47a88a
From d2dcaeddfe015d3fee3817737e1bae72f1ad3316 Mon Sep 17 00:00:00 2001
47a88a
From: Jakub Filak <jfilak@redhat.com>
47a88a
Date: Wed, 1 Jul 2015 13:38:57 +0200
47a88a
Subject: [PATCH] cli: enable polkit authentication on command line
47a88a
47a88a
This patch will allow users to work with all problems without the need
47a88a
to run abrt-cli under root account.
47a88a
47a88a
The polkit aget will run in a separate thread and will interact with a
47a88a
user via STDOUT and STDIN, so we should not introduce new threads using
47a88a
STDIN or STDOUT and all D-Bus calls should be synchronous.
47a88a
47a88a
http://www.freedesktop.org/software/polkit/docs/latest/ref-authentication-agent-api.html
47a88a
47a88a
Related: #1224984
47a88a
47a88a
Signed-off-by: Jakub Filak <jfilak@redhat.com>
47a88a
47a88a
Conflicts:
47a88a
	src/cli/Makefile.am
47a88a
---
47a88a
 configure.ac            |  1 +
47a88a
 doc/abrt-cli.txt        | 11 +++++++++--
47a88a
 src/cli/Makefile.am     |  2 ++
47a88a
 src/cli/abrt-cli-core.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++--
47a88a
 src/cli/abrt-cli-core.h |  9 ++++++++-
47a88a
 src/cli/abrt-cli.c      | 15 ++++++++++++++-
47a88a
 6 files changed, 82 insertions(+), 6 deletions(-)
47a88a
47a88a
diff --git a/configure.ac b/configure.ac
47a88a
index d65bf54..56b8ad8 100644
47a88a
--- a/configure.ac
47a88a
+++ b/configure.ac
47a88a
@@ -104,6 +104,7 @@ PKG_CHECK_MODULES([NSS], [nss])
47a88a
 PKG_CHECK_MODULES([LIBREPORT], [libreport])
47a88a
 PKG_CHECK_MODULES([LIBREPORT_GTK], [libreport-gtk])
47a88a
 PKG_CHECK_MODULES([POLKIT], [polkit-gobject-1])
47a88a
+PKG_CHECK_MODULES([POLKIT_AGENT], [polkit-agent-1])
47a88a
 PKG_CHECK_MODULES([GIO], [gio-2.0])
47a88a
 PKG_CHECK_MODULES([SATYR], [satyr])
47a88a
 PKG_CHECK_MODULES([LIBSELINUX], [libselinux])
47a88a
diff --git a/doc/abrt-cli.txt b/doc/abrt-cli.txt
47a88a
index 399b5fd..0f18784 100644
47a88a
--- a/doc/abrt-cli.txt
47a88a
+++ b/doc/abrt-cli.txt
47a88a
@@ -7,6 +7,8 @@ abrt-cli - List, remove, print, analyze, report problems
47a88a
 
47a88a
 SYNOPSIS
47a88a
 --------
47a88a
+'abrt-cli' [--authenticate] COMMAND [COMMAND OPTIONS]
47a88a
+
47a88a
 'abrt-cli' list    [-vn] [--detailed] [--since NUM] [--until NUM] [DIR]...
47a88a
 
47a88a
 'abrt-cli' remove  [-v]  DIR...
47a88a
@@ -19,8 +21,13 @@ SYNOPSIS
47a88a
 
47a88a
 'abrt-cli' process [-v]  [--since NUM] DIR...
47a88a
 
47a88a
-OPTIONS
47a88a
--------
47a88a
+GLOBAL OPTIONS
47a88a
+--------------
47a88a
+-a,--authenticate::
47a88a
+   Enable PolicyKit authentication to be able to work with the system problems
47a88a
+
47a88a
+COMMAND OPTIONS
47a88a
+---------------
47a88a
 -v,--verbose::
47a88a
    Be more verbose. Can be given multiple times.
47a88a
 
47a88a
diff --git a/src/cli/Makefile.am b/src/cli/Makefile.am
47a88a
index 9fff5b3..a7c76ef 100644
47a88a
--- a/src/cli/Makefile.am
47a88a
+++ b/src/cli/Makefile.am
47a88a
@@ -17,6 +17,7 @@ abrt_cli_CFLAGS = \
47a88a
 	-I$(srcdir)/../include \
47a88a
 	-I$(srcdir)/../lib \
47a88a
 	$(LIBREPORT_CFLAGS) \
47a88a
+	$(POLKIT_AGENT_CFLAGS) \
47a88a
 	-DWORKFLOWS_DIR=\"${WORKFLOWS_DIR}\"
47a88a
 
47a88a
 if SUGGEST_AUTOREPORTING
47a88a
@@ -24,6 +25,7 @@ abrt_cli_CFLAGS += -DSUGGEST_AUTOREPORTING=1
47a88a
 endif
47a88a
 
47a88a
 abrt_cli_LDADD = \
47a88a
+    $(POLKIT_AGENT_LIBS) \
47a88a
     $(LIBREPORT_LIBS) \
47a88a
     ../lib/libabrt.la
47a88a
 
47a88a
diff --git a/src/cli/abrt-cli-core.c b/src/cli/abrt-cli-core.c
47a88a
index 46acd01..ca49dbd 100644
47a88a
--- a/src/cli/abrt-cli-core.c
47a88a
+++ b/src/cli/abrt-cli-core.c
47a88a
@@ -20,6 +20,17 @@
47a88a
 #include "libabrt.h"
47a88a
 #include "abrt-cli-core.h"
47a88a
 
47a88a
+/* It is not possible to include polkitagent.h without the following define.
47a88a
+ * Check out the included header file.
47a88a
+ */
47a88a
+#define POLKIT_AGENT_I_KNOW_API_IS_SUBJECT_TO_CHANGE
47a88a
+#include <polkitagent/polkitagent.h>
47a88a
+
47a88a
+int g_cli_authenticate;
47a88a
+
47a88a
+static PolkitAgentListener *s_local_polkit_agent = NULL;
47a88a
+static gpointer s_local_agent_handle = NULL;
47a88a
+
47a88a
 /* Vector of problems: */
47a88a
 /* problem_data_vector[i] = { "name" = { "content", CD_FLAG_foo_bits } } */
47a88a
 
47a88a
@@ -41,7 +52,7 @@ vector_of_problem_data_t *new_vector_of_problem_data(void)
47a88a
 
47a88a
 vector_of_problem_data_t *fetch_crash_infos(void)
47a88a
 {
47a88a
-    GList *problems = get_problems_over_dbus(/*don't authorize*/false);
47a88a
+    GList *problems = get_problems_over_dbus(g_cli_authenticate);
47a88a
     if (problems == ERR_PTR)
47a88a
         return NULL;
47a88a
 
47a88a
@@ -97,7 +108,7 @@ char *find_problem_by_hash(const char *hash, GList *problems)
47a88a
 char *hash2dirname(const char *hash)
47a88a
 {
47a88a
     /* Try loading by dirname hash */
47a88a
-    GList *problems = get_problems_over_dbus(/*don't authorize*/false);
47a88a
+    GList *problems = get_problems_over_dbus(g_cli_authenticate);
47a88a
     if (problems == ERR_PTR)
47a88a
         return NULL;
47a88a
 
47a88a
@@ -112,3 +123,38 @@ char *hash2dirname_if_necessary(const char *input)
47a88a
 {
47a88a
     return isxdigit_str(input) ? hash2dirname(input) : xstrdup(input);
47a88a
 }
47a88a
+
47a88a
+void initialize_polkit_agent(void)
47a88a
+{
47a88a
+    GError *error = NULL;
47a88a
+    PolkitSubject *subject = polkit_unix_process_new_for_owner(
47a88a
+                                getpid(),
47a88a
+                                /*start time from /proc*/0,
47a88a
+                                getuid());
47a88a
+
47a88a
+    s_local_polkit_agent = polkit_agent_text_listener_new(NULL, &error);
47a88a
+    if (s_local_polkit_agent == NULL)
47a88a
+    {
47a88a
+        error_msg_and_die("polkit_agent_text_listener_new: %s (%s, %d)\n",
47a88a
+                error->message, g_quark_to_string (error->domain), error->code);
47a88a
+    }
47a88a
+
47a88a
+    s_local_agent_handle = polkit_agent_listener_register(s_local_polkit_agent,
47a88a
+            POLKIT_AGENT_REGISTER_FLAGS_RUN_IN_THREAD, subject, NULL, NULL, &error);
47a88a
+    if (s_local_agent_handle == NULL)
47a88a
+    {
47a88a
+        error_msg_and_die("polkit_agent_listener_register: %s (%s, %d)\n",
47a88a
+                error->message, g_quark_to_string (error->domain), error->code);
47a88a
+    }
47a88a
+
47a88a
+    g_object_unref(subject);
47a88a
+}
47a88a
+
47a88a
+void uninitialize_polkit_agent(void)
47a88a
+{
47a88a
+    if (s_local_agent_handle != NULL)
47a88a
+        polkit_agent_listener_unregister(s_local_agent_handle);
47a88a
+
47a88a
+    if (s_local_polkit_agent != NULL)
47a88a
+        g_object_unref(s_local_polkit_agent);
47a88a
+}
47a88a
diff --git a/src/cli/abrt-cli-core.h b/src/cli/abrt-cli-core.h
47a88a
index d69d463..e2456e6 100644
47a88a
--- a/src/cli/abrt-cli-core.h
47a88a
+++ b/src/cli/abrt-cli-core.h
47a88a
@@ -22,6 +22,10 @@
47a88a
 
47a88a
 #include "problem_api.h"
47a88a
 
47a88a
+/* Use authenticate D-Bus methods. The authentication requires a polkit agent
47a88a
+ * to finish an authenticated method successfully. */
47a88a
+extern int g_cli_authenticate;
47a88a
+
47a88a
 typedef GPtrArray vector_of_problem_data_t;
47a88a
 
47a88a
 problem_data_t *get_problem_data(vector_of_problem_data_t *vector, unsigned i);
47a88a
@@ -37,6 +41,9 @@ char *hash2dirname(const char *hash);
47a88a
 /* If input looks like a hash, returns malloced string, or NULL if not found.
47a88a
  * Otherwise returns a copy of the input. */
47a88a
 char *hash2dirname_if_necessary(const char *input);
47a88a
-
47a88a
+/* Initialize a new polkit text agent in a new thread */
47a88a
+void initialize_polkit_agent(void);
47a88a
+/* Uninitialize the polkit text agent */
47a88a
+void uninitialize_polkit_agent(void);
47a88a
 
47a88a
 #endif /* ABRT_CLI_CORE_H_ */
47a88a
diff --git a/src/cli/abrt-cli.c b/src/cli/abrt-cli.c
47a88a
index 8e19081..f45523e 100644
47a88a
--- a/src/cli/abrt-cli.c
47a88a
+++ b/src/cli/abrt-cli.c
47a88a
@@ -19,6 +19,7 @@
47a88a
 
47a88a
 #include "libabrt.h"
47a88a
 #include "builtin-cmd.h"
47a88a
+#include "abrt-cli-core.h"
47a88a
 
47a88a
 #define USAGE_OPTS_WIDTH 16
47a88a
 #define USAGE_GAP         2
47a88a
@@ -75,6 +76,10 @@ static unsigned handle_internal_options(int argc, const char **argv, const char
47a88a
         {
47a88a
             return skip + argc;
47a88a
         }
47a88a
+        else if (strcmp(cmd, "-a") == 0 || strcmp(cmd, "--authenticate") == 0)
47a88a
+        {
47a88a
+            g_cli_authenticate = 1;
47a88a
+        }
47a88a
         else
47a88a
             error_msg_and_die("%s", usage);
47a88a
 
47a88a
@@ -122,7 +127,7 @@ int main(int argc, const char **argv)
47a88a
     argc--;
47a88a
 
47a88a
     const char *abrt_cli_usage_string = _(
47a88a
-        "Usage: abrt-cli [--version] COMMAND [DIR]..."
47a88a
+        "Usage: abrt-cli [--authenticate] [--version] COMMAND [DIR]..."
47a88a
         );
47a88a
 
47a88a
     const struct cmd_struct commands[] = {
47a88a
@@ -141,8 +146,16 @@ int main(int argc, const char **argv)
47a88a
     argc -= skip;
47a88a
     argv += skip;
47a88a
     if (argc > 0)
47a88a
+    {
47a88a
+        if (g_cli_authenticate)
47a88a
+            initialize_polkit_agent();
47a88a
+
47a88a
         handle_internal_command(argc, argv, commands);
47a88a
 
47a88a
+        if (g_cli_authenticate)
47a88a
+            uninitialize_polkit_agent();
47a88a
+    }
47a88a
+
47a88a
     /* user didn't specify command; print out help */
47a88a
     printf("%s\n\n", abrt_cli_usage_string);
47a88a
     list_cmds_help(commands);
47a88a
-- 
47a88a
2.4.3
47a88a