From 587deddf80b2ad72d1ff21a2d5858c720303106c Mon Sep 17 00:00:00 2001 From: David Zeuthen Date: Thu, 24 May 2012 15:50:59 -0400 Subject: [PATCH] Clarify pkexec(1) variables Signed-off-by: David Zeuthen --- actions/org.freedesktop.policykit.policy.in | 25 +++++----------- docs/man/pkexec.xml | 30 ++++++++++++++----- docs/man/polkit.xml | 6 ++-- ...esktop.policykit.examples.pkexec.policy.in | 13 ++++---- src/programs/pkexec.c | 6 ++-- 5 files changed, 42 insertions(+), 38 deletions(-) diff --git a/actions/org.freedesktop.policykit.policy.in b/actions/org.freedesktop.policykit.policy.in index 23608ee..7400b08 100644 --- a/actions/org.freedesktop.policykit.policy.in +++ b/actions/org.freedesktop.policykit.policy.in @@ -1,16 +1,15 @@ - - + + - + - The PolicyKit Project - http://hal.freedesktop.org/docs/PolicyKit/ + The polkit project + http://www.freedesktop.org/wiki/Software/polkit/ - <_description>Run programs as another user + <_description>Run a program as another user <_message>Authentication is required to run a program as another user auth_admin @@ -19,14 +18,4 @@ - - <_description>Configure lock down for an action - <_message>Authentication is required to configure lock down policy - - no - no - auth_admin - - /usr/bin/pklalockdown - diff --git a/docs/man/pkexec.xml b/docs/man/pkexec.xml index d84aa1d..236f9f1 100644 --- a/docs/man/pkexec.xml +++ b/docs/man/pkexec.xml @@ -82,8 +82,8 @@ SECURITY NOTES Executing a program as another user is a privileged - operation. By default the required authorization (See - ) requires administrator + operation. By default the action to check for (see + ) requires administrator authentication. In addition, the authentication dialog presented to the user will display the full path to the program to be executed so the user is aware of what will happen. @@ -125,7 +125,7 @@ - REQUIRED AUTHORIZATIONS + ACTION AND AUTHORIZATIONS By default, the org.freedesktop.policykit.exec action is @@ -134,10 +134,13 @@ annotation on an action with the value set to the full path of the program. In addition to specifying the program, the authentication message, description, icon and defaults can be - specified. The strings $(user), - $(program) and - $(command_line) in the message will be - expanded, see . + specified. + + + Note that authentication messages may reference variables (see + ), for example + $(user) will be expanded to the value of the + user variable. @@ -178,7 +181,7 @@ - user_full + user.gecos The full name of the user to execute the program as. @@ -186,6 +189,17 @@ + + user.display + + + A representation of the user to execute the program as + that is suitable for display in an authentication dialog. + Is typically set to a combination of the user name and the + full name. + + + diff --git a/docs/man/polkit.xml b/docs/man/polkit.xml index 9718541..bd39299 100644 --- a/docs/man/polkit.xml +++ b/docs/man/polkit.xml @@ -486,7 +486,7 @@ System Context | | polkit object (of type Polkit). - + The <type>Polkit</type> type @@ -616,10 +616,10 @@ polkit.addRule(function(action, subject) { }); ]]> - will produce the following when the user runs 'pkexec bash -i' from a shelll: + will produce the following when the user runs 'pkexec -u bateman bash -i' from a shell: diff --git a/src/examples/org.freedesktop.policykit.examples.pkexec.policy.in b/src/examples/org.freedesktop.policykit.examples.pkexec.policy.in index 9c05b77..049c024 100644 --- a/src/examples/org.freedesktop.policykit.examples.pkexec.policy.in +++ b/src/examples/org.freedesktop.policykit.examples.pkexec.policy.in @@ -1,15 +1,14 @@ - + - Examples for the PolicyKit Project - http://hal.freedesktop.org/docs/PolicyKit/ + Examples for the polkit project + http://www.freedesktop.org/wiki/Software/polkit/ - <_description>Run the PolicyKit example program Frobnicate - <_message>Authentication is required to run the PolicyKit example program Frobnicate (user=$(user), program=$(program), command_line=$(command_line)) + <_description>Run the polkit example program Frobnicate + <_message>Authentication is required to run the polkit example program Frobnicate (user=$(user), user.gecos=$(user.gecos), user.display=$(user.display), program=$(program), command_line=$(command_line)) audio-x-generic no diff --git a/src/programs/pkexec.c b/src/programs/pkexec.c index db13cf9..d87825c 100644 --- a/src/programs/pkexec.c +++ b/src/programs/pkexec.c @@ -669,11 +669,13 @@ main (int argc, char *argv[]) details = polkit_details_new (); polkit_details_insert (details, "user", pw->pw_name); + if (pw->pw_gecos != NULL) + polkit_details_insert (details, "user.gecos", pw->pw_gecos); if (pw->pw_gecos != NULL && strlen (pw->pw_gecos) > 0) s = g_strdup_printf ("%s (%s)", pw->pw_gecos, pw->pw_name); else s = g_strdup_printf ("%s", pw->pw_name); - polkit_details_insert (details, "user_full", s); + polkit_details_insert (details, "user.display", s); g_free (s); polkit_details_insert (details, "program", path); polkit_details_insert (details, "command_line", command_line); @@ -696,7 +698,7 @@ main (int argc, char *argv[]) * be expanded to the path of the program e.g. "/bin/bash" and the latter * to the user e.g. "John Doe (johndoe)" or "johndoe". */ - N_("Authentication is needed to run `$(program)' as user $(user)")); + N_("Authentication is needed to run `$(program)' as user $(user.display)")); } } polkit_details_insert (details, "polkit.gettext_domain", GETTEXT_PACKAGE); -- 2.34.1