src/shared/bus-polkit.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "bus-internal.h"
   4 #include "bus-message.h"
   5 #include "bus-polkit.h"
   6 #include "strv.h"
   7 #include "user-util.h"
   8
   9 static int check_good_user(sd_bus_message *m, uid_t good_user) {
  10         _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
  11         uid_t sender_uid;
  12         int r;
  13
  14         assert(m);
  15
  16         if (good_user == UID_INVALID)
  17                 return 0;
  18
  19         r = sd_bus_query_sender_creds(m, SD_BUS_CREDS_EUID, &creds);
  20         if (r < 0)
  21                 return r;
  22
  23         /* Don't trust augmented credentials for authorization */
  24         assert_return((sd_bus_creds_get_augmented_mask(creds) & SD_BUS_CREDS_EUID) == 0, -EPERM);
  25
  26         r = sd_bus_creds_get_euid(creds, &sender_uid);
  27         if (r < 0)
  28                 return r;
  29
  30         return sender_uid == good_user;
  31 }
  32
  33 #if ENABLE_POLKIT
  34 static int bus_message_append_strv_key_value(
  35                 sd_bus_message *m,
  36                 const char **l) {
  37
  38         const char **k, **v;
  39         int r;
  40
  41         assert(m);
  42
  43         r = sd_bus_message_open_container(m, 'a', "{ss}");
  44         if (r < 0)
  45                 return r;
  46
  47         STRV_FOREACH_PAIR(k, v, l) {
  48                 r = sd_bus_message_append(m, "{ss}", *k, *v);
  49                 if (r < 0)
  50                         return r;
  51         }
  52
  53         r = sd_bus_message_close_container(m);
  54         if (r < 0)
  55                 return r;
  56
  57         return r;
  58 }
  59 #endif
  60
  61 int bus_test_polkit(
  62                 sd_bus_message *call,
  63                 int capability,
  64                 const char *action,
  65                 const char **details,
  66                 uid_t good_user,
  67                 bool *_challenge,
  68                 sd_bus_error *ret_error) {
  69
  70         int r;
  71
  72         assert(call);
  73         assert(action);
  74
  75         /* Tests non-interactively! */
  76
  77         r = check_good_user(call, good_user);
  78         if (r != 0)
  79                 return r;
  80
  81         r = sd_bus_query_sender_privilege(call, capability);
  82         if (r < 0)
  83                 return r;
  84         else if (r > 0)
  85                 return 1;
  86 #if ENABLE_POLKIT
  87         else {
  88                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *request = NULL;
  89                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
  90                 int authorized = false, challenge = false;
  91                 const char *sender;
  92
  93                 sender = sd_bus_message_get_sender(call);
  94                 if (!sender)
  95                         return -EBADMSG;
  96
  97                 r = sd_bus_message_new_method_call(
  98                                 call->bus,
  99                                 &request,
 100                                 "org.freedesktop.PolicyKit1",
 101                                 "/org/freedesktop/PolicyKit1/Authority",
 102                                 "org.freedesktop.PolicyKit1.Authority",
 103                                 "CheckAuthorization");
 104                 if (r < 0)
 105                         return r;
 106
 107                 r = sd_bus_message_append(
 108                                 request,
 109                                 "(sa{sv})s",
 110                                 "system-bus-name", 1, "name", "s", sender,
 111                                 action);
 112                 if (r < 0)
 113                         return r;
 114
 115                 r = bus_message_append_strv_key_value(request, details);
 116                 if (r < 0)
 117                         return r;
 118
 119                 r = sd_bus_message_append(request, "us", 0, NULL);
 120                 if (r < 0)
 121                         return r;
 122
 123                 r = sd_bus_call(call->bus, request, 0, ret_error, &reply);
 124                 if (r < 0) {
 125                         /* Treat no PK available as access denied */
 126                         if (sd_bus_error_has_name(ret_error, SD_BUS_ERROR_SERVICE_UNKNOWN)) {
 127                                 sd_bus_error_free(ret_error);
 128                                 return -EACCES;
 129                         }
 130
 131                         return r;
 132                 }
 133
 134                 r = sd_bus_message_enter_container(reply, 'r', "bba{ss}");
 135                 if (r < 0)
 136                         return r;
 137
 138                 r = sd_bus_message_read(reply, "bb", &authorized, &challenge);
 139                 if (r < 0)
 140                         return r;
 141
 142                 if (authorized)
 143                         return 1;
 144
 145                 if (_challenge) {
 146                         *_challenge = challenge;
 147                         return 0;
 148                 }
 149         }
 150 #endif
 151
 152         return -EACCES;
 153 }
 154
 155 #if ENABLE_POLKIT
 156
 157 typedef struct AsyncPolkitQuery {
 158         char *action;
 159         char **details;
 160
 161         sd_bus_message *request, *reply;
 162         sd_bus_slot *slot;
 163
 164         Hashmap *registry;
 165         sd_event_source *defer_event_source;
 166 } AsyncPolkitQuery;
 167
 168 static void async_polkit_query_free(AsyncPolkitQuery *q) {
 169         if (!q)
 170                 return;
 171
 172         sd_bus_slot_unref(q->slot);
 173
 174         if (q->registry && q->request)
 175                 hashmap_remove(q->registry, q->request);
 176
 177         sd_bus_message_unref(q->request);
 178         sd_bus_message_unref(q->reply);
 179
 180         free(q->action);
 181         strv_free(q->details);
 182
 183         sd_event_source_disable_unref(q->defer_event_source);
 184         free(q);
 185 }
 186
 187 static int async_polkit_defer(sd_event_source *s, void *userdata) {
 188         AsyncPolkitQuery *q = userdata;
 189
 190         assert(s);
 191
 192         /* This is called as idle event source after we processed the async polkit reply, hopefully after the
 193          * method call we re-enqueued has been properly processed. */
 194
 195         async_polkit_query_free(q);
 196         return 0;
 197 }
 198
 199 static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_error *error) {
 200         _cleanup_(sd_bus_error_free) sd_bus_error error_buffer = SD_BUS_ERROR_NULL;
 201         AsyncPolkitQuery *q = userdata;
 202         int r;
 203
 204         assert(reply);
 205         assert(q);
 206
 207         assert(q->slot);
 208         q->slot = sd_bus_slot_unref(q->slot);
 209
 210         assert(!q->reply);
 211         q->reply = sd_bus_message_ref(reply);
 212
 213         /* Now, let's dispatch the original message a second time be re-enqueing. This will then traverse the
 214          * whole message processing again, and thus re-validating and re-retrieving the "userdata" field
 215          * again.
 216          *
 217          * We install an idle event loop event to clean-up the PolicyKit request data when we are idle again,
 218          * i.e. after the second time the message is processed is complete. */
 219
 220         assert(!q->defer_event_source);
 221         r = sd_event_add_defer(sd_bus_get_event(sd_bus_message_get_bus(reply)), &q->defer_event_source, async_polkit_defer, q);
 222         if (r < 0)
 223                 goto fail;
 224
 225         r = sd_event_source_set_priority(q->defer_event_source, SD_EVENT_PRIORITY_IDLE);
 226         if (r < 0)
 227                 goto fail;
 228
 229         r = sd_event_source_set_enabled(q->defer_event_source, SD_EVENT_ONESHOT);
 230         if (r < 0)
 231                 goto fail;
 232
 233         r = sd_bus_message_rewind(q->request, true);
 234         if (r < 0)
 235                 goto fail;
 236
 237         r = sd_bus_enqueue_for_read(sd_bus_message_get_bus(q->request), q->request);
 238         if (r < 0)
 239                 goto fail;
 240
 241         return 1;
 242
 243 fail:
 244         log_debug_errno(r, "Processing asynchronous PolicyKit reply failed, ignoring: %m");
 245         (void) sd_bus_reply_method_errno(q->request, r, NULL);
 246         async_polkit_query_free(q);
 247         return r;
 248 }
 249
 250 #endif
 251
 252 int bus_verify_polkit_async(
 253                 sd_bus_message *call,
 254                 int capability,
 255                 const char *action,
 256                 const char **details,
 257                 bool interactive,
 258                 uid_t good_user,
 259                 Hashmap **registry,
 260                 sd_bus_error *ret_error) {
 261
 262 #if ENABLE_POLKIT
 263         _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
 264         AsyncPolkitQuery *q;
 265         int c;
 266 #endif
 267         const char *sender;
 268         int r;
 269
 270         assert(call);
 271         assert(action);
 272         assert(registry);
 273
 274         r = check_good_user(call, good_user);
 275         if (r != 0)
 276                 return r;
 277
 278 #if ENABLE_POLKIT
 279         q = hashmap_get(*registry, call);
 280         if (q) {
 281                 int authorized, challenge;
 282
 283                 /* This is the second invocation of this function, and there's already a response from
 284                  * polkit, let's process it */
 285                 assert(q->reply);
 286
 287                 /* If the operation we want to authenticate changed between the first and the second time,
 288                  * let's not use this authentication, it might be out of date as the object and context we
 289                  * operate on might have changed. */
 290                 if (!streq(q->action, action) ||
 291                     !strv_equal(q->details, (char**) details))
 292                         return -ESTALE;
 293
 294                 if (sd_bus_message_is_method_error(q->reply, NULL)) {
 295                         const sd_bus_error *e;
 296
 297                         e = sd_bus_message_get_error(q->reply);
 298
 299                         /* Treat no PK available as access denied */
 300                         if (sd_bus_error_has_name(e, SD_BUS_ERROR_SERVICE_UNKNOWN) ||
 301                             sd_bus_error_has_name(e, SD_BUS_ERROR_NAME_HAS_NO_OWNER))
 302                                 return -EACCES;
 303
 304                         /* Copy error from polkit reply */
 305                         sd_bus_error_copy(ret_error, e);
 306                         return -sd_bus_error_get_errno(e);
 307                 }
 308
 309                 r = sd_bus_message_enter_container(q->reply, 'r', "bba{ss}");
 310                 if (r >= 0)
 311                         r = sd_bus_message_read(q->reply, "bb", &authorized, &challenge);
 312                 if (r < 0)
 313                         return r;
 314
 315                 if (authorized)
 316                         return 1;
 317
 318                 if (challenge)
 319                         return sd_bus_error_set(ret_error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED, "Interactive authentication required.");
 320
 321                 return -EACCES;
 322         }
 323 #endif
 324
 325         r = sd_bus_query_sender_privilege(call, capability);
 326         if (r < 0)
 327                 return r;
 328         else if (r > 0)
 329                 return 1;
 330
 331         sender = sd_bus_message_get_sender(call);
 332         if (!sender)
 333                 return -EBADMSG;
 334
 335 #if ENABLE_POLKIT
 336         c = sd_bus_message_get_allow_interactive_authorization(call);
 337         if (c < 0)
 338                 return c;
 339         if (c > 0)
 340                 interactive = true;
 341
 342         r = hashmap_ensure_allocated(registry, NULL);
 343         if (r < 0)
 344                 return r;
 345
 346         r = sd_bus_message_new_method_call(
 347                         call->bus,
 348                         &pk,
 349                         "org.freedesktop.PolicyKit1",
 350                         "/org/freedesktop/PolicyKit1/Authority",
 351                         "org.freedesktop.PolicyKit1.Authority",
 352                         "CheckAuthorization");
 353         if (r < 0)
 354                 return r;
 355
 356         r = sd_bus_message_append(
 357                         pk,
 358                         "(sa{sv})s",
 359                         "system-bus-name", 1, "name", "s", sender,
 360                         action);
 361         if (r < 0)
 362                 return r;
 363
 364         r = bus_message_append_strv_key_value(pk, details);
 365         if (r < 0)
 366                 return r;
 367
 368         r = sd_bus_message_append(pk, "us", interactive, NULL);
 369         if (r < 0)
 370                 return r;
 371
 372         q = new(AsyncPolkitQuery, 1);
 373         if (!q)
 374                 return -ENOMEM;
 375
 376         *q = (AsyncPolkitQuery) {
 377                 .request = sd_bus_message_ref(call),
 378         };
 379
 380         q->action = strdup(action);
 381         if (!q->action) {
 382                 async_polkit_query_free(q);
 383                 return -ENOMEM;
 384         }
 385
 386         q->details = strv_copy((char**) details);
 387         if (!q->details) {
 388                 async_polkit_query_free(q);
 389                 return -ENOMEM;
 390         }
 391
 392         r = hashmap_put(*registry, call, q);
 393         if (r < 0) {
 394                 async_polkit_query_free(q);
 395                 return r;
 396         }
 397
 398         q->registry = *registry;
 399
 400         r = sd_bus_call_async(call->bus, &q->slot, pk, async_polkit_callback, q, 0);
 401         if (r < 0) {
 402                 async_polkit_query_free(q);
 403                 return r;
 404         }
 405
 406         return 0;
 407 #endif
 408
 409         return -EACCES;
 410 }
 411
 412 void bus_verify_polkit_async_registry_free(Hashmap *registry) {
 413 #if ENABLE_POLKIT
 414         hashmap_free_with_destructor(registry, async_polkit_query_free);
 415 #endif
 416 }