core: pass details to polkit for some unit actions
authorMichael Chapman <mike@very.puzzling.org>
Sat, 5 Sep 2015 14:07:17 +0000 (00:07 +1000)
committerMichael Chapman <mike@very.puzzling.org>
Sat, 5 Sep 2015 14:07:17 +0000 (00:07 +1000)
commit88ced61bf9673407f4b15bf51b1b408fd78c149d
treeb6cf57f054c3e65497b01100446a6667b3ef474d
parent403ed0e5c914f2a0a683403d8ba7eaf96e3ffcdf
core: pass details to polkit for some unit actions

The following details are passed:

- unit: the primary name of the unit upon which the action was
        invoked (i.e. after resolving any aliases);
- verb: one of 'start', 'stop', 'reload', 'restart', 'try-restart',
        'reload-or-restart', 'reload-or-try-restart', 'kill',
        'reset-failed', or 'set-property', corresponding to the
        systemctl verb used to invoke the action.

Typical use of these details in a polkit policy rule might be:

  // Allow alice to manage example.service;
  // fall back to implicit authorization otherwise.
  polkit.addRule(function(action, subject) {
      if (action.id == "org.freedesktop.systemd1.manage-units" &&
          action.lookup("unit") == "example.service" &&
          subject.user == "alice") {
          return polkit.Result.YES;
      }
  });

We also supply a custom polkit message that includes the unit's name and
the requested operation.
po/POTFILES.in
src/basic/util.h
src/core/dbus-unit.c
src/core/dbus.c
src/core/dbus.h