summaryrefslogtreecommitdiff
path: root/docs
Commit message (Collapse)AuthorAgeFilesLines
* State that authorization rules must not rely on SpiderMonkey featureswip/js-rule-filesDavid Zeuthen2012-06-041-5/+13
| | | | | | ... e.g. we reserve the right to switch out the JS engine. Signed-off-by: David Zeuthen <zeuthen@gmail.com>
* Small updates to the "Writing polkit applications" chapterDavid Zeuthen2012-06-041-74/+161
| | | | Signed-off-by: David Zeuthen <zeuthen@gmail.com>
* Update pkexec(1) man page with exampleDavid Zeuthen2012-06-041-0/+1
| | | | Signed-off-by: David Zeuthen <zeuthen@gmail.com>
* Update links to udisks docsDavid Zeuthen2012-06-041-4/+2
| | | | Signed-off-by: David Zeuthen <zeuthen@gmail.com>
* Rewrite the "Writing polkit applications" chapterDavid Zeuthen2012-05-251-38/+142
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Run polkitd as an unprivileged userDavid Zeuthen2012-05-252-3/+20
| | | | | | There's really no reason to run all this code as uid 0. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Remove unused DBUS_GLIB_* and GIO_* variablesDavid Zeuthen2012-05-251-4/+0
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Clarify pkexec(1) variablesDavid Zeuthen2012-05-242-11/+25
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Combine action and details parametersDavid Zeuthen2012-05-241-175/+204
| | | | | | | | | | This also removes the ability to change detail parameters which is actually a good thing. If we later need a way to change the authentication message, we can always add something like polkit.addAuthenticationMessageRule() so the user can register a function returning a string. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Terminate runaway scriptsDavid Zeuthen2012-05-241-0/+7
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Mention systemd(1) in the polkitd(8) man pageDavid Zeuthen2012-05-231-3/+11
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Nuke polkitbackend library, localauthority backend and extension systemDavid Zeuthen2012-05-235-133/+1
| | | | | | | | | | | Any backend can now be implemented in JavaScript (if so desired) so we don't need any of this any more. Note that the libpolkitbackend library was never declared stable (the preprocessor symbol POLKIT_BACKEND_I_KNOW_API_IS_SUBJECT_TO_CHANGE had to be defined) so removing it is not an API/ABI break. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Add real-world example featuring udisks2 and the drive.* variables it passesDavid Zeuthen2012-05-231-1/+25
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Use <variablelist> instead of <informaltable> for Subject attributesDavid Zeuthen2012-05-231-48/+64
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Mention details["polkit.message"] and add an example using detailsDavid Zeuthen2012-05-231-5/+48
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Fix a couple typos in the docsDavid Zeuthen2012-05-233-5/+5
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Fix spelingDavid Zeuthen2012-05-221-1/+1
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* polkitd: add reference to polkit(8) from its man pageDavid Zeuthen2012-05-221-1/+4
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Clarify docs a bitDavid Zeuthen2012-05-221-8/+6
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* docs: update SEE ALSO to make each man page point to all other man pagesDavid Zeuthen2012-05-225-8/+16
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* docs: enclose local <citerefentry> in <link> to make links workDavid Zeuthen2012-05-226-78/+29
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Update docsDavid Zeuthen2012-05-2216-871/+567
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Mention unix-netgroup:xyz as a valid return value in addAdminRule() functionsDavid Zeuthen2012-05-211-1/+2
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Minor doc fixesDavid Zeuthen2012-05-211-7/+4
| | | | | | Nuke the has_prefix() helper, it's just confusing. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Add netgroup supportDavid Zeuthen2012-05-211-0/+15
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* docs: emphasize that registered functions may actually never be calledDavid Zeuthen2012-05-211-2/+11
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* docs: clarify how rules files workDavid Zeuthen2012-05-211-20/+51
| | | | | | After feedback from Matthias Clasen <mclasen@redhat.com>. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Also add an example of polkit.spawn() to polkit(8) man pageDavid Zeuthen2012-05-201-0/+20
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* docs: add AUTHORIZATION RULES section to the polkit(8) man pageDavid Zeuthen2012-05-201-0/+238
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Update the docs to use 'polkit' (instead of 'PolicyKit') as the nameDavid Zeuthen2012-04-242-68/+25
| | | | | | | | | | | ... as much as possible. Also remove the license on the docs and the FSF's address. Also point to http://www.freedesktop.org/software/polkit/docs/latest/ as that is going to be where docs are stored, going forward. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Mention pkttyagent(1) in "Writing PolicyKit applications" chapterDavid Zeuthen2012-04-241-4/+3
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Fix type in docsDavid Zeuthen2012-04-121-4/+4
| | | | | | | It's RegisterAuthenticationAgentWithOptions, not just RegisterAuthenticationAgent. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Make it possible to influence agent registration with an a{sv} parameterDavid Zeuthen2012-04-123-0/+33
| | | | | | | | | | | Additionally, add a "fallback" option. Also add support in this in the pkttyagent(1) program. This slightly breaks libpolkit-backend API by adding a GVariant* param to one of the class vfuncs... but that API is already declared unstable so that's fine. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Add pkttyagent(1) helperDavid Zeuthen2012-04-118-0/+182
| | | | | | | | | | | This came up while working on https://bugzilla.redhat.com/show_bug.cgi?id=804088 and is useful for example if it's not suitable or appropriate to link against the polkit libraries. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 43610 - Add netgroup supportNikki VonHollen2011-12-224-3/+26
| | | | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=43610 Added netgroup support and additional unit tests with MockLibc support. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Default to AdminIdentities=unix-group:wheel for local authorityDavid Zeuthen2011-12-061-2/+2
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Mistype in DBus object: PoliycKit1 -> PolicyKit1Alan Near2011-11-171-1/+1
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 41025 – Add org.freedesktop.policykit.owner annotationDavid Zeuthen2011-10-181-0/+13
| | | | | | | | | | This allows daemons running as a designated uid to check authorizations. Based on a patch from Christopher James Halse Rogers <chalserogers@gmail.com>. https://bugs.freedesktop.org/show_bug.cgi?id=41025 Signed-off-by: David Zeuthen <davidz@redhat.com>
* Add support for the org.freedesktop.policykit.imply annotationDavid Zeuthen2011-09-201-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For example, GNOME control center can now defined e.g. <action id="org.zee.example.meta"> <description>Meta Action</description> <message>Example of a meta action, blabla</message> <defaults> <allow_any>no</allow_any> <allow_inactive>no</allow_inactive> <allow_active>auth_admin_keep</allow_active> </defaults> <annotate key="org.freedesktop.policykit.imply">org.freedesktop.udisks2.ata-smart-selftest org.freedesktop.udisks2.encrypted-lock-others org.freedesktop.udisks2.filesystem-unmount-others</annotate> </action> and set up a single GtkLockButton for a PolkitPermission for action id "org.zee.example.meta". When unlocked the given subject will now be authorized for the actions mentioned in the annotation. Example test program: int main (int argc, char *argv[]) { PolkitSubject *subject; GtkWidget *window; GtkWidget *table; GMainLoop *loop; guint n; gtk_init (&argc, &argv); subject = polkit_unix_process_new (getpid ()); window = gtk_window_new (GTK_WINDOW_TOPLEVEL); table = gtk_table_new (1, 2, FALSE); for (n = 1; n < argc; n++) { const gchar *action_id = argv[n]; GPermission *permission; GtkWidget *label; GtkWidget *lock_button; GError *error = NULL; label = gtk_label_new (action_id); permission = polkit_permission_new_sync (action_id, subject, NULL, &error); if (permission == NULL) { g_error ("Error constructing permission for action_id %s: %s (%s, %d)", action_id, error->message, g_quark_to_string (error->domain), error->code); goto out; } lock_button = gtk_lock_button_new (permission); g_object_unref (permission); gtk_table_attach (GTK_TABLE (table), label, 0, 1, n - 1, n, GTK_FILL, GTK_FILL, 0, 0); gtk_table_attach (GTK_TABLE (table), lock_button, 1, 2, n - 1, n, GTK_FILL, GTK_FILL, 0, 0); } gtk_container_add (GTK_CONTAINER (window), table); gtk_widget_show_all (window); loop = g_main_loop_new (NULL, FALSE); g_main_loop_run (loop); out: ; } Compile with: gcc -o showpolkit showpolkit.c `pkg-config --cflags --libs polkit-gobject-1 gtk+-3.0` -g -O0 Run with: ./showpolkit org.freedesktop.udisks2.ata-smart-selftest org.freedesktop.udisks2.encrypted-lock-others org.freedesktop.udisks2.filesystem-unmount-others org.zee.example.meta Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 38769 — pkexec: Support running X11 appsMartin Pitt2011-08-011-2/+6
| | | | | | | | | | | | | | Introduce a new annotation flag "org.freedesktop.policykit.exec.allow_gui" which will cause pkexec to preserve $DISPLAY and $XAUTHORITY. With this, the remaining few legacy X11 programs which still need to run as root can finally be migrated away from gksu (or similar) to pkexec, with the help of some .polkit files. This will provide a consistent UI and also help with making the authentication dialogs less spoofable. Relax validate_environment_variable() to allow '/' in $XAUTHORITY, as this variable actually is a full path. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Make PolkitUnixProcess also record the uid of the processDavid Zeuthen2011-04-011-2/+5
| | | | | | | This is needed to avoid possible TOCTTOU issues since a process can change both its real uid and effective uid. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Deprecated PolkitBackendActionLookupDavid Zeuthen2011-03-035-26/+59
| | | | | | | | | | | | | | | | | | | | Instead, pass the untranslated message as polkit.message and set the gettext domain on polkit.gettext_domain. For printf()-style messages, occurences of the form $(name_of_key) in the translated version of polkit.message are expanded with the value of the property name_of_key. See the pkexec(1) mechanism for an example of how to use this. Additionally, the property polkit.icon_name can be set to the icon. Note that not all authentication agents use this - in particular, gnome-shell does not. It is no longer possible to set the details to be shown in the authentication dialog. It was never a good idea to hide information there anyway. Instead, the mechanism should format a meaningful message. Signed-off-by: David Zeuthen <davidz@redhat.com>
* Allow overriding message shown in authentication dialogDavid Zeuthen2011-02-231-0/+13
| | | | | | | | | | This is much easier than writing a PolkitBackendActionLookup class and installing an extension. On the downside it requires the caller to be uid 0. Example: http://people.freedesktop.org/~david/polkit-pass-messages.png Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 29712 – Use monotonic for temporary authorizationsDavid Zeuthen2011-02-231-0/+2
| | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=29712 Signed-off-by: David Zeuthen <davidz@redhat.com>
* pkcheck: Make it possible to list and revoke temporary authorizationsDavid Zeuthen2011-02-231-0/+16
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Make pkcheck(1) report if the authentication dialog was dismissedDavid Zeuthen2011-02-231-0/+7
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 32334 – Always set polkit.retains_authorization_after_challengeDavid Zeuthen2011-02-231-1/+1
| | | | | | | | Otherwise it's impossible to implement lock buttons. https://bugs.freedesktop.org/show_bug.cgi?id=32334 Signed-off-by: David Zeuthen <davidz@redhat.com>
* Bug 30653 – No way to detect cancellation in pkexecDavid Zeuthen2011-02-224-4/+24
| | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=30653 Signed-off-by: David Zeuthen <davidz@redhat.com>
* Pass caller and subject pid to authentication agentDavid Zeuthen2011-02-211-1/+3
| | | | | | | | The authentication agent can use information this to inform the user about the UI application that triggered the authentication request (if any). Signed-off-by: David Zeuthen <davidz@redhat.com>
* Add a note about POLKIT_DEBUGDavid Zeuthen2011-02-211-0/+5
| | | | Signed-off-by: David Zeuthen <davidz@redhat.com>
View Lorry Controller Status