Re: [PATCHES] Whip polkit into shape

[Andy Wingo <wingo@igalia.com>]

[-- Attachment #1: Type: text/plain, Size: 988 bytes --]

On Tue 01 Sep 2015 13:53, Andy Wingo <wingo@igalia.com> writes:

> Attached are three patches to polkit.  The first makes polkit use
> elogind for seat management.  The second is based on a WIP patch from
> Mark, and arranges for polkit to look in the system profile for rules
> and actions.  The third adds a polkit service.  I've tested these by
> running "pkaction" and "pkcheck", both with an embedded authentication
> agent and with an external agent.  Kinda cool to see these work.
> Unfortunately I haven't gotten user-mode "loginctl reboot" to work --
> for some reason it doesn't end up spawning the authentication agent
> correctly.  Oh well, future work.  Usually people will be running with a
> authentication agent linked to their graphical session anyway.
>
> BTW, for XFCE there appears to be this thing: 
>
>   https://github.com/ncopa/xfce-polkit
>
> See also:
>
>   https://wiki.archlinux.org/index.php/Polkit#Authentication_agents
>
> Cheers,

aaaaaaand here they are


[-- Attachment #2: 0003-gnu-polkit-Use-elogind-for-seat-management.patch --]
[-- Type: text/plain, Size: 2216 bytes --]

From e409449f493da3a42b9f989c819d3290fe9a523a Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@pobox.com>
Date: Tue, 18 Aug 2015 11:39:22 +0200
Subject: [PATCH 3/7] gnu: polkit: Use elogind for seat management.

* gnu/packages/polkit.scm (polkit): Depend on elogind.
---
 gnu/packages/polkit.scm | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/gnu/packages/polkit.scm b/gnu/packages/polkit.scm
index 172b0e1..acbc03d 100644
--- a/gnu/packages/polkit.scm
+++ b/gnu/packages/polkit.scm
@@ -23,6 +23,7 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
+  #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages linux)
@@ -44,11 +45,28 @@
              (sha256
               (base32
                "109w86kfqrgz83g9ivggplmgc77rz8kx8646izvm2jb57h4rbh71"))
-             (patches (list (search-patch "polkit-drop-test.patch")))))
+             (patches (list (search-patch "polkit-drop-test.patch")))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                 (use-modules (guix build utils))
+                 (substitute* "configure"
+                   ;; Replace libsystemd-login with libelogind.
+                   (("libsystemd-login") "libelogind")
+                   ;; Skip the sanity check that the current system runs
+                   ;; systemd.
+                   (("test ! -d /sys/fs/cgroup/systemd/") "false"))
+                 (substitute* "src/polkit/polkitunixsession-systemd.c"
+                   (("systemd") "elogind"))
+                 (substitute* "src/polkitbackend/polkitbackendsessionmonitor-systemd.c"
+                   (("systemd") "elogind"))
+                 (substitute* "src/polkitbackend/polkitbackendjsauthority.c"
+                   (("systemd") "elogind"))))))
     (build-system gnu-build-system)
     (inputs
       `(("expat" ,expat)
         ("glib:bin" ,glib "bin") ; for glib-mkenums
+        ("elogind" ,elogind)
         ("intltool" ,intltool)
         ("linux-pam" ,linux-pam)
         ("mozjs" ,mozjs)
-- 
2.4.3


[-- Attachment #3: 0004-gnu-polkit-Look-for-rules-in-run-current-system-prof.patch --]
[-- Type: text/plain, Size: 4649 bytes --]

From 11e1301553117f093642142bf50bb4462c87ba47 Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@pobox.com>
Date: Tue, 1 Sep 2015 13:30:31 +0200
Subject: [PATCH 4/7] gnu: polkit: Look for rules in
 /run/current-system/profile.

* gnu/packages/polkit.scm (polkit): Configure to look for actions and
  rules in the system profile.  Arrange to look for the setuid helper in
  /run/setuid-programs.  Fix introspection installation.

Based on a patch by Mark H Weaver <mhw@netris.org>.
---
 gnu/packages/polkit.scm | 62 +++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 52 insertions(+), 10 deletions(-)

diff --git a/gnu/packages/polkit.scm b/gnu/packages/polkit.scm
index acbc03d..010d47a 100644
--- a/gnu/packages/polkit.scm
+++ b/gnu/packages/polkit.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -61,20 +62,61 @@
                  (substitute* "src/polkitbackend/polkitbackendsessionmonitor-systemd.c"
                    (("systemd") "elogind"))
                  (substitute* "src/polkitbackend/polkitbackendjsauthority.c"
-                   (("systemd") "elogind"))))))
+                   (("systemd") "elogind"))
+
+                 (substitute* "src/polkitagent/polkitagentsession.c"
+                   (("PACKAGE_PREFIX \"/lib/polkit-1/polkit-agent-helper-1\"")
+                    "\"/run/setuid-programs/polkit-agent-helper-1\""))
+                 (substitute* "src/polkitbackend/polkitbackendinteractiveauthority.c"
+                   (("PACKAGE_DATA_DIR \"/polkit-1/actions\"")
+                    "\"/run/current-system/profile/share/polkit-1/actions\""))
+                 (substitute* "src/polkitbackend/polkitbackendjsauthority.c"
+                   (("PACKAGE_SYSCONF_DIR \"/polkit-1/rules.d\"")
+                    "\"/run/current-system/profile/etc/polkit-1/rules.d\""))
+                 (substitute* "src/polkitbackend/polkitbackendjsauthority.c"
+                   (("PACKAGE_DATA_DIR \"/polkit-1/rules.d\"")
+                    "\"/run/current-system/profile/share/polkit-1/rules.d\""))))))
     (build-system gnu-build-system)
     (inputs
-      `(("expat" ,expat)
-        ("glib:bin" ,glib "bin") ; for glib-mkenums
-        ("elogind" ,elogind)
-        ("intltool" ,intltool)
-        ("linux-pam" ,linux-pam)
-        ("mozjs" ,mozjs)
-        ("nspr" ,nspr)))
+     `(("expat" ,expat)
+       ("linux-pam" ,linux-pam)
+       ("elogind" ,elogind)
+       ("mozjs" ,mozjs)
+       ("nspr" ,nspr)))
     (propagated-inputs
-      `(("glib" ,glib))) ; required by polkit-gobject-1.pc
+     `(("glib" ,glib))) ; required by polkit-gobject-1.pc
     (native-inputs
-      `(("pkg-config", pkg-config)))
+     `(("pkg-config" ,pkg-config)
+       ("glib:bin" ,glib "bin") ; for glib-mkenums
+       ("intltool" ,intltool)
+       ("gobject-introspection" ,gobject-introspection)))
+    (arguments
+     `(#:configure-flags '("--sysconfdir=/etc"
+                           "--enable-man-pages")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after
+          'unpack 'fix-introspection-install-dir
+          (lambda* (#:key outputs #:allow-other-keys)
+            (let ((out (assoc-ref outputs "out")))
+              (substitute* (find-files "." "Makefile.in")
+                (("@INTROSPECTION_GIRDIR@")
+                 (string-append out "/share/gir-1.0/"))
+                (("@INTROSPECTION_TYPELIBDIR@")
+                 (string-append out "/lib/girepository-1.0/"))))))
+         (replace
+          'install
+          (lambda* (#:key outputs (make-flags '()) #:allow-other-keys)
+            ;; Override sysconfdir during "make install", to avoid attempting
+            ;; to install in /etc, and to instead install the skeletons in the
+            ;; output directory.
+            (let ((out (assoc-ref outputs "out")))
+             (zero? (apply system*
+                           "make" "install"
+                           (string-append "sysconfdir=" out "/etc")
+                           (string-append "polkit_actiondir="
+                                          out "/share/polkit-1/actions")
+                           make-flags))))))))
     (home-page "http://www.freedesktop.org/wiki/Software/polkit/")
     (synopsis "Authorization API for privilege management")
     (description "Polkit is an application-level toolkit for defining and
-- 
2.4.3


[-- Attachment #4: 0005-gnu-Add-polkit-service.patch --]
[-- Type: text/plain, Size: 3940 bytes --]

From ec20ffc9bdad2d467ec0f7e76f1b7f7a92580eff Mon Sep 17 00:00:00 2001
From: Andy Wingo <wingo@pobox.com>
Date: Tue, 18 Aug 2015 11:57:15 +0200
Subject: [PATCH 5/7] gnu: Add polkit service.

* gnu/services/desktop.scm (polkit-service): New function.
  (%desktop-services): Add polkit service.
---
 gnu/services/desktop.scm | 51 +++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 46 insertions(+), 5 deletions(-)

diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 764954c..500933c 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -24,12 +24,14 @@
   #:use-module (gnu services xorg)
   #:use-module (gnu services networking)
   #:use-module (gnu system shadow)
+  #:use-module (gnu system linux) ; unix-pam-service
   #:use-module (gnu packages glib)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages avahi)
   #:use-module (gnu packages wicd)
+  #:use-module (gnu packages polkit)
   #:use-module (guix monads)
   #:use-module (guix store)
   #:use-module (guix gexp)
@@ -40,6 +42,7 @@
             geoclue-application
             %standard-geoclue-applications
             geoclue-service
+            polkit-service
             elogind-service
             %desktop-services))
 
@@ -376,6 +379,42 @@ site} for more information."
 
 \f
 ;;;
+;;; Polkit privilege management service.
+;;;
+
+(define* (polkit-service #:key (polkit polkit))
+  "Return a service that runs the @command{polkit} privilege management
+service.  By querying the @command{polkit} service, a privileged system
+component can know when it should grant additional capabilities to ordinary
+users.  For example, an ordinary user can be granted the capability to suspend
+the system if the user is logged in locally."
+  (with-monad %store-monad
+    (return
+     (service
+      (documentation "Run the polkit privilege management service.")
+      (provision '(polkit-daemon))
+      (requirement '(dbus-system))
+
+      (start #~(make-forkexec-constructor
+                (list (string-append #$polkit "/lib/polkit-1/polkitd"))))
+      (stop #~(make-kill-destructor))
+
+      (user-groups (list (user-group
+                          (name "polkitd")
+                          (system? #t))))
+      (user-accounts (list (user-account
+                            (name "polkitd")
+                            (group "polkitd")
+                            (system? #t)
+                            (comment "Polkit daemon user")
+                            (home-directory "/var/empty")
+                            (shell
+                             "/run/current-system/profile/sbin/nologin"))))
+
+      (pam-services (list (unix-pam-service "polkit-1")))))))
+
+\f
+;;;
 ;;; Elogind login and seat management service.
 ;;;
 
@@ -552,14 +591,16 @@ when they log out."
          (avahi-service)
          (wicd-service)
          (upower-service)
-         ;; FIXME: The colord and geoclue services could all be bus-activated
-         ;; by default, so they don't run at program startup.  However, user
-         ;; creation and /var/lib.colord creation happen at service activation
-         ;; time, so we currently add them to the set of default services.
+         ;; FIXME: The colord, geoclue, and polkit services could all be
+         ;; bus-activated by default, so they don't run at program startup.
+         ;; However, user creation and /var/lib/colord creation happen at
+         ;; service activation time, so we currently add them to the set of
+         ;; default services.
          (colord-service)
          (geoclue-service)
+         (polkit-service)
          (elogind-service)
-         (dbus-service (list avahi wicd upower colord geoclue elogind))
+         (dbus-service (list avahi wicd upower colord geoclue polkit elogind))
 
          (ntp-service)
 
-- 
2.4.3