code.delx.au - pulseaudio/blob - src/daemon/polkit.c

   1 /***
   2   This file is part of PulseAudio.
   3
   4   Copyright 2004-2006 Lennart Poettering
   5   Copyright 2006 Pierre Ossman <ossman@cendio.se> for Cendio AB
   6
   7   PulseAudio is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU Lesser General Public License as published
   9   by the Free Software Foundation; either version 2 of the License,
  10   or (at your option) any later version.
  11
  12   PulseAudio is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with PulseAudio; if not, write to the Free Software
  19   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
  20   USA.
  21 ***/
  22
  23 #ifdef HAVE_CONFIG_H
  24 #include <config.h>
  25 #endif
  26
  27 #include <unistd.h>
  28 #include <stdlib.h>
  29 #include <inttypes.h>
  30
  31 #include <dbus/dbus.h>
  32 #include <polkit-dbus/polkit-dbus.h>
  33
  34 #include <pulsecore/log.h>
  35 #include <pulsecore/macro.h>
  36
  37 #include "polkit.h"
  38
  39 int pa_polkit_check(const char *action_id) {
  40     int ret = -1;
  41     DBusError dbus_error;
  42     DBusConnection *bus = NULL;
  43     PolKitCaller *caller = NULL;
  44     PolKitAction *action = NULL;
  45     PolKitContext *context = NULL;
  46     PolKitError *polkit_error = NULL;
  47     PolKitSession *session = NULL;
  48     PolKitResult polkit_result;
  49
  50     dbus_error_init(&dbus_error);
  51
  52     if (!(bus = dbus_bus_get(DBUS_BUS_SYSTEM, &dbus_error))) {
  53         pa_log_error("Cannot connect to system bus: %s", dbus_error.message);
  54         goto finish;
  55     }
  56
  57     /* There seems to be a bug in some versions of D-Bus that causes
  58      * dbus_shutdown() to call exit() when a connection without this
  59      * flag disabled was created during runtime.*/
  60     dbus_connection_set_exit_on_disconnect(bus, FALSE);
  61
  62     if (!(caller = polkit_caller_new_from_pid(bus, getpid(), &dbus_error))) {
  63         pa_log_error("Cannot get caller from PID: %s", dbus_error.message);
  64         goto finish;
  65     }
  66
  67     /* This function is called when PulseAudio is called SUID root. We
  68      * want to authenticate the real user that called us and not the
  69      * effective user we gained through being SUID root. Hence we
  70      * overwrite the UID caller data here explicitly, just for
  71      * paranoia. In fact PolicyKit should fill in the UID here anyway
  72      * -- an not the EUID or any other user id. */
  73
  74     if (!(polkit_caller_set_uid(caller, getuid()))) {
  75         pa_log_error("Cannot set UID on caller object.");
  76         goto finish;
  77     }
  78
  79     if (!(polkit_caller_get_ck_session(caller, &session))) {
  80         pa_log_error("Failed to get CK session.");
  81         goto finish;
  82     }
  83
  84     /* We need to overwrite the UID in both the caller and the session
  85      * object */
  86
  87     if (!(polkit_session_set_uid(session, getuid()))) {
  88         pa_log_error("Cannot set UID on session object.");
  89         goto finish;
  90     }
  91
  92     if (!(action = polkit_action_new())) {
  93         pa_log_error("Cannot allocate PolKitAction.");
  94         goto finish;
  95     }
  96
  97     if (!polkit_action_set_action_id(action, action_id)) {
  98         pa_log_error("Cannot set action_id");
  99         goto finish;
 100     }
 101
 102     if (!(context = polkit_context_new())) {
 103         pa_log_error("Cannot allocate PolKitContext.");
 104         goto finish;
 105     }
 106
 107     if (!polkit_context_init(context, &polkit_error)) {
 108         pa_log_error("Cannot initialize PolKitContext: %s", polkit_error_get_error_message(polkit_error));
 109         goto finish;
 110     }
 111
 112     for (;;) {
 113
 114         polkit_result = polkit_context_is_caller_authorized(context, action, caller, TRUE, &polkit_error);
 115
 116         if (polkit_error_is_set(polkit_error)) {
 117             pa_log_error("Could not determine whether caller is authorized: %s", polkit_error_get_error_message(polkit_error));
 118             goto finish;
 119         }
 120
 121         if (polkit_result == POLKIT_RESULT_ONLY_VIA_ADMIN_AUTH ||
 122             polkit_result == POLKIT_RESULT_ONLY_VIA_ADMIN_AUTH_KEEP_SESSION ||
 123             polkit_result == POLKIT_RESULT_ONLY_VIA_ADMIN_AUTH_KEEP_ALWAYS ||
 124             polkit_result == POLKIT_RESULT_ONLY_VIA_ADMIN_AUTH_ONE_SHOT ||
 125             polkit_result == POLKIT_RESULT_ONLY_VIA_SELF_AUTH ||
 126             polkit_result == POLKIT_RESULT_ONLY_VIA_SELF_AUTH_KEEP_SESSION ||
 127             polkit_result == POLKIT_RESULT_ONLY_VIA_SELF_AUTH_KEEP_ALWAYS ||
 128             polkit_result == POLKIT_RESULT_ONLY_VIA_SELF_AUTH_ONE_SHOT
 129         ) {
 130
 131             if (polkit_auth_obtain(action_id, 0, getpid(), &dbus_error)) {
 132                 polkit_result = POLKIT_RESULT_YES;
 133                 break;
 134             }
 135
 136             if (dbus_error_is_set(&dbus_error)) {
 137                 pa_log_error("Cannot obtain auth: %s", dbus_error.message);
 138                 goto finish;
 139             }
 140         }
 141
 142         break;
 143     }
 144
 145     if (polkit_result != POLKIT_RESULT_YES && polkit_result != POLKIT_RESULT_NO)
 146         pa_log_warn("PolicyKit responded with '%s'", polkit_result_to_string_representation(polkit_result));
 147
 148     ret = polkit_result == POLKIT_RESULT_YES;
 149
 150 finish:
 151
 152     if (caller)
 153         polkit_caller_unref(caller);
 154
 155     if (action)
 156         polkit_action_unref(action);
 157
 158     if (context)
 159         polkit_context_unref(context);
 160
 161     if (bus)
 162         dbus_connection_unref(bus);
 163
 164     dbus_error_free(&dbus_error);
 165
 166     if (polkit_error)
 167         polkit_error_free(polkit_error);
 168
 169     return ret;
 170 }