Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

POC: Fix dbus using polkit #3349

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

POC: Fix dbus using polkit #3349

wants to merge 2 commits into from

Conversation

jirihnidek
Copy link
Contributor

  • Experiment with Polkit, but it does not work from UX perspective

@cnsnyder cnsnyder requested review from a team and cnsnyder and removed request for a team October 30, 2023 13:41
@jirihnidek
WIP: Fix D-Bus policy
9203738 
* Non-root users should be able to call only methods providing
  data that are gathered from files readable by non-root users.
* Non-root users are not allowed to call methods changing
  the system (like, Register(), Unregister(), etc.) or obtaining
  sensitive data.
@jirihnidek
WIP: Use polkit for some D-Bus methods
15f2aee 
* Allow to call "register" and "unregister" D-Bus methods for
  non-root user, when the user is authorized using polkit
* This change will require to do some changes on selinux-policy.
  To test this with enforcing SELinux you can create local
  policy using following file (local_rhsmcertd_policykit.cil)
  containing following rules:

    (allow rhsmcertd_t policykit_t (dbus (send_msg)))
    (allow policykit_t rhsmcertd_t (dbus (send_msg)))

  Then you can run: `semodule -i local_rhsmcertd_policykit.cil`
* TODO: we should use more polkit action IDs. Not only one
  default
@github-actions
Copy link

github-actions bot commented Oct 30, 2023 •
edited
Loading

Coverage

Coverage (computed on Fedora latest) •
FileStmtsMissCoverMissing
rhsmlib
   client_info.py401562%43, 52–53, 63–66, 68–69, 76–78, 80–81, 88
rhsmlib/dbus
   util.py866030%42–49, 55–58, 60–61, 63–64, 66–68, 70–71, 82, 84–87, 89–90, 92, 105–108, 110, 125, 127–130, 132–134, 136–137, 139, 141, 150–154, 156, 158–159, 161–164, 166, 173
rhsmlib/dbus/objects
   register.py2046070%36, 88–89, 100–102, 104–105, 116–118, 120, 134, 137, 150, 153, 192, 201, 239–240, 247, 283, 329–331, 333–334, 353–356, 358–360, 362, 364, 366, 381, 385, 404–409, 411–413, 415, 417, 429–433, 435–437, 439, 441
   unregister.py371364%32, 47–51, 54, 67–68, 85–86, 88, 90
TOTAL18211461274% 

Tests Skipped Failures Errors Time
2640 9 💤 0 ❌ 0 🔥 49.652s ⏱️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cnsnyder cnsnyder Awaiting requested review from cnsnyder cnsnyder was automatically assigned from candlepin/client-tools

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@jirihnidek