src/shared/polkit.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2011 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include <sys/types.h>
  23
  24 #include <errno.h>
  25
  26 #include "util.h"
  27 #include "dbus-common.h"
  28 #include "polkit.h"
  29
  30 int verify_polkit(
  31                 DBusConnection *c,
  32                 DBusMessage *request,
  33                 const char *action,
  34                 bool interactive,
  35                 bool *_challenge,
  36                 DBusError *error) {
  37
  38         DBusMessage *m = NULL, *reply = NULL;
  39         const char *unix_process = "unix-process", *pid = "pid", *starttime = "start-time", *cancel_id = "";
  40         const char *sender;
  41         uint32_t flags = interactive ? 1 : 0;
  42         pid_t pid_raw;
  43         uint32_t pid_u32;
  44         unsigned long long starttime_raw;
  45         uint64_t starttime_u64;
  46         DBusMessageIter iter_msg, iter_struct, iter_array, iter_dict, iter_variant;
  47         int r;
  48         dbus_bool_t authorized = FALSE, challenge = FALSE;
  49         unsigned long ul;
  50
  51         assert(c);
  52         assert(request);
  53
  54         sender = dbus_message_get_sender(request);
  55         if (!sender)
  56                 return -EINVAL;
  57
  58         ul = dbus_bus_get_unix_user(c, sender, error);
  59         if (ul == (unsigned) -1)
  60                 return -EINVAL;
  61
  62         /* Shortcut things for root, to avoid the PK roundtrip and dependency */
  63         if (ul == 0)
  64                 return 1;
  65
  66         pid_raw = bus_get_unix_process_id(c, sender, error);
  67         if (pid_raw == 0)
  68                 return -EINVAL;
  69
  70         r = get_starttime_of_pid(pid_raw, &starttime_raw);
  71         if (r < 0)
  72                 return r;
  73
  74         m = dbus_message_new_method_call(
  75                         "org.freedesktop.PolicyKit1",
  76                         "/org/freedesktop/PolicyKit1/Authority",
  77                         "org.freedesktop.PolicyKit1.Authority",
  78                         "CheckAuthorization");
  79         if (!m)
  80                 return -ENOMEM;
  81
  82         dbus_message_iter_init_append(m, &iter_msg);
  83
  84         pid_u32 = (uint32_t) pid_raw;
  85         starttime_u64 = (uint64_t) starttime_raw;
  86
  87         if (!dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_STRUCT, NULL, &iter_struct) ||
  88             !dbus_message_iter_append_basic(&iter_struct, DBUS_TYPE_STRING, &unix_process) ||
  89             !dbus_message_iter_open_container(&iter_struct, DBUS_TYPE_ARRAY, "{sv}", &iter_array) ||
  90             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
  91             !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &pid) ||
  92             !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "u", &iter_variant) ||
  93             !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT32, &pid_u32) ||
  94             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
  95             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
  96             !dbus_message_iter_open_container(&iter_array, DBUS_TYPE_DICT_ENTRY, NULL, &iter_dict) ||
  97             !dbus_message_iter_append_basic(&iter_dict, DBUS_TYPE_STRING, &starttime) ||
  98             !dbus_message_iter_open_container(&iter_dict, DBUS_TYPE_VARIANT, "t", &iter_variant) ||
  99             !dbus_message_iter_append_basic(&iter_variant, DBUS_TYPE_UINT64, &starttime_u64) ||
 100             !dbus_message_iter_close_container(&iter_dict, &iter_variant) ||
 101             !dbus_message_iter_close_container(&iter_array, &iter_dict) ||
 102             !dbus_message_iter_close_container(&iter_struct, &iter_array) ||
 103             !dbus_message_iter_close_container(&iter_msg, &iter_struct) ||
 104             !dbus_message_iter_append_basic(&iter_msg, DBUS_TYPE_STRING, &action) ||
 105             !dbus_message_iter_open_container(&iter_msg, DBUS_TYPE_ARRAY, "{ss}", &iter_array) ||
 106             !dbus_message_iter_close_container(&iter_msg, &iter_array) ||
 107             !dbus_message_iter_append_basic(&iter_msg, DBUS_TYPE_UINT32, &flags) ||
 108             !dbus_message_iter_append_basic(&iter_msg, DBUS_TYPE_STRING, &cancel_id)) {
 109                 r = -ENOMEM;
 110                 goto finish;
 111         }
 112
 113         reply = dbus_connection_send_with_reply_and_block(c, m, -1, error);
 114         if (!reply) {
 115                 r = -EIO;
 116                 goto finish;
 117         }
 118
 119         if (dbus_set_error_from_message(error, reply)) {
 120                 r = -EIO;
 121                 goto finish;
 122         }
 123
 124         if (!dbus_message_iter_init(reply, &iter_msg) ||
 125             dbus_message_iter_get_arg_type(&iter_msg) != DBUS_TYPE_STRUCT) {
 126                 r = -EIO;
 127                 goto finish;
 128         }
 129
 130         dbus_message_iter_recurse(&iter_msg, &iter_struct);
 131
 132         if (dbus_message_iter_get_arg_type(&iter_struct) != DBUS_TYPE_BOOLEAN) {
 133                 r = -EIO;
 134                 goto finish;
 135         }
 136
 137         dbus_message_iter_get_basic(&iter_struct, &authorized);
 138
 139         if (!dbus_message_iter_next(&iter_struct) ||
 140             dbus_message_iter_get_arg_type(&iter_struct) != DBUS_TYPE_BOOLEAN) {
 141                 r = -EIO;
 142                 goto finish;
 143         }
 144
 145         dbus_message_iter_get_basic(&iter_struct, &challenge);
 146
 147         if (authorized)
 148                 r = 1;
 149         else if (_challenge) {
 150                 *_challenge = !!challenge;
 151                 r = 0;
 152         } else
 153                 r = -EPERM;
 154
 155 finish:
 156         if (m)
 157                 dbus_message_unref(m);
 158
 159         if (reply)
 160                 dbus_message_unref(reply);
 161
 162         return r;
 163 }