polkit: turn "interactive" flag to polkit APIs into a proper flags field (#31715)

This adds for both the D-Bus and the Varlink flavours of our polkit
client api a flags parameter. And then folds the "bool interactive" flag
that the D-Bus version so far had, into a flag, and also adds support
for it in the Varlink API.

Since this means the Varlink API gained another parameter, let's do what
we already did for the D-Bus API and add a _full() version of the API
that has the flags and the good_uid parameter, and one without both.

diff --git a/src/creds/creds.c b/src/creds/creds.c
index 02e317ad2d5d3798b83b686dfbc206fa180621c9..1bc6760fbba94b3d6b8d46f35b3eb1ac774af26b 100644 (file)
--- a/src/creds/creds.c
+++ b/src/creds/creds.c
@@ -1192,7 +1192,6 @@ static int vl_method_encrypt(Varlink *link, JsonVariant *parameters, VarlinkMeth
                                 /* bus= */ NULL,
                                 "io.systemd.credentials.encrypt",
                                 /* details= */ NULL,
-                                /* good_user= */ UID_INVALID,
                                 polkit_registry);
                 if (r <= 0)
                         return r;
@@ -1297,7 +1296,6 @@ static int vl_method_decrypt(Varlink *link, JsonVariant *parameters, VarlinkMeth
                                         /* bus= */ NULL,
                                         "io.systemd.credentials.decrypt",
                                         /* details= */ NULL,
-                                        /* good_user= */ UID_INVALID,
                                         polkit_registry);
                         if (r <= 0)
                                 return r;

diff --git a/src/home/homed-home-bus.c b/src/home/homed-home-bus.c
index f54de1f581a01f7182cb1e434fcab40a8c2a334f..368ce2d9e23d682e4861457799dde28226a80eb6 100644 (file)
--- a/src/home/homed-home-bus.c
+++ b/src/home/homed-home-bus.c
@@ -97,13 +97,12 @@ static int home_verify_polkit_async(
                         message,
                         action,
                         details,
-                        /* interactive= */ false,
                         good_uid,
+                        /* flags= */ 0,
                         &h->manager->polkit_registry,
                         error);
 }
 
-
 int bus_home_get_record_json(
                 Home *h,
                 sd_bus_message *message,
@@ -185,8 +184,8 @@ int bus_home_method_activate(
                         message,
                         "org.freedesktop.home1.activate-home",
                         /* details= */ NULL,
-                        /* interctive= */ false,
                         h->uid,
+                        /* flags= */ 0,
                         &h->manager->polkit_registry,
                         error);
         if (r < 0)

diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 8904885c138ab1ab1303292d72465d5cc7b08ef9..83a988154feaea05dbceaba327bd3598a723f2b3 100644 (file)
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -1111,8 +1111,8 @@ static int method_set_hostname(sd_bus_message *m, void *userdata, sd_bus_error *
                         m,
                         "org.freedesktop.hostname1.set-hostname",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -1157,8 +1157,8 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
                         m,
                         "org.freedesktop.hostname1.set-static-hostname",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -1235,8 +1235,8 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
                         m,
                         prop == PROP_PRETTY_HOSTNAME ? "org.freedesktop.hostname1.set-static-hostname" : "org.freedesktop.hostname1.set-machine-info",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -1312,8 +1312,8 @@ static int method_get_product_uuid(sd_bus_message *m, void *userdata, sd_bus_err
                         m,
                         "org.freedesktop.hostname1.get-product-uuid",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -1651,7 +1651,6 @@ static int vl_method_describe(Varlink *link, JsonVariant *parameters, VarlinkMet
                         c->bus,
                         "org.freedesktop.hostname1.get-hardware-serial",
                         /* details= */ NULL,
-                        /* good_user= */ UID_INVALID,
                         &c->polkit_registry);
         if (r == 0)
                 return 0; /* No authorization for now, but the async polkit stuff will call us again when it has it */

diff --git a/src/locale/localed.c b/src/locale/localed.c
index cf88da37ad9f7c798c5ee117d40ef34d0a939e57..5758a2624c791107620cac0a8cfe01e815f98ad0 100644 (file)
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -286,8 +286,8 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
                         m,
                         "org.freedesktop.locale1.set-locale",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -390,8 +390,8 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
                         m,
                         "org.freedesktop.locale1.set-keyboard",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)
@@ -509,8 +509,8 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
                         m,
                         "org.freedesktop.locale1.set-keyboard",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &c->polkit_registry,
                         error);
         if (r < 0)

diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c
index 7290616252c6420c7edbd4c9f0d409659e80cf21..0e4e93d2775910822fb6b387e1c98a241c40a59f 100644 (file)
--- a/src/login/logind-dbus.c
+++ b/src/login/logind-dbus.c
@@ -1442,8 +1442,8 @@ static int method_set_user_linger(sd_bus_message *message, void *userdata, sd_bu
                         uid == auth_uid ? "org.freedesktop.login1.set-self-linger" :
                                           "org.freedesktop.login1.set-user-linger",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &m->polkit_registry,
                         error);
         if (r < 0)
@@ -1614,8 +1614,8 @@ static int method_attach_device(sd_bus_message *message, void *userdata, sd_bus_
                         message,
                         "org.freedesktop.login1.attach-device",
                         /* details= */ NULL,
-                        interactive,
                         /* good_user= */ UID_INVALID,
+                        interactive ? POLKIT_ALLOW_INTERACTIVE : 0,
                         &m->polkit_registry,
                         error);
         if (r < 0)

diff --git a/src/login/logind-session-dbus.c b/src/login/logind-session-dbus.c
index 0411d85c336a795404e658c0312a1169e2f5bc57..f20ef4f309bfba7f7fd33381951de3f5de823ed2 100644 (file)
--- a/src/login/logind-session-dbus.c
+++ b/src/login/logind-session-dbus.c
@@ -162,8 +162,8 @@ int bus_session_method_terminate(sd_bus_message *message, void *userdata, sd_bus
                         message,
                         "org.freedesktop.login1.manage",
                         /* details= */ NULL,
-                        /* interactive= */ false,
                         s->user->user_record->uid,
+                        /* flags= */ 0,
                         &s->manager->polkit_registry,
                         error);
         if (r < 0)
@@ -207,8 +207,8 @@ int bus_session_method_lock(sd_bus_message *message, void *userdata, sd_bus_erro
                         message,
                         "org.freedesktop.login1.lock-sessions",
                         /* details= */ NULL,
-                        /* interactive= */ false,
                         s->user->user_record->uid,
+                        /* flags= */ 0,
                         &s->manager->polkit_registry,
                         error);
         if (r < 0)
@@ -317,8 +317,8 @@ int bus_session_method_kill(sd_bus_message *message, void *userdata, sd_bus_erro
                         message,
                         "org.freedesktop.login1.manage",
                         /* details= */ NULL,
-                        /* interactive= */ false,
                         s->user->user_record->uid,
+                        /* flags= */ 0,
                         &s->manager->polkit_registry,
                         error);
         if (r < 0)

diff --git a/src/login/logind-user-dbus.c b/src/login/logind-user-dbus.c
index d277aed2a9ee2c6d3bfd045747dc2adc55ca9dd4..ba83dc5d1a305d1bf0214d66bf3b91c2362b8a8d 100644 (file)
--- a/src/login/logind-user-dbus.c
+++ b/src/login/logind-user-dbus.c
@@ -196,8 +196,8 @@ int bus_user_method_terminate(sd_bus_message *message, void *userdata, sd_bus_er
                         message,
                         "org.freedesktop.login1.manage",
                         /* details= */ NULL,
-                        /* interactive= */ false,
                         u->user_record->uid,
+                        /* flags= */ 0,
                         &u->manager->polkit_registry,
                         error);
         if (r < 0)
@@ -223,8 +223,8 @@ int bus_user_method_kill(sd_bus_message *message, void *userdata, sd_bus_error *
                         message,
                         "org.freedesktop.login1.manage",
                         /* details= */ NULL,
-                        /* interactive= */ false,
                         u->user_record->uid,
+                        /* flags= */ 0,
                         &u->manager->polkit_registry,
                         error);
         if (r < 0)

diff --git a/src/shared/bus-polkit.c b/src/shared/bus-polkit.c
index c8e1e73121552743c629aeedeb85b989f7a9a383..707f33acae118091a615f1c76627fb41e91bd19c 100644 (file)
--- a/src/shared/bus-polkit.c
+++ b/src/shared/bus-polkit.c
@@ -497,8 +497,8 @@ int bus_verify_polkit_async_full(
                 sd_bus_message *call,
                 const char *action,
                 const char **details,
-                bool interactive, /* Use only for legacy method calls that have a separate "allow_interactive_authentication" field */
                 uid_t good_user,
+                PolkitFlags flags,
                 Hashmap **registry,
                 sd_bus_error *ret_error) {
 
@@ -533,7 +533,7 @@ int bus_verify_polkit_async_full(
                 return 1;
 
 #if ENABLE_POLKIT
-        _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
+        bool interactive = FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE);
 
         int c = sd_bus_message_get_allow_interactive_authorization(call);
         if (c < 0)
@@ -541,6 +541,7 @@ int bus_verify_polkit_async_full(
         if (c > 0)
                 interactive = true;
 
+        _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
         r = bus_message_new_polkit_auth_call_for_bus(call, action, details, interactive, &pk);
         if (r < 0)
                 return r;
@@ -707,12 +708,13 @@ static bool varlink_allow_interactive_authentication(Varlink *link) {
 }
 #endif
 
-int varlink_verify_polkit_async(
+int varlink_verify_polkit_async_full(
                 Varlink *link,
                 sd_bus *bus,
                 const char *action,
                 const char **details,
                 uid_t good_user,
+                PolkitFlags flags,
                 Hashmap **registry) {
 
         int r;
@@ -766,7 +768,9 @@ int varlink_verify_polkit_async(
                 bus = mybus;
         }
 
-        bool interactive = varlink_allow_interactive_authentication(link);
+        bool interactive =
+                FLAGS_SET(flags, POLKIT_ALLOW_INTERACTIVE) ||
+                varlink_allow_interactive_authentication(link);
 
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *pk = NULL;
         r = bus_message_new_polkit_auth_call_for_varlink(bus, link, action, details, interactive, &pk);

diff --git a/src/shared/bus-polkit.h b/src/shared/bus-polkit.h
index 0fe3a4ca0ed91d0ab0bdc0c72c0a89d64ad6104e..4e2c1d355117105c21b685429aa8a44301e1e123 100644 (file)
--- a/src/shared/bus-polkit.h
+++ b/src/shared/bus-polkit.h
@@ -7,14 +7,21 @@
 #include "user-util.h"
 #include "varlink.h"
 
+typedef enum PolkitFLags {
+        POLKIT_ALLOW_INTERACTIVE = 1 << 0, /* Allow interactive auth (typically not required, because can be derived from bus message/link automatically) */
+} PolkitFlags;
+
 int bus_test_polkit(sd_bus_message *call, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);
 
-int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, bool interactive, uid_t good_user, Hashmap **registry, sd_bus_error *error);
+int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry, sd_bus_error *error);
 static inline int bus_verify_polkit_async(sd_bus_message *call, const char *action, const char **details, Hashmap **registry, sd_bus_error *ret_error) {
-        return bus_verify_polkit_async_full(call, action, details, false, UID_INVALID, registry, ret_error);
+        return bus_verify_polkit_async_full(call, action, details, UID_INVALID, 0, registry, ret_error);
 }
 
-int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, Hashmap **registry);
+int varlink_verify_polkit_async_full(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry);
+static inline int varlink_verify_polkit_async(Varlink *link, sd_bus *bus, const char *action, const char **details, Hashmap **registry) {
+        return varlink_verify_polkit_async_full(link, bus, action, details, UID_INVALID, 0, registry);
+}
 
 /* A JsonDispatch initializer that makes sure the allowInteractiveAuthentication boolean field we want for
  * polkit support in Varlink calls is ignored while regular dispatching (and does not result in errors