libexec/pegasus/lmipolkitagent -u "$USERNAME" -c $INPUT_FD -c $OUTPUT_FD /usr/libexec/pegasus/cimprovagt 0 "$@" |
||
I would quote $INPUT_FD and $OUTPUT_FD to prevent surprises.
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 45 | Also, **no changes in existing provider code is needed.** |
||
s/is needed/are needed/
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 64 | This tools prepares Pegasus provider process to work with polkit. |
||
s/tools/tool/
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 122 | * `cmpi<provider name>-cimprovagt` has the right SELinux context to ensure each provider has different one. |
||
| 123 | * `cmpi<provider name>-cimprovagt` is just a simple script, which executes `lmipolkitagent -u <the remote user> /usr/libexec/pegasus/cimprovagt`. |
||
Hmm, we're wrapping wrappers here. If I understand this right, there's not much that can be done here because of the SELinux labels. Otherwise the agent could be improved so that it handled everything that the original wrapper handles. Correct?
| doc/polkit/polkit-authorization.md (Diff revision 1) | |||
|---|---|---|---|
| 181 | Our `lmipolkitagent` must be started by root, otherwise it cannot confirm polkit that an user has been reauthenticated (polkit checks it). Therefore it cannot be misused by regular users for cheating polkit and performing actions on DBus without retyping a password. |
||
s/confirm polkit/give confirmation to polkit/
(Maybe even "confirm with polkit", but I'm not sure about that.)
- Jan Synacek
On July 11th, 2014, 12:31 p.m. CEST, Jan Safranek wrote:
|
Review request for OpenLMI Developers.
By Jan Safranek.
Updated July 11, 2014, 12:31 p.m.
Repository:
openlmi-providers
Description
Diffs
|