]> git.ipfire.org Git - thirdparty/systemd.git/commitdiff
dbus/varlink: do not skip privilege check when polkit support is disabled
authorLuca Boccassi <luca.boccassi@gmail.com>
Tue, 17 Feb 2026 14:37:43 +0000 (14:37 +0000)
committerMike Yuan <me@yhndnzj.com>
Tue, 17 Feb 2026 17:12:59 +0000 (18:12 +0100)
There's not going to be any query if polkit support is
disabled at build time, so always check the peer's privileges
in that case

Follow-up for f5a12ceaedf4d490a9dc82e9460dd6fd97acc942

src/shared/bus-polkit.c

index c000b758695134261755635236f5ca69dae87323..f19db2a6eb00831a207072273b85840f5a633d3e 100644 (file)
@@ -571,18 +571,18 @@ int bus_verify_polkit_async_full(
                         return r;
                 }
         }
-#endif
 
         if (!FLAGS_SET(flags, POLKIT_ALWAYS_QUERY)) {
+#endif
                 /* Don't query PK if client is privileged */
                 r = sd_bus_query_sender_privilege(call, /* capability= */ -1);
                 if (r < 0)
                         return r;
                 if (r > 0)
                         return 1;
+#if ENABLE_POLKIT
         }
 
-#if ENABLE_POLKIT
         int c = sd_bus_message_get_allow_interactive_authorization(call);
         if (c < 0)
                 return c;
@@ -781,13 +781,15 @@ int varlink_verify_polkit_async_full(
         if (r != 0)
                 return r;
 
+#if ENABLE_POLKIT
         if (!FLAGS_SET(flags, POLKIT_ALWAYS_QUERY)) {
+#endif
                 r = varlink_check_peer_privilege(link);
                 if (r != 0)
                         return r;
+#if ENABLE_POLKIT
         }
 
-#if ENABLE_POLKIT
         _cleanup_(async_polkit_query_unrefp) AsyncPolkitQuery *q = NULL;
 
         q = async_polkit_query_ref(hashmap_get(*registry, link));