Bug 30181

Crazy idea: Maybe a better setup than .pkla files would be to do things exactly like udev does - with rules

 ACTION=="org.libvirt.manage", USER=="davidz", RESULT="auth_admin"

 # /path/to/script can print RESULT=auth_admin|yes|no|... on stdout
 ACTION=="org.libvirt.*", RUN="/path/to/script"

 # allow mounting filesystems if in a local active session
 ACTION=="org.udisks.mount", ACTIVE=="true", LOCAL=="true", RESULT="yes"

So we'd have and

 /etc/polkit-1/localauthority/rules.d/
 /var/polkit-1/localauthority/rules.d/

 (same way udev has /lib/udev/rules.d and /etc/udev/rules.d - we'd also
  include nice and useful semantics such as

    Rule files are required to have a unique name, duplicate file names are
    ignored. Files in /etc/udev/rules.d/ have precedence over files with
    the same name in /lib/udev/rules.d/. This can be used to ignore a
    default rules file if needed.

  which is from the udev(8) man page.)

and, more importantly, this allows running scripts/programs to determine if the given Subject is authorized or not. Which basically makes the PolicyKit Local Authority backend 100% scriptable. Which I think is something most admins want.

Repurposing this bug for reworking local authority configuration

I created a new branch for an experiment, see

 http://cgit.freedesktop.org/polkit/log/?h=wip/js-rule-files

that embeds a JS interpreter (running inside polkitd). The idea is that admins can drop .rules files in /etc/polkit-1/rules.d and these rules are JS scripts. This allows maximum flexibility while still allowing relatively simple files. A lot of information is available in the passed @subject value, for example pid, user-name, groups, session and seat. See below

With the rules file in [1], I get

 00:12:40.780: /etc/polkit-1/rules.d/10-example.rules:8:
action=org.freedesktop.policykit.exec
 00:12:40.780: /etc/polkit-1/rules.d/10-example.rules:9:
subject=[Subject pid=7449 seat=seat0 session=1 local=true active=true
user=davidz groups=davidz,wheel]
 00:12:40.780: /etc/polkit-1/rules.d/10-example.rules:11: now=Fri May
18 2012 00:12:40 GMT-0400 (EDT)

and if from another seat I get

 00:11:29.680: /etc/polkit-1/rules.d/10-example.rules:8:
action=org.freedesktop.policykit.exec
 00:11:29.680: /etc/polkit-1/rules.d/10-example.rules:9:
subject=[Subject pid=30980 seat= session=8 local=false active=true
user=bateman groups=bateman]
 00:11:29.680: /etc/polkit-1/rules.d/10-example.rules:11: now=Fri May
18 2012 00:11:29 GMT-0400 (EDT)

The only real missing feature is a polkit.spawn() method to run
arbitrary helpers (which is of course very expensive so should be used sparingly).

[1] : /etc/polkit-1/rules.d/10-example.rules

/* -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*- */

polkit.addAdministratorRule(function(action, subject) {
   return ["unix-group:sys", "unix-user:root"];
});

polkit.addAuthorizationRule(function(action, subject) {
   polkit.log("action=" + action);
   polkit.log("subject=" + subject);
   var now = new Date();
   polkit.log("now=" + now);
   if (action == "org.freedesktop.policykit.exec" &&
       subject.isInGroup("staff")) {
       return "yes";
   }
   return null;
});

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/polkit/polkit/issues/12.