New upstream version 1.22.0 upstream/1.22.0

1 files changed, 46 insertions, 60 deletions

diff --git a/src/nm-auth-manager.c b/src/nm-auth-manager.c
index 0663e207..3f248aee 100644
--- a/src/nm-auth-manager.c
+++ b/src/nm-auth-manager.c
@@ -1,19 +1,5 @@
-/* NetworkManager -- Network link manager
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
+// SPDX-License-Identifier: GPL-2.0+
+/*
  * Copyright (C) 2014 Red Hat, Inc.
  */
 
@@ -56,7 +42,7 @@ typedef struct {
 	guint changed_signal_id;
 	bool disposing:1;
 	bool shutting_down:1;
-	bool polkit_enabled_construct_only:1;
+	NMAuthPolkitMode auth_polkit_mode:3;
 } NMAuthManagerPrivate;
 
 struct _NMAuthManager {
@@ -124,11 +110,6 @@ typedef enum {
 	POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION = (1<<0),
 } PolkitCheckAuthorizationFlags;
 
-typedef enum {
-	IDLE_REASON_AUTHORIZED,
-	IDLE_REASON_NO_DBUS,
-} IdleReason;
-
 struct _NMAuthManagerCallId {
 	CList calls_lst;
 	NMAuthManager *self;
@@ -137,7 +118,7 @@ struct _NMAuthManagerCallId {
 	gpointer user_data;
 	guint64 call_numid;
 	guint idle_id;
-	IdleReason idle_reason:8;
+	bool idle_is_authorized:1;
 };
 
 #define cancellation_id_to_str_a(call_numid) \
@@ -276,25 +257,16 @@ static gboolean
 _call_on_idle (gpointer user_data)
 {
 	NMAuthManagerCallId *call_id = user_data;
-	gs_free_error GError *error = NULL;
-	gboolean is_authorized = FALSE;
+	gboolean is_authorized;
 	gboolean is_challenge = FALSE;
-	const char *error_msg = NULL;
 
+	is_authorized = call_id->idle_is_authorized;
 	call_id->idle_id = 0;
-	if (call_id->idle_reason == IDLE_REASON_AUTHORIZED) {
-		is_authorized = TRUE;
-		_LOG2T (call_id, "completed: authorized=%d, challenge=%d (simulated)",
-		        is_authorized, is_challenge);
-	} else {
-		nm_assert (call_id->idle_reason == IDLE_REASON_NO_DBUS);
-		error_msg = "failure creating GDBusProxy for authorization request";
-		_LOG2T (call_id, "completed: failed due to no D-Bus proxy");
-	}
 
-	if (error_msg)
-		g_set_error_literal (&error, NM_UTILS_ERROR, NM_UTILS_ERROR_UNKNOWN, error_msg);
-	_call_id_invoke_callback (call_id, is_authorized, is_challenge, error);
+	_LOG2T (call_id, "completed: authorized=%d, challenge=%d (simulated)",
+	        is_authorized, is_challenge);
+
+	_call_id_invoke_callback (call_id, is_authorized, is_challenge, NULL);
 	return G_SOURCE_REMOVE;
 }
 
@@ -342,24 +314,24 @@ nm_auth_manager_check_authorization (NMAuthManager *self,
 
 	call_id = g_slice_new (NMAuthManagerCallId);
 	*call_id = (NMAuthManagerCallId) {
-		.self       = g_object_ref (self),
-		.callback   = callback,
-		.user_data  = user_data,
-		.call_numid = ++priv->call_numid_counter,
+		.self               = g_object_ref (self),
+		.callback           = callback,
+		.user_data          = user_data,
+		.call_numid         = ++priv->call_numid_counter,
+		.idle_is_authorized = TRUE,
 	};
 	c_list_link_tail (&priv->calls_lst_head, &call_id->calls_lst);
 
-	if (!priv->dbus_connection) {
-		_LOG2T (call_id, "CheckAuthorization(%s), subject=%s (succeeding due to polkit authorization disabled)", action_id, nm_auth_subject_to_string (subject, subject_buf, sizeof (subject_buf)));
-		call_id->idle_reason = IDLE_REASON_AUTHORIZED;
-		call_id->idle_id = g_idle_add (_call_on_idle, call_id);
-	} else if (nm_auth_subject_is_internal (subject)) {
+	if (nm_auth_subject_is_internal (subject)) {
 		_LOG2T (call_id, "CheckAuthorization(%s), subject=%s (succeeding for internal request)", action_id, nm_auth_subject_to_string (subject, subject_buf, sizeof (subject_buf)));
-		call_id->idle_reason = IDLE_REASON_AUTHORIZED;
 		call_id->idle_id = g_idle_add (_call_on_idle, call_id);
 	} else if (nm_auth_subject_get_unix_process_uid (subject) == 0) {
 		_LOG2T (call_id, "CheckAuthorization(%s), subject=%s (succeeding for root)", action_id, nm_auth_subject_to_string (subject, subject_buf, sizeof (subject_buf)));
-		call_id->idle_reason = IDLE_REASON_AUTHORIZED;
+		call_id->idle_id = g_idle_add (_call_on_idle, call_id);
+	} else if (priv->auth_polkit_mode != NM_AUTH_POLKIT_MODE_USE_POLKIT) {
+		_LOG2T (call_id, "CheckAuthorization(%s), subject=%s (PolicyKit disabled and always %s authorization to non-root user)", action_id, nm_auth_subject_to_string (subject, subject_buf, sizeof (subject_buf)),
+		        priv->auth_polkit_mode == NM_AUTH_POLKIT_MODE_ALLOW_ALL ? "grant" : "deny");
+		call_id->idle_is_authorized = (priv->auth_polkit_mode == NM_AUTH_POLKIT_MODE_ALLOW_ALL);
 		call_id->idle_id = g_idle_add (_call_on_idle, call_id);
 	} else {
 		GVariant *parameters;
@@ -494,11 +466,17 @@ static void
 set_property (GObject *object, guint prop_id, const GValue *value, GParamSpec *pspec)
 {
 	NMAuthManagerPrivate *priv = NM_AUTH_MANAGER_GET_PRIVATE ((NMAuthManager *) object);
+	int v_int;
 
 	switch (prop_id) {
 	case PROP_POLKIT_ENABLED:
 		/* construct-only */
-		priv->polkit_enabled_construct_only = !!g_value_get_boolean (value);
+		v_int = g_value_get_int (value);
+		g_return_if_fail (NM_IN_SET (v_int, NM_AUTH_POLKIT_MODE_ROOT_ONLY,
+		                                    NM_AUTH_POLKIT_MODE_ALLOW_ALL,
+		                                    NM_AUTH_POLKIT_MODE_USE_POLKIT));
+		priv->auth_polkit_mode = v_int;
+		nm_assert (priv->auth_polkit_mode == v_int);
 		break;
 	default:
 		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
@@ -514,6 +492,7 @@ nm_auth_manager_init (NMAuthManager *self)
 	NMAuthManagerPrivate *priv = NM_AUTH_MANAGER_GET_PRIVATE (self);
 
 	c_list_init (&priv->calls_lst_head);
+	priv->auth_polkit_mode = NM_AUTH_POLKIT_MODE_ROOT_ONLY;
 }
 
 static void
@@ -526,8 +505,11 @@ constructed (GObject *object)
 
 	G_OBJECT_CLASS (nm_auth_manager_parent_class)->constructed (object);
 
-	if (!priv->polkit_enabled_construct_only) {
-		create_message = "polkit disabled";
+	if (priv->auth_polkit_mode != NM_AUTH_POLKIT_MODE_USE_POLKIT) {
+		if (priv->auth_polkit_mode == NM_AUTH_POLKIT_MODE_ROOT_ONLY)
+			create_message = "polkit disabled, root-only";
+		else
+			create_message = "polkit disabled, allow-all";
 		goto out;
 	}
 
@@ -536,7 +518,8 @@ constructed (GObject *object)
 	if (!priv->dbus_connection) {
 		/* This warrants an info level message. */
 		logl = LOGL_INFO;
-		create_message = "D-Bus connection not available. Polkit is disabled and all requests are authenticated.";
+		create_message = "D-Bus connection not available. Polkit is disabled and only root will be authorized.";
+		priv->auth_polkit_mode = NM_AUTH_POLKIT_MODE_ROOT_ONLY;
 		goto out;
 	}
 
@@ -560,14 +543,17 @@ out:
 }
 
 NMAuthManager *
-nm_auth_manager_setup (gboolean polkit_enabled)
+nm_auth_manager_setup (NMAuthPolkitMode auth_polkit_mode)
 {
 	NMAuthManager *self;
 
 	g_return_val_if_fail (!singleton_instance, singleton_instance);
+	nm_assert (NM_IN_SET (auth_polkit_mode, NM_AUTH_POLKIT_MODE_ROOT_ONLY,
+	                                        NM_AUTH_POLKIT_MODE_ALLOW_ALL,
+	                                        NM_AUTH_POLKIT_MODE_USE_POLKIT));
 
 	self = g_object_new (NM_TYPE_AUTH_MANAGER,
-	                     NM_AUTH_MANAGER_POLKIT_ENABLED, polkit_enabled,
+	                     NM_AUTH_MANAGER_POLKIT_ENABLED, (int) auth_polkit_mode,
 	                     NULL);
 	_LOGD ("set instance");
 
@@ -612,11 +598,11 @@ nm_auth_manager_class_init (NMAuthManagerClass *klass)
 	object_class->dispose = dispose;
 
 	obj_properties[PROP_POLKIT_ENABLED] =
-	     g_param_spec_boolean (NM_AUTH_MANAGER_POLKIT_ENABLED, "", "",
-	                           FALSE,
-	                           G_PARAM_WRITABLE |
-	                           G_PARAM_CONSTRUCT_ONLY |
-	                           G_PARAM_STATIC_STRINGS);
+	     g_param_spec_int (NM_AUTH_MANAGER_POLKIT_ENABLED, "", "",
+	                       NM_AUTH_POLKIT_MODE_ROOT_ONLY, NM_AUTH_POLKIT_MODE_USE_POLKIT, NM_AUTH_POLKIT_MODE_USE_POLKIT,
+	                       G_PARAM_WRITABLE |
+	                       G_PARAM_CONSTRUCT_ONLY |
+	                       G_PARAM_STATIC_STRINGS);
 
 	g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties);