Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

POC: Fix dbus using polkit #3349

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

POC: Fix dbus using polkit #3349

wants to merge 2 commits into from

Commits on Oct 30, 2023

  1. WIP: Fix D-Bus policy 

    * Non-root users should be able to call only methods providing
  data that are gathered from files readable by non-root users.
* Non-root users are not allowed to call methods changing
  the system (like, Register(), Unregister(), etc.) or obtaining
  sensitive data.
    @jirihnidek
    jirihnidek committed Oct 30, 2023
    Configuration menu
    Copy the full SHA
    9203738 View commit details
    Browse the repository at this point in the history

  2. WIP: Use polkit for some D-Bus methods 

    * Allow to call "register" and "unregister" D-Bus methods for
  non-root user, when the user is authorized using polkit
* This change will require to do some changes on selinux-policy.
  To test this with enforcing SELinux you can create local
  policy using following file (local_rhsmcertd_policykit.cil)
  containing following rules:

    (allow rhsmcertd_t policykit_t (dbus (send_msg)))
    (allow policykit_t rhsmcertd_t (dbus (send_msg)))

  Then you can run: `semodule -i local_rhsmcertd_policykit.cil`
* TODO: we should use more polkit action IDs. Not only one
  default
    @jirihnidek
    jirihnidek committed Oct 30, 2023
    Configuration menu
    Copy the full SHA
    15f2aee View commit details
    Browse the repository at this point in the history