feat: Polkit authorization for linux-hello-polman (EPIC-17 gap) #29

New issue

Closed

opened 2026-07-29 10:59:49 +02:00 by elegos · 0 comments

elegos commented

2026-07-29 10:59:49 +02:00

Owner

Issue

docs/lld/polman.md:84,159: polkit authorization is deferred in the current linux-hello-polman implementation. Write operations currently require raw UID 0 — a direct nix::unistd::getuid() == 0 check.

Impact

Non-root administrators cannot be delegated policy-editing rights. The polkit policy file (polkit/name.giacomofurlan.linux_hello.policy) is present in the repo but not used for policy management authorization.

Fix

Add polkit check in linux-hello-polman for set and unset subcommands, using the name.giacomofurlan.linux_hello.set-trust-policy polkit action.
Add polkit check in the daemon's set_trust_policy D-Bus handler.
Define the polkit action in polkit/name.giacomofurlan.linux_hello.policy with appropriate allow_active / allow_admin_auth settings.

## Issue `docs/lld/polman.md:84,159`: polkit authorization is deferred in the current `linux-hello-polman` implementation. Write operations currently require raw UID 0 — a direct `nix::unistd::getuid() == 0` check. ## Impact Non-root administrators cannot be delegated policy-editing rights. The polkit policy file (`polkit/name.giacomofurlan.linux_hello.policy`) is present in the repo but not used for policy management authorization. ## Fix - Add polkit check in `linux-hello-polman` for `set` and `unset` subcommands, using the `name.giacomofurlan.linux_hello.set-trust-policy` polkit action. - Add polkit check in the daemon's `set_trust_policy` D-Bus handler. - Define the polkit action in `polkit/name.giacomofurlan.linux_hello.policy` with appropriate `allow_active` / `allow_admin_auth` settings.

elegos added this to the Foundation project

2026-07-29 11:00:02 +02:00

elegos

2026-07-29 11:20:46 +02:00