Projects
Eulaceura:Factory
kiran-authentication-service
_service:obs_scm:0003-fix-Interface-permission-...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:obs_scm:0003-fix-Interface-permission-Upgrade-the-permission-of-s.patch of Package kiran-authentication-service
From 74cff73678e966b232d70aba787476f34fa0d584 Mon Sep 17 00:00:00 2001 From: liuxinhao <liuxinhao@kylinsec.com.cn> Date: Tue, 30 May 2023 11:11:48 +0800 Subject: [PATCH 3/5] fix(Interface permission): Upgrade the permission of some interfaces of the authentication service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 提升部分认证服务接口权限至root，调用前需认证polkit Closes #I795QI --- data/com.kylinsec.Kiran.Authentication.xml | 7 ++- src/daemon/auth-manager.cpp | 66 ++++++++++++++-------- src/daemon/auth-manager.h | 46 ++++++++++----- src/daemon/user.cpp | 2 +- src/pam/authentication.cpp | 1 - 5 files changed, 82 insertions(+), 40 deletions(-) diff --git a/data/com.kylinsec.Kiran.Authentication.xml b/data/com.kylinsec.Kiran.Authentication.xml index b575ebd..12b077f 100644 --- a/data/com.kylinsec.Kiran.Authentication.xml +++ b/data/com.kylinsec.Kiran.Authentication.xml @@ -51,7 +51,7 @@ </arg> </method> - <method name="SetDrivereEanbled"> + <method name="SetDrivereEnabled"> <arg name="driver_name" direction="in" type="s"> <description>driver name</description> </arg> @@ -73,7 +73,7 @@ <arg name="auth_type" direction="in" type="i"> <description>The auth type. Refer to KADAuthType in kas-authentication-i.h</description> </arg> - <arg name="device_id" type="s"> + <arg name="device_id" direction="in" type="s"> <description>The default device ID.</description> </arg> </method> @@ -82,6 +82,9 @@ <arg name="auth_type" direction="in" type="i"> <description>The auth type. Refer to KADAuthType in kas-authentication-i.h</description> </arg> + <arg name="device_id" direction="out" type="s"> + <description>The default device ID.</description> + </arg> </method> <method name="SetAuthTypeEnabledForApp"> diff --git a/src/daemon/auth-manager.cpp b/src/daemon/auth-manager.cpp index 0a74682..7ebef89 100644 --- a/src/daemon/auth-manager.cpp +++ b/src/daemon/auth-manager.cpp @@ -21,6 +21,7 @@ #include "src/daemon/device/device-adaptor-factory.h" #include "src/daemon/error.h" #include "src/daemon/proxy/dbus-daemon-proxy.h" +#include "src/daemon/proxy/polkit-proxy.h" #include "src/daemon/session.h" #include "src/daemon/user-manager.h" #include "src/utils/utils.h" @@ -34,6 +35,9 @@ #include <QMetaEnum> #include <QSettings> #include <QTime> + +#define AUTH_USER_ADMIN "com.kylinsec.kiran.authentication.user-administration" + namespace Kiran { // 会话ID的最大值 @@ -85,7 +89,7 @@ QDBusObjectPath AuthManager::CreateSession(const QString &username, int timeout, .arg(authApp) .arg(this->message().service()) .arg(sessionID); - + return QDBusObjectPath(session->getObjectPath()); } @@ -108,15 +112,6 @@ QString AuthManager::GetDriversForType(int authType) return DeviceAdaptorFactory::getInstance()->getDriversForType(authType); } -void AuthManager::SetDrivereEanbled(const QString &driverName, bool enabled) -{ - if (!DeviceAdaptorFactory::getInstance()->setDrivereEanbled(driverName, enabled)) - { - DBUS_ERROR_REPLY(QDBusError::InternalError, - KADErrorCode::ERROR_FAILED); - } -} - QDBusObjectPath AuthManager::FindUserByID(qulonglong uid) { auto pwent = getpwuid(uid); @@ -164,21 +159,11 @@ bool AuthManager::GetAuthTypeEnabled(int authType) return m_authConfig->getAuthTypeEnable((KADAuthType)authType); } -void AuthManager::SetAuthTypeEnabled(int authType, bool enabled) -{ - m_authConfig->setAuthTypeEnable((KADAuthType)authType, enabled); -} - bool AuthManager::GetAuthTypeEnabledForApp(int authType, int authApp) { return m_authConfig->getAuthTypeEnabledForApp((KADAuthType)authType, (KADAuthApplication)authApp); } -void AuthManager::SetAuthTypeEnabledForApp(int authType, int authApp, bool enabled) -{ - m_authConfig->setAuthTypeEnabledForApp((KADAuthType)authType, (KADAuthApplication)authApp, enabled); -} - /// @brief 通过认证应用枚举获取支持的认证类型或认证顺序 /// @param authApp 应用程序所属的认证应用类型 /// @return 与模式下为需认证类型的认证顺序,或模式下为可选的认证类型 @@ -202,9 +187,9 @@ QList<int> AuthManager::GetAuthTypeByApp(int32_t authApp) auto sortedAuthTypes = authOrder; auto enabledAuthTypeIter = enabledAuthTypes.begin(); - while(enabledAuthTypeIter != enabledAuthTypes.end()) + while (enabledAuthTypeIter != enabledAuthTypes.end()) { - if(!sortedAuthTypes.contains(*enabledAuthTypeIter)) + if (!sortedAuthTypes.contains(*enabledAuthTypeIter)) { sortedAuthTypes << *enabledAuthTypeIter; } @@ -257,6 +242,10 @@ void AuthManager::onNameLost(const QString &serviceName) } } +CHECK_AUTH_WITH_2ARGS(AuthManager, SetDrivereEnabled, onSetDriverEnabled, AUTH_USER_ADMIN, const QString &, bool); +CHECK_AUTH_WITH_2ARGS(AuthManager, SetAuthTypeEnabled, onSetAuthTypeEnabled, AUTH_USER_ADMIN, int, bool); +CHECK_AUTH_WITH_3ARGS(AuthManager, SetAuthTypeEnabledForApp, onSetAuthTypeEnabledForApp, AUTH_USER_ADMIN, int, int, bool); + void AuthManager::init() { auto systemConnection = QDBusConnection::systemBus(); @@ -276,6 +265,11 @@ void AuthManager::init() connect(m_authConfig, SIGNAL(defaultDeviceChanged(int, QString)), this, SIGNAL(defaultDeviceChanged(int, QString))); } +QString AuthManager::calcAction(const QString &originAction) +{ + return AUTH_USER_ADMIN; +} + int32_t AuthManager::generateSessionID() { // 最多生成10次，超过次数则返回失败 @@ -288,4 +282,32 @@ int32_t AuthManager::generateSessionID() } return -1; } + +void AuthManager::onSetDriverEnabled(const QDBusMessage &message, const QString &driverName, bool enabled) +{ + if (!DeviceAdaptorFactory::getInstance()->setDrivereEanbled(driverName, enabled)) + { + DBUS_ERROR_REPLY_ASYNC(message, QDBusError::InternalError, KADErrorCode::ERROR_FAILED); + } + + auto replyMessage = message.createReply(); + QDBusConnection::systemBus().send(replyMessage); +} + +void AuthManager::onSetAuthTypeEnabled(const QDBusMessage &message, int authType, bool enabled) +{ + m_authConfig->setAuthTypeEnable((KADAuthType)authType, enabled); + + auto replyMessage = message.createReply(); + QDBusConnection::systemBus().send(replyMessage); +} + +void AuthManager::onSetAuthTypeEnabledForApp(const QDBusMessage &message, int authType, int authApp, bool enabled) +{ + m_authConfig->setAuthTypeEnabledForApp((KADAuthType)authType, (KADAuthApplication)authApp, enabled); + + auto replyMessage = message.createReply(); + QDBusConnection::systemBus().send(replyMessage); +} + } // namespace Kiran diff --git a/src/daemon/auth-manager.h b/src/daemon/auth-manager.h index 696dc96..e707e0b 100644 --- a/src/daemon/auth-manager.h +++ b/src/daemon/auth-manager.h @@ -48,46 +48,64 @@ public: int getMaxFailures(); public Q_SLOTS: // DBUS METHODS + /// normal + // 获取认证服务中用户DBUS对象 + QDBusObjectPath FindUserByID(qulonglong uid); + QDBusObjectPath FindUserByName(const QString &userName); + // 认证会话创建以及销毁 QDBusObjectPath CreateSession(const QString &userName, int timeout,int authApp); void DestroySession(uint sessionID); + // 根据认证类型获取驱动列表 QString GetDriversForType(int authType); - void SetDrivereEanbled(const QString& driverName,bool enabled); - // 获取认证服务中用户DBUS对象 - QDBusObjectPath FindUserByID(qulonglong uid); - QDBusObjectPath FindUserByName(const QString &userName); - - // 获取认证设备 + // 根据认证类型获取设备列表 QString GetDevicesForType(int authType); - // 获取默认认证设备 - QString GetDefaultDeviceID(int authType); - // 设置默认设备ID - void SetDefaultDeviceID(int authType, const QString &deviceID); - // 认证类型总开关 + // 获取认证类型是否启用 bool GetAuthTypeEnabled(int authType); - void SetAuthTypeEnabled(int authType,bool enabled); - // 获取/设置指定认证场景下认证类型的开关 + // 获取认证类型认证场景(认证应用)是否启用 bool GetAuthTypeEnabledForApp(int authType,int authApp); - void SetAuthTypeEnabledForApp(int authType, int authApp, bool enabled); + + // 默认设备 + QString GetDefaultDeviceID(int authType); + void SetDefaultDeviceID(int authType, const QString &deviceID); // 通过pam服务名查询属于哪个认证场景 + // 例如: + // lightdm->KAD_AUTH_APPLICATION_LOGIN, + // iran-screensaver->KAD_AUTH_APPLICATION_UNLOCK int QueryAuthApp(const QString &pamServiceName); + // 通过指定的认证应用获取支持的认证类型,返回值为有序列表 QList<int> GetAuthTypeByApp(int32_t authApp); void onNameLost(const QString &serviceName); + // root + // 设备驱动控制 + void SetDrivereEnabled(const QString& driverName,bool enabled); + + // 认证类型总开关 + void SetAuthTypeEnabled(int authType,bool enabled); + + // 获取/设置指定认证场景下认证类型的开关 + void SetAuthTypeEnabledForApp(int authType, int authApp, bool enabled); + signals: void defaultDeviceChanged(int authType,const QString& deviceID,QPrivateSignal); private: void init(); + // 需要管理员权限 + QString calcAction(const QString &originAction); // 生成一个唯一的会话ID int32_t generateSessionID(); + void onSetDriverEnabled(const QDBusMessage &message,const QString& driverName,bool enabled); + void onSetAuthTypeEnabled(const QDBusMessage &message,int authType,bool enabled); + void onSetAuthTypeEnabledForApp(const QDBusMessage &message,int authType, int authApp, bool enabled); private: static AuthManager *m_instance; diff --git a/src/daemon/user.cpp b/src/daemon/user.cpp index 1b77bf0..c9d98bb 100644 --- a/src/daemon/user.cpp +++ b/src/daemon/user.cpp @@ -290,7 +290,7 @@ void User::onDeleteIdentification(const QDBusMessage &message, const QString &ii if (!getIIDs().contains(iid)) { USER_WARNING() << "delete identification" << iid << "error,can not find!"; - DBUS_ERROR_REPLY_AND_RET(QDBusError::InvalidArgs, KADErrorCode::ERROR_INVALID_ARGUMENT); + DBUS_ERROR_REPLY_ASYNC_AND_RET(message,QDBusError::InvalidArgs, KADErrorCode::ERROR_INVALID_ARGUMENT); } USER_DEBUG() << "delete identification" << iid; diff --git a/src/pam/authentication.cpp b/src/pam/authentication.cpp index 192a1b1..6a165fd 100644 --- a/src/pam/authentication.cpp +++ b/src/pam/authentication.cpp @@ -42,7 +42,6 @@ Authentication::Authentication(PAMHandle *pamHandle, { } -// TODO polkit 认证 超时,未结束认证 Authentication::~Authentication() { if (this->m_authSessionProxy && this->m_authManagerProxy) -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2