summaryrefslogtreecommitdiff
path: root/docs/polkit/overview.xml
AgeCommit message (Collapse)AuthorFilesLines
2015-06-17docs: Update for changes to uid binding/AuthenticationAgentResponse2Miloslav Trmač1-4/+4
- Refer to PolkitAgentSession in general instead of to _response only - Revert to the original description of authentication cancellation, the agent really needs to return an error to the caller (in addition to dealing with the session if any). - Explicitly document the UID assumption; in the process fixing bug #69980. - Keep documenting that we need a sufficiently privileged caller. - Refer to the ...Response2 API in more places. - Also update docbook documentation. - Drop a paragraph suggesting non-PolkitAgentSession implementations are expected and commonplace. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90837 Reviewed-by: Colin Walters <walters@redhat.com>
2015-06-17CVE-2015-4625: Bind use of cookies to specific uidsColin Walters1-8/+10
http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html The "cookie" value that Polkit hands out is global to all polkit users. And when `AuthenticationAgentResponse` is invoked, we previously only received the cookie and *target* identity, and attempted to find an agent from that. The problem is that the current cookie is just an integer counter, and if it overflowed, it would be possible for an successful authorization in one session to trigger a response in another session. The overflow and ability to guess the cookie were fixed by the previous patch. This patch is conceptually further hardening on top of that. Polkit currently treats uids as equivalent from a security domain perspective; there is no support for SELinux/AppArmor/etc. differentiation. We can retrieve the uid from `getuid()` in the setuid helper, which allows us to ensure the uid invoking `AuthenticationAgentResponse2` matches that of the agent. Then the authority only looks at authentication sessions matching the cookie that were created by a matching uid, thus removing the ability for different uids to interfere with each other entirely. Several fixes to this patch were contributed by: Miloslav Trmač <mitr@redhat.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90837 CVE: CVE-2015-4625 Reported-by: Tavis Ormandy <taviso@google.com> Reviewed-by: Miloslav Trmač <mitr@redhat.com> Signed-off-by: Colin Walters <walters@redhat.com>
2013-05-06More warnings about using auth_self*Miloslav Trmač1-2/+22
Suggested by Colin Walters. https://bugs.freedesktop.org/show_bug.cgi?id=57284
2013-05-06Use auth_admin* instead of auth_self* in examplesMiloslav Trmač1-2/+2
From time to time, application developers just copy example configuration without examining it in details. Because polkit is typically used to control access to system-level operations, the policy (and therefore the examples) should limit access to system administrators only.
2012-11-14docs: mention the audience for authorization rulesDavid Zeuthen1-0/+10
Signed-off-by: David Zeuthen <zeuthen@gmail.com>
2012-06-08Update guidance on situations where there is no polkit authorityDavid Zeuthen1-1/+6
Now that GDBusProxy does something reasonable for a masked systemd service, see https://bugzilla.gnome.org/show_bug.cgi?id=677718 construction of the PolkitAuthority object does not fail anymore. That doesn't mean the authority is available, though, so mention that users should check the result of the CheckAuthorization() call as well. Or in the case of PolkitAuthority, that the error is not a POLKIT_ERROR. This is actually a nice feature, it means that if you unmask polkit.service then mechanisms using PolkitAuthority will start using it without a restart. Signed-off-by: David Zeuthen <zeuthen@gmail.com>
2012-06-07docs: add a "make sure your app works when there's no polkitd(8)" noteDavid Zeuthen1-0/+22
Signed-off-by: David Zeuthen <zeuthen@gmail.com>
2012-06-04Small updates to the "Writing polkit applications" chapterDavid Zeuthen1-74/+161
Signed-off-by: David Zeuthen <zeuthen@gmail.com>
2012-05-25Rewrite the "Writing polkit applications" chapterDavid Zeuthen1-38/+142
Signed-off-by: David Zeuthen <davidz@redhat.com>
2012-05-23Nuke polkitbackend library, localauthority backend and extension systemDavid Zeuthen1-33/+0
Any backend can now be implemented in JavaScript (if so desired) so we don't need any of this any more. Note that the libpolkitbackend library was never declared stable (the preprocessor symbol POLKIT_BACKEND_I_KNOW_API_IS_SUBJECT_TO_CHANGE had to be defined) so removing it is not an API/ABI break. Signed-off-by: David Zeuthen <davidz@redhat.com>
2012-04-24Update the docs to use 'polkit' (instead of 'PolicyKit') as the nameDavid Zeuthen1-19/+19
... as much as possible. Also remove the license on the docs and the FSF's address. Also point to http://www.freedesktop.org/software/polkit/docs/latest/ as that is going to be where docs are stored, going forward. Signed-off-by: David Zeuthen <davidz@redhat.com>
2012-04-24Mention pkttyagent(1) in "Writing PolicyKit applications" chapterDavid Zeuthen1-4/+3
Signed-off-by: David Zeuthen <davidz@redhat.com>
2011-03-03Deprecated PolkitBackendActionLookupDavid Zeuthen1-9/+0
Instead, pass the untranslated message as polkit.message and set the gettext domain on polkit.gettext_domain. For printf()-style messages, occurences of the form $(name_of_key) in the translated version of polkit.message are expanded with the value of the property name_of_key. See the pkexec(1) mechanism for an example of how to use this. Additionally, the property polkit.icon_name can be set to the icon. Note that not all authentication agents use this - in particular, gnome-shell does not. It is no longer possible to set the details to be shown in the authentication dialog. It was never a good idea to hide information there anyway. Instead, the mechanism should format a meaningful message. Signed-off-by: David Zeuthen <davidz@redhat.com>
2011-02-21Add a note about POLKIT_DEBUGDavid Zeuthen1-0/+5
Signed-off-by: David Zeuthen <davidz@redhat.com>
2010-08-20Various doc cleanupsDavid Zeuthen1-6/+18
Signed-off-by: David Zeuthen <davidz@redhat.com>
2009-11-13Add Python exampleDavid Zeuthen1-0/+4
2009-06-16Use unique ids for sections to prevent them being autogeneratedYanko Kaneti1-4/+4
Signed-off-by: David Zeuthen <davidz@redhat.com>
2009-06-08Minor doc fixesDavid Zeuthen1-5/+29
2009-06-08Add a "PolicyKit Overview" section to the docsDavid Zeuthen1-0/+91
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-18 02:33:33 +0000