src/shared/bus-polkit.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "bus-internal.h"
   4 #include "bus-message.h"
   5 #include "bus-polkit.h"
   6 #include "strv.h"
   7 #include "user-util.h"
   8
   9 static int check_good_user(sd_bus_message *m, uid_t good_user) {
  10         _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
  11         uid_t sender_uid;
  12         int r;
  13
  14         assert(m);
  15
  16         if (good_user == UID_INVALID)
  17                 return 0;
  18
  19         r = sd_bus_query_sender_creds(m, SD_BUS_CREDS_EUID, &creds);
  20         if (r < 0)
  21                 return r;
  22
  23         /* Don't trust augmented credentials for authorization */
  24         assert_return((sd_bus_creds_get_augmented_mask(creds) & SD_BUS_CREDS_EUID) == 0, -EPERM);
  25
  26         r = sd_bus_creds_get_euid(creds, &sender_uid);
  27         if (r < 0)
  28                 return r;
  29
  30         return sender_uid == good_user;
  31 }
  32
  33 #if ENABLE_POLKIT
  34 static int bus_message_append_strv_key_value(
  35                 sd_bus_message *m,
  36                 const char **l) {
  37
  38         const char **k, **v;
  39         int r;
  40
  41         assert(m);
  42
  43         r = sd_bus_message_open_container(m, 'a', "{ss}");
  44         if (r < 0)
  45                 return r;
  46
  47         STRV_FOREACH_PAIR(k, v, l) {
  48                 r = sd_bus_message_append(m, "{ss}", *k, *v);
  49                 if (r < 0)
  50                         return r;
  51         }
  52
  53         r = sd_bus_message_close_container(m);
  54         if (r < 0)
  55                 return r;
  56
  57         return r;
  58 }
  59 #endif
  60
  61 int bus_test_polkit(
  62                 sd_bus_message *call,
  63                 int capability,
  64                 const char *action,
  65                 const char **details,
  66                 uid_t good_user,
  67                 bool *_challenge,
  68                 sd_bus_error *ret_error) {
  69
  70         int r;
  71
  72         assert(call);
  73         assert(action);
  74
  75         /* Tests non-interactively! */
  76
  77         r = check_good_user(call, good_user);
  78         if (r != 0)
  79                 return r;
  80
  81         r = sd_bus_query_sender_privilege(call, capability);
  82         if (r < 0)
  83                 return r;
  84         else if (r > 0)
  85                 return 1;
  86 #if ENABLE_POLKIT
  87         else {
  88                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *request = NULL;
  89                 _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
  90                 int authorized = false, challenge = false;
  91                 const char *sender;
  92
  93                 sender = sd_bus_message_get_sender(call);
  94                 if (!sender)
  95                         return -EBADMSG;
  96
  97                 r = sd_bus_message_new_method_call(
  98                                 call->bus,
  99                                 &request,
 100                                 "org.freedesktop.PolicyKit1",
 101                                 "/org/freedesktop/PolicyKit1/Authority",
 102                                 "org.freedesktop.PolicyKit1.Authority",
 103                                 "CheckAuthorization");
 104                 if (r < 0)
 105                         return r;
 106
 107                 r = sd_bus_message_append(
 108                                 request,
 109                                 "(sa{sv})s",
 110                                 "system-bus-name", 1, "name", "s", sender,
 111                                 action);
 112                 if (r < 0)
 113                         return r;
 114
 115                 r = bus_message_append_strv_key_value(request, details);
 116                 if (r < 0)
 117                         return r;
 118
 119                 r = sd_bus_message_append(request, "us", 0, NULL);
 120                 if (r < 0)
 121                         return r;
 122
 123                 r = sd_bus_call(call->bus, request, 0, ret_error, &reply);
 124                 if (r < 0) {
 125                         /* Treat no PK available as access denied */
 126                         if (sd_bus_error_has_name(ret_error, SD_BUS_ERROR_SERVICE_UNKNOWN)) {
 127                                 sd_bus_error_free(ret_error);
 128                                 return -EACCES;
 129                         }
 130
 131                         return r;
 132                 }
 133
 134                 r = sd_bus_message_enter_container(reply, 'r', "bba{ss}");
 135                 if (r < 0)
 136                         return r;
 137
 138                 r = sd_bus_message_read(reply, "bb", &authorized, &challenge);
 139                 if (r < 0)
 140                         return r;
 141
 142                 if (authorized)
 143                         return 1;
 144
 145                 if (_challenge) {
 146                         *_challenge = challenge;
 147                         return 0;
 148                 }
 149         }
 150 #endif
 151
 152         return -EACCES;
 153 }
 154
 155 #if ENABLE_POLKIT
 156
 157 typedef struct AsyncPolkitQuery {
 158         char *action;
 159         char **details;
 160
 161         sd_bus_message *request, *reply;
 162         sd_bus_slot *slot;
 163
 164         Hashmap *registry;
 165         sd_event_source *defer_event_source;
 166 } AsyncPolkitQuery;
 167
 168 static void async_polkit_query_free(AsyncPolkitQuery *q) {
 169         if (!q)
 170                 return;
 171
 172         sd_bus_slot_unref(q->slot);
 173
 174         if (q->registry && q->request)
 175                 hashmap_remove(q->registry, q->request);
 176
 177         sd_bus_message_unref(q->request);
 178         sd_bus_message_unref(q->reply);
 179
 180         free(q->action);
 181         strv_free(q->details);
 182
 183         sd_event_source_disable_unref(q->defer_event_source);
 184         free(q);
 185 }
 186
 187 static int async_polkit_defer(sd_event_source *s, void *userdata) {
 188         AsyncPolkitQuery *q = userdata;
 189
 190         assert(s);
 191
 192         /* This is called as idle event source after we processed the async polkit reply, hopefully after the
 193          * method call we re-enqueued has been properly processed. */
 194
 195         async_polkit_query_free(q);
 196         return 0;
 197 }
 198
 199 static int async_polkit_callback(sd_bus_message *reply, void *userdata, sd_bus_error *error) {
 200         AsyncPolkitQuery *q = userdata;
 201         int r;
 202
 203         assert(reply);
 204         assert(q);
 205
 206         assert(q->slot);
 207         q->slot = sd_bus_slot_unref(q->slot);
 208
 209         assert(!q->reply);
 210         q->reply = sd_bus_message_ref(reply);
 211
 212         /* Now, let's dispatch the original message a second time be re-enqueing. This will then traverse the
 213          * whole message processing again, and thus re-validating and re-retrieving the "userdata" field
 214          * again.
 215          *
 216          * We install an idle event loop event to clean-up the PolicyKit request data when we are idle again,
 217          * i.e. after the second time the message is processed is complete. */
 218
 219         assert(!q->defer_event_source);
 220         r = sd_event_add_defer(sd_bus_get_event(sd_bus_message_get_bus(reply)), &q->defer_event_source, async_polkit_defer, q);
 221         if (r < 0)
 222                 goto fail;
 223
 224         r = sd_event_source_set_priority(q->defer_event_source, SD_EVENT_PRIORITY_IDLE);
 225         if (r < 0)
 226                 goto fail;
 227
 228         r = sd_event_source_set_enabled(q->defer_event_source, SD_EVENT_ONESHOT);
 229         if (r < 0)
 230                 goto fail;
 231
 232         r = sd_bus_message_rewind(q->request, true);
 233         if (r < 0)
 234                 goto fail;
 235
 236         r = sd_bus_enqueue_for_read(sd_bus_message_get_bus(q->request), q->request);
 237         if (r < 0)
 238                 goto fail;
 239
 240         return 1;
 241
 242 fail:
 243         log_debug_errno(r, "Processing asynchronous PolicyKit reply failed, ignoring: %m");
 244         (void) sd_bus_reply_method_errno(q->request, r, NULL);
 245         async_polkit_query_free(q);
 246         return r;
 247 }
 248
 249 #endif
 250
 251 int bus_verify_polkit_async(
 252                 sd_bus_message *call,
 253                 int capability,
 254                 const char *action,
 255                 const char **details,
 256                 bool interactive,
 257                 uid_t good_user,
 258                 Hashmap **registry,
 259                 sd_bus_error *ret_error) {
 260
 261 #if ENABLE_POLKIT
 262         _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
 263         AsyncPolkitQuery *q;
 264         int c;
 265 #endif
 266         const char *sender;
 267         int r;
 268
 269         assert(call);
 270         assert(action);
 271         assert(registry);
 272
 273         r = check_good_user(call, good_user);
 274         if (r != 0)
 275                 return r;
 276
 277 #if ENABLE_POLKIT
 278         q = hashmap_get(*registry, call);
 279         if (q) {
 280                 int authorized, challenge;
 281
 282                 /* This is the second invocation of this function, and there's already a response from
 283                  * polkit, let's process it */
 284                 assert(q->reply);
 285
 286                 /* If the operation we want to authenticate changed between the first and the second time,
 287                  * let's not use this authentication, it might be out of date as the object and context we
 288                  * operate on might have changed. */
 289                 if (!streq(q->action, action) ||
 290                     !strv_equal(q->details, (char**) details))
 291                         return -ESTALE;
 292
 293                 if (sd_bus_message_is_method_error(q->reply, NULL)) {
 294                         const sd_bus_error *e;
 295
 296                         e = sd_bus_message_get_error(q->reply);
 297
 298                         /* Treat no PK available as access denied */
 299                         if (sd_bus_error_has_name(e, SD_BUS_ERROR_SERVICE_UNKNOWN) ||
 300                             sd_bus_error_has_name(e, SD_BUS_ERROR_NAME_HAS_NO_OWNER))
 301                                 return -EACCES;
 302
 303                         /* Copy error from polkit reply */
 304                         sd_bus_error_copy(ret_error, e);
 305                         return -sd_bus_error_get_errno(e);
 306                 }
 307
 308                 r = sd_bus_message_enter_container(q->reply, 'r', "bba{ss}");
 309                 if (r >= 0)
 310                         r = sd_bus_message_read(q->reply, "bb", &authorized, &challenge);
 311                 if (r < 0)
 312                         return r;
 313
 314                 if (authorized)
 315                         return 1;
 316
 317                 if (challenge)
 318                         return sd_bus_error_set(ret_error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED, "Interactive authentication required.");
 319
 320                 return -EACCES;
 321         }
 322 #endif
 323
 324         r = sd_bus_query_sender_privilege(call, capability);
 325         if (r < 0)
 326                 return r;
 327         else if (r > 0)
 328                 return 1;
 329
 330         sender = sd_bus_message_get_sender(call);
 331         if (!sender)
 332                 return -EBADMSG;
 333
 334 #if ENABLE_POLKIT
 335         c = sd_bus_message_get_allow_interactive_authorization(call);
 336         if (c < 0)
 337                 return c;
 338         if (c > 0)
 339                 interactive = true;
 340
 341         r = hashmap_ensure_allocated(registry, NULL);
 342         if (r < 0)
 343                 return r;
 344
 345         r = sd_bus_message_new_method_call(
 346                         call->bus,
 347                         &pk,
 348                         "org.freedesktop.PolicyKit1",
 349                         "/org/freedesktop/PolicyKit1/Authority",
 350                         "org.freedesktop.PolicyKit1.Authority",
 351                         "CheckAuthorization");
 352         if (r < 0)
 353                 return r;
 354
 355         r = sd_bus_message_append(
 356                         pk,
 357                         "(sa{sv})s",
 358                         "system-bus-name", 1, "name", "s", sender,
 359                         action);
 360         if (r < 0)
 361                 return r;
 362
 363         r = bus_message_append_strv_key_value(pk, details);
 364         if (r < 0)
 365                 return r;
 366
 367         r = sd_bus_message_append(pk, "us", interactive, NULL);
 368         if (r < 0)
 369                 return r;
 370
 371         q = new(AsyncPolkitQuery, 1);
 372         if (!q)
 373                 return -ENOMEM;
 374
 375         *q = (AsyncPolkitQuery) {
 376                 .request = sd_bus_message_ref(call),
 377         };
 378
 379         q->action = strdup(action);
 380         if (!q->action) {
 381                 async_polkit_query_free(q);
 382                 return -ENOMEM;
 383         }
 384
 385         q->details = strv_copy((char**) details);
 386         if (!q->details) {
 387                 async_polkit_query_free(q);
 388                 return -ENOMEM;
 389         }
 390
 391         r = hashmap_put(*registry, call, q);
 392         if (r < 0) {
 393                 async_polkit_query_free(q);
 394                 return r;
 395         }
 396
 397         q->registry = *registry;
 398
 399         r = sd_bus_call_async(call->bus, &q->slot, pk, async_polkit_callback, q, 0);
 400         if (r < 0) {
 401                 async_polkit_query_free(q);
 402                 return r;
 403         }
 404
 405         return 0;
 406 #endif
 407
 408         return -EACCES;
 409 }
 410
 411 void bus_verify_polkit_async_registry_free(Hashmap *registry) {
 412 #if ENABLE_POLKIT
 413         hashmap_free_with_destructor(registry, async_polkit_query_free);
 414 #endif
 415 }