src/shared/bus-polkit.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "bus-internal.h"
   4 #include "bus-message.h"
   5 #include "bus-polkit.h"
   6 #include "bus-util.h"
   7 #include "strv.h"
   8 #include "user-util.h"
   9
  10 static int check_good_user(sd_bus_message *m, uid_t good_user) {
  11         _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
  12         uid_t sender_uid;
  13         int r;
  14
  15         assert(m);
  16
  17         if (good_user == UID_INVALID)
  18                 return 0;
  19
  20         r = sd_bus_query_sender_creds(m, SD_BUS_CREDS_EUID, &creds);
  21         if (r < 0)
  22                 return r;
  23
  24         /* Don't trust augmented credentials for authorization */
  25         assert_return((sd_bus_creds_get_augmented_mask(creds) & SD_BUS_CREDS_EUID) == 0, -EPERM);
  26
  27         r = sd_bus_creds_get_euid(creds, &sender_uid);
  28         if (r < 0)
  29                 return r;
  30
  31         return sender_uid == good_user;
  32 }
  33
  34 #if ENABLE_POLKIT
  35 static int bus_message_append_strv_key_value(
  36                 sd_bus_message *m,
  37                 const char **l) {
  38
  39         int r;
  40
  41         assert(m);
  42
  43         r = sd_bus_message_open_container(m, 'a', "{ss}");
  44         if (r < 0)
  45                 return r;
  46
  47         STRV_FOREACH_PAIR(k, v, l) {
  48                 r = sd_bus_message_append(m, "{ss}", *k, *v);
  49                 if (r < 0)
  50                         return r;
  51         }
  52
  53         r = sd_bus_message_close_container(m);
  54         if (r < 0)
  55                 return r;
  56
  57         return r;
  58 }
  59 #endif
  60
  61 int bus_test_polkit(
  62                 sd_bus_message *call,
  63                 int capability,
  64                 const char *action,
  65                 const char **details,
  66                 uid_t good_user,
  67                 bool *_challenge,
  68                 sd_bus_error *ret_error) {
  69
  70         int r;
  71
  72         assert(call);
  73         assert(action);
  74
  75         /* Tests non-interactively! */
  76
  77         r = check_good_user(call, good_user);
  78         if (r != 0)
  79                 return r;
  80
  81         r = sd_bus_query_sender_privilege(call, capability);
  82         if (r < 0)
  83                 return r;
  84         else if (r > 0)
  85                 return 1;
  86 #if ENABLE_POLKIT
  87         else {
  88                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *request = NULL;
  89                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
  90                 int authorized = false, challenge = false;
  91                 const char *sender;
  92
  93                 sender = sd_bus_message_get_sender(call);
  94                 if (!sender)
  95                         return -EBADMSG;
  96
  97                 r = sd_bus_message_new_method_call(
  98                                 call->bus,
  99                                 &request,
 100                                 "org.freedesktop.PolicyKit1",
 101                                 "/org/freedesktop/PolicyKit1/Authority",
 102                                 "org.freedesktop.PolicyKit1.Authority",
 103                                 "CheckAuthorization");
 104                 if (r < 0)
 105                         return r;
 106
 107                 r = sd_bus_message_append(
 108                                 request,
 109                                 "(sa{sv})s",
 110                                 "system-bus-name", 1, "name", "s", sender,
 111                                 action);
 112                 if (r < 0)
 113                         return r;
 114
 115                 r = bus_message_append_strv_key_value(request, details);
 116                 if (r < 0)
 117                         return r;
 118
 119                 r = sd_bus_message_append(request, "us", 0, NULL);
 120                 if (r < 0)
 121                         return r;
 122
 123                 r = sd_bus_call(call->bus, request, 0, ret_error, &reply);
 124                 if (r < 0) {
 125                         /* Treat no PK available as access denied */
 126                         if (bus_error_is_unknown_service(ret_error)) {
 127                                 sd_bus_error_free(ret_error);
 128                                 return -EACCES;
 129                         }
 130
 131                         return r;
 132                 }
 133
 134                 r = sd_bus_message_enter_container(reply, 'r', "bba{ss}");
 135                 if (r < 0)
 136                         return r;
 137
 138                 r = sd_bus_message_read(reply, "bb", &authorized, &challenge);
 139                 if (r < 0)
 140                         return r;
 141
 142                 if (authorized)
 143                         return 1;
 144
 145                 if (_challenge) {
 146                         *_challenge = challenge;
 147                         return 0;
 148                 }
 149         }
 150 #endif
 151
 152         return -EACCES;
 153 }
 154
 155 #if ENABLE_POLKIT
 156
 157 typedef struct AsyncPolkitQuery {
 158         char *action;
 159         char **details;
 160
 161         sd_bus_message *request, *reply;
 162         sd_bus_slot *slot;
 163
 164         Hashmap *registry;
 165         sd_event_source *defer_event_source;
 166 } AsyncPolkitQuery;
 167
 168 static void async_polkit_query_free(AsyncPolkitQuery *q) {
 169         if (!q)
 170                 return;
 171
 172         sd_bus_slot_unref(q->slot);
 173
 174         if (q->registry && q->request)
 175                 hashmap_remove(q->registry, q->request);
 176
 177         sd_bus_message_unref(q->request);
 178         sd_bus_message_unref(q->reply);
 179
 180         free(q->action);
 181         strv_free(q->details);
 182
 183         sd_event_source_disable_unref(q->defer_event_source);
 184         free(q);
 185 }
 186
 187 static int async_polkit_defer(sd_event_source *s, void *userdata) {
 188         AsyncPolkitQuery *q = userdata;
 189
 190         assert(s);
 191
 192         /* This is called as idle event source after we processed the async polkit reply, hopefully after the
 193          * method call we re-enqueued has been properly processed. */
 194
 195         async_polkit_query_free(q);
 196         return 0;
 197 }
 198
 199 static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_error *error) {
 200         AsyncPolkitQuery *q = ASSERT_PTR(userdata);
 201         int r;
 202
 203         assert(reply);
 204
 205         assert(q->slot);
 206         q->slot = sd_bus_slot_unref(q->slot);
 207
 208         assert(!q->reply);
 209         q->reply = sd_bus_message_ref(reply);
 210
 211         /* Now, let's dispatch the original message a second time be re-enqueing. This will then traverse the
 212          * whole message processing again, and thus re-validating and re-retrieving the "userdata" field
 213          * again.
 214          *
 215          * We install an idle event loop event to clean-up the PolicyKit request data when we are idle again,
 216          * i.e. after the second time the message is processed is complete. */
 217
 218         assert(!q->defer_event_source);
 219         r = sd_event_add_defer(sd_bus_get_event(sd_bus_message_get_bus(reply)), &q->defer_event_source, async_polkit_defer, q);
 220         if (r < 0)
 221                 goto fail;
 222
 223         r = sd_event_source_set_priority(q->defer_event_source, SD_EVENT_PRIORITY_IDLE);
 224         if (r < 0)
 225                 goto fail;
 226
 227         r = sd_event_source_set_enabled(q->defer_event_source, SD_EVENT_ONESHOT);
 228         if (r < 0)
 229                 goto fail;
 230
 231         r = sd_bus_message_rewind(q->request, true);
 232         if (r < 0)
 233                 goto fail;
 234
 235         r = sd_bus_enqueue_for_read(sd_bus_message_get_bus(q->request), q->request);
 236         if (r < 0)
 237                 goto fail;
 238
 239         return 1;
 240
 241 fail:
 242         log_debug_errno(r, "Processing asynchronous PolicyKit reply failed, ignoring: %m");
 243         (void) sd_bus_reply_method_errno(q->request, r, NULL);
 244         async_polkit_query_free(q);
 245         return r;
 246 }
 247
 248 #endif
 249
 250 int bus_verify_polkit_async(
 251                 sd_bus_message *call,
 252                 int capability,
 253                 const char *action,
 254                 const char **details,
 255                 bool interactive,
 256                 uid_t good_user,
 257                 Hashmap **registry,
 258                 sd_bus_error *ret_error) {
 259
 260         const char *sender;
 261         int r;
 262
 263         assert(call);
 264         assert(action);
 265         assert(registry);
 266
 267         r = check_good_user(call, good_user);
 268         if (r != 0)
 269                 return r;
 270
 271 #if ENABLE_POLKIT
 272         AsyncPolkitQuery *q = hashmap_get(*registry, call);
 273         if (q) {
 274                 int authorized, challenge;
 275
 276                 /* This is the second invocation of this function, and there's already a response from
 277                  * polkit, let's process it */
 278                 assert(q->reply);
 279
 280                 /* If the operation we want to authenticate changed between the first and the second time,
 281                  * let's not use this authentication, it might be out of date as the object and context we
 282                  * operate on might have changed. */
 283                 if (!streq(q->action, action) ||
 284                     !strv_equal(q->details, (char**) details))
 285                         return -ESTALE;
 286
 287                 if (sd_bus_message_is_method_error(q->reply, NULL)) {
 288                         const sd_bus_error *e;
 289
 290                         e = sd_bus_message_get_error(q->reply);
 291
 292                         /* Treat no PK available as access denied */
 293                         if (bus_error_is_unknown_service(e))
 294                                 return -EACCES;
 295
 296                         /* Copy error from polkit reply */
 297                         sd_bus_error_copy(ret_error, e);
 298                         return -sd_bus_error_get_errno(e);
 299                 }
 300
 301                 r = sd_bus_message_enter_container(q->reply, 'r', "bba{ss}");
 302                 if (r >= 0)
 303                         r = sd_bus_message_read(q->reply, "bb", &authorized, &challenge);
 304                 if (r < 0)
 305                         return r;
 306
 307                 if (authorized)
 308                         return 1;
 309
 310                 if (challenge)
 311                         return sd_bus_error_set(ret_error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED, "Interactive authentication required.");
 312
 313                 return -EACCES;
 314         }
 315 #endif
 316
 317         r = sd_bus_query_sender_privilege(call, capability);
 318         if (r < 0)
 319                 return r;
 320         else if (r > 0)
 321                 return 1;
 322
 323         sender = sd_bus_message_get_sender(call);
 324         if (!sender)
 325                 return -EBADMSG;
 326
 327 #if ENABLE_POLKIT
 328         _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
 329
 330         int c = sd_bus_message_get_allow_interactive_authorization(call);
 331         if (c < 0)
 332                 return c;
 333         if (c > 0)
 334                 interactive = true;
 335
 336         r = hashmap_ensure_allocated(registry, NULL);
 337         if (r < 0)
 338                 return r;
 339
 340         r = sd_bus_message_new_method_call(
 341                         call->bus,
 342                         &pk,
 343                         "org.freedesktop.PolicyKit1",
 344                         "/org/freedesktop/PolicyKit1/Authority",
 345                         "org.freedesktop.PolicyKit1.Authority",
 346                         "CheckAuthorization");
 347         if (r < 0)
 348                 return r;
 349
 350         r = sd_bus_message_append(
 351                         pk,
 352                         "(sa{sv})s",
 353                         "system-bus-name", 1, "name", "s", sender,
 354                         action);
 355         if (r < 0)
 356                 return r;
 357
 358         r = bus_message_append_strv_key_value(pk, details);
 359         if (r < 0)
 360                 return r;
 361
 362         r = sd_bus_message_append(pk, "us", interactive, NULL);
 363         if (r < 0)
 364                 return r;
 365
 366         q = new(AsyncPolkitQuery, 1);
 367         if (!q)
 368                 return -ENOMEM;
 369
 370         *q = (AsyncPolkitQuery) {
 371                 .request = sd_bus_message_ref(call),
 372         };
 373
 374         q->action = strdup(action);
 375         if (!q->action) {
 376                 async_polkit_query_free(q);
 377                 return -ENOMEM;
 378         }
 379
 380         q->details = strv_copy((char**) details);
 381         if (!q->details) {
 382                 async_polkit_query_free(q);
 383                 return -ENOMEM;
 384         }
 385
 386         r = hashmap_put(*registry, call, q);
 387         if (r < 0) {
 388                 async_polkit_query_free(q);
 389                 return r;
 390         }
 391
 392         q->registry = *registry;
 393
 394         r = sd_bus_call_async(call->bus, &q->slot, pk, async_polkit_callback, q, 0);
 395         if (r < 0) {
 396                 async_polkit_query_free(q);
 397                 return r;
 398         }
 399
 400         return 0;
 401 #endif
 402
 403         return -EACCES;
 404 }
 405
 406 Hashmap *bus_verify_polkit_async_registry_free(Hashmap *registry) {
 407 #if ENABLE_POLKIT
 408         return hashmap_free_with_destructor(registry, async_polkit_query_free);
 409 #else
 410         assert(hashmap_isempty(registry));
 411         return hashmap_free(registry);
 412 #endif
 413 }