jsauthority: add 'system_unit' and 'no_new_privileges' subject attributes
When building with libsystemd support, query the systemd unit name that the process if part of (if any) and add it as a subject attribute. Allows allow-listing actions based on the systemd unit: polkit.addRule(function(action, subject) { if (action.id.indexOf("org.foo.bar") == 0) { if (subject.system_unit == "test.service" && subject.no_new_privileges) { return polkit.Result.YES; } } }); We call it system_unit instead of just unit to make it extra clear that this is about system units, rather than user units. If we ran as root we could also query for the user unit, but we are running as the polkitd user in most cases which means we cannot connect to other D-Bus sessions to perform the query. We only do this if we can pin the subject process by PIDFD, as that's safer PIDs can be recycled. Skip if not possible because the D-Bus daemon and/or systemd are too old and do not support the functionality. Also we check for the NoNewPrivileges= being set, so that we can ensure that the unit cannot alter its uid via a setuid binary. But let this last part be decided by policy, as a system builder might simply ensure that no setuid binaries are shipped at all, which is equivalent. This requires dbus-broker v34 or dbus-daemon v15.7 and systemd v253 and kernel v6.5.
Showing
- docs/man/polkit.xml 41 additions, 0 deletionsdocs/man/polkit.xml
- src/polkit/meson.build 1 addition, 0 deletionssrc/polkit/meson.build
- src/polkit/polkitsystembusname.c 28 additions, 4 deletionssrc/polkit/polkitsystembusname.c
- src/polkit/polkitunixprocess.c 50 additions, 1 deletionsrc/polkit/polkitunixprocess.c
- src/polkit/polkitunixprocess.h 1 addition, 0 deletionssrc/polkit/polkitunixprocess.h
- src/polkitbackend/polkitbackendcommon.c 131 additions, 0 deletionssrc/polkitbackend/polkitbackendcommon.c
- src/polkitbackend/polkitbackendcommon.h 4 additions, 0 deletionssrc/polkitbackend/polkitbackendcommon.h
- src/polkitbackend/polkitbackendduktapeauthority.c 14 additions, 0 deletionssrc/polkitbackend/polkitbackendduktapeauthority.c
- src/polkitbackend/polkitbackendjsauthority.cpp 14 additions, 0 deletionssrc/polkitbackend/polkitbackendjsauthority.cpp
Loading
Please register or sign in to comment