pkcheck: Support --process=pid,start-time,uid syntax too

The uid is a new addition; this allows callers such as libvirt to
close a race condition in reading the uid of the process talking to
them.  They can read it via getsockopt(SO_PEERCRED) or equivalent,
rather than having pkcheck look at /proc later after the fact.

Programs which invoke pkcheck but need to know beforehand (i.e.  at
compile time) whether or not it supports passing the uid can
use:

pkcheck_supports_uid=$($PKG_CONFIG --variable pkcheck_supports_uid polkit-gobject-1)
test x$pkcheck_supports_uid = xyes

diff --git a/data/polkit-gobject-1.pc.in b/data/polkit-gobject-1.pc.in
index c39677ddf52f747032c64472445483ed0b6cc47e..5c4c62072f805e1fd3b20a1c2a0f385c2c609785 100644 (file)
--- a/data/polkit-gobject-1.pc.in
+++ b/data/polkit-gobject-1.pc.in
@@ -11,3 +11,6 @@ Version: @VERSION@
 Libs: -L${libdir} -lpolkit-gobject-1
 Cflags: -I${includedir}/polkit-1
 Requires: gio-2.0 >= 2.18 glib-2.0 >= 2.18
+# Programs using pkcheck can use this to determine
+# whether or not it can be passed a uid.
+pkcheck_supports_uid=true

diff --git a/docs/man/pkcheck.xml b/docs/man/pkcheck.xml
index fc540548714e9709f9fa09b1bfdf8c70e5681cd8..c856ca43e7229b7cddcf2198a309e7597e10fa5e 100644 (file)
--- a/docs/man/pkcheck.xml
+++ b/docs/man/pkcheck.xml
@@ -55,6 +55,9 @@
             <arg choice="plain">
               <replaceable>pid,pid-start-time</replaceable>
             </arg>
+            <arg choice="plain">
+              <replaceable>pid,pid-start-time,uid</replaceable>
+            </arg>
           </group>
         </arg>
         <arg choice="plain">
@@ -90,7 +93,7 @@
     <title>DESCRIPTION</title>
     <para>
       <command>pkcheck</command> is used to check whether a process, specified by
-      either <option>--process</option> or <option>--system-bus-name</option>,
+      either <option>--process</option> (see below) or <option>--system-bus-name</option>,
       is authorized for <replaceable>action</replaceable>. The <option>--detail</option>
       option can be used zero or more times to pass details about <replaceable>action</replaceable>.
       If <option>--allow-user-interaction</option> is passed, <command>pkcheck</command> blocks
@@ -160,15 +163,23 @@ KEY3=VALUE3
   <refsect1 id="pkcheck-notes">
     <title>NOTES</title>
     <para>
-      Since process identifiers can be recycled, the caller should always use
-      <replaceable>pid,pid-start-time</replaceable> to specify the process
-      to check for authorization when using the <option>--process</option> option.
-      The value of <replaceable>pid-start-time</replaceable>
-      can be determined by consulting e.g. the
+      Do not use either the bare <replaceable>pid</replaceable> or
+      <replaceable>pid,start-time</replaceable> syntax forms for
+      <option>--process</option>.  There are race conditions in both.
+      New code should always use
+      <replaceable>pid,pid-start-time,uid</replaceable>.  The value of
+      <replaceable>start-time</replaceable> can be determined by
+      consulting e.g. the
       <citerefentry><refentrytitle>proc</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-      file system depending on the operating system. If only <replaceable>pid</replaceable>
-      is passed to the <option>--process</option> option, then <command>pkcheck</command>
-      will look up the start time itself but note that this may be racy.
+      file system depending on the operating system.  If fewer than 3
+      arguments are passed, <command>pkcheck</command> will attempt to
+      look up them up internally, but note that this may be racy.
+    </para>
+    <para>
+      If your program is a daemon with e.g. a custom Unix domain
+      socket, you should determine the <replaceable>uid</replaceable>
+      parameter via operating system mechanisms such as
+      <literal>PEERCRED</literal>.
     </para>
   </refsect1>
 

diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c
index 9076693fd4d3b9141c89509fc284108fbd251686..11b2e26cf067b15db75be655a8840030b85c4bec 100644 (file)
--- a/src/programs/pkcheck.c
+++ b/src/programs/pkcheck.c
@@ -44,7 +44,7 @@ help (void)
 "  -d, --details=KEY VALUE            Add (KEY, VALUE) to information about the action\n"
 "  --enable-internal-agent            Use an internal authentication agent if necessary\n"
 "  --list-temp                        List temporary authorizations for current session\n"
-"  -p, --process=PID[,START_TIME]     Check authorization of specified process\n"
+"  -p, --process=PID[,START_TIME,UID] Check authorization of specified process\n"
 "  --revoke-temp                      Revoke all temporary authorizations for current session\n"
 "  -s, --system-bus-name=BUS_NAME     Check authorization of owner of BUS_NAME\n"
 "  --version                          Show version\n"
@@ -382,6 +382,7 @@ main (int argc, char *argv[])
       else if (g_strcmp0 (argv[n], "--process") == 0 || g_strcmp0 (argv[n], "-p") == 0)
         {
           gint pid;
+         guint uid;
           guint64 pid_start_time;
 
           n++;
@@ -392,7 +393,11 @@ main (int argc, char *argv[])
               goto out;
             }
 
-          if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2)
+          if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT ",%u", &pid, &pid_start_time, &uid) == 3)
+            {
+              subject = polkit_unix_process_new_for_owner (pid, pid_start_time, uid);
+            }
+          else if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2)
             {
               subject = polkit_unix_process_new_full (pid, pid_start_time);
             }