diff options
| author | Colin Walters <walters@verbum.org> | 2013-08-19 12:16:11 -0400 |
|---|---|---|
| committer | Miloslav Trmač <mitr@redhat.com> | 2013-09-18 18:29:25 +0200 |
| commit | 3968411b0c7ba193f9b9276ec911692aec248608 (patch) | |
| tree | de9a4f0b3ad64a2f518220f8b5966f2939d7a1bd /src | |
| parent | 08291789a1f99d4ab29c74c39344304bcca43023 (diff) | |
| download | polkit-3968411b0c7ba193f9b9276ec911692aec248608.tar.gz | |
pkcheck: Support --process=pid,start-time,uid syntax too
The uid is a new addition; this allows callers such as libvirt to
close a race condition in reading the uid of the process talking to
them. They can read it via getsockopt(SO_PEERCRED) or equivalent,
rather than having pkcheck look at /proc later after the fact.
Programs which invoke pkcheck but need to know beforehand (i.e. at
compile time) whether or not it supports passing the uid can
use:
pkcheck_supports_uid=$($PKG_CONFIG --variable pkcheck_supports_uid polkit-gobject-1)
test x$pkcheck_supports_uid = xyes
Diffstat (limited to 'src')
| -rw-r--r-- | src/programs/pkcheck.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/programs/pkcheck.c b/src/programs/pkcheck.c index 9076693..11b2e26 100644 --- a/src/programs/pkcheck.c +++ b/src/programs/pkcheck.c @@ -44,7 +44,7 @@ help (void) " -d, --details=KEY VALUE Add (KEY, VALUE) to information about the action\n" " --enable-internal-agent Use an internal authentication agent if necessary\n" " --list-temp List temporary authorizations for current session\n" -" -p, --process=PID[,START_TIME] Check authorization of specified process\n" +" -p, --process=PID[,START_TIME,UID] Check authorization of specified process\n" " --revoke-temp Revoke all temporary authorizations for current session\n" " -s, --system-bus-name=BUS_NAME Check authorization of owner of BUS_NAME\n" " --version Show version\n" @@ -382,6 +382,7 @@ main (int argc, char *argv[]) else if (g_strcmp0 (argv[n], "--process") == 0 || g_strcmp0 (argv[n], "-p") == 0) { gint pid; + guint uid; guint64 pid_start_time; n++; @@ -392,7 +393,11 @@ main (int argc, char *argv[]) goto out; } - if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2) + if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT ",%u", &pid, &pid_start_time, &uid) == 3) + { + subject = polkit_unix_process_new_for_owner (pid, pid_start_time, uid); + } + else if (sscanf (argv[n], "%i,%" G_GUINT64_FORMAT, &pid, &pid_start_time) == 2) { subject = polkit_unix_process_new_full (pid, pid_start_time); } |