Visitar URL original
polkitd: add support for INI config file and use it for auth expiration timer by bluca · Pull Request #604 · polkit-org/polkit · GitHub
Skip to content

polkitd: add support for INI config file and use it for auth expiration timer #604

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jrybar-rh merged 3 commits into from
Dec 11, 2025
Merged

polkitd: add support for INI config file and use it for auth expiration timer #604

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
acef8b6
interactive authority: change expiration time to a class property
bluca Oct 20, 2025
5526cc3
polkitd: add support for INI config file and use it for auth expirati…
bluca Oct 20, 2025
e4aed5d
packit: install new files
bluca Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .packit/polkit.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%files -f polkit-1.lang
%doc COPYING NEWS.md README.md
%{_datadir}/man/man1/*
%{_datadir}/man/man5/*
%{_datadir}/man/man8/*
%{_datadir}/dbus-1/system.d/org.freedesktop.PolicyKit1.conf
%{_datadir}/dbus-1/system-services/*
Expand All @@ -132,6 +133,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%attr(0750,root,polkitd) %dir %{_datadir}/polkit-1/rules.d
%{_datadir}/polkit-1/actions/org.freedesktop.policykit.policy
%{_datadir}/polkit-1/policyconfig-1.dtd
%{_datadir}/polkit-1/polkitd.conf
%dir %{_sysconfdir}/polkit-1
%{_datadir}/polkit-1/rules.d/50-default.rules
%attr(0750,root,polkitd) %dir %{_sysconfdir}/polkit-1/rules.d
Expand Down
5 changes: 5 additions & 0 deletions data/meson.build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,11 @@ if not get_option('libs-only')
install_dir: pk_datadir / 'polkit-1'
)

install_data(
'polkitd.conf',
install_dir: pk_datadir / 'polkit-1'
)

configure_file(
input: 'polkit-tmpfiles.conf.in',
output: '@BASENAME@',
Expand Down
2 changes: 2 additions & 0 deletions data/polkitd.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[Polkitd]
#ExpirationSeconds=300
1 change: 1 addition & 0 deletions docs/man/meson.build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ xsltproc_cmd = [
mans = [
['polkit', '8'],
['polkitd', '8'],
['polkitd.conf', '5'],
['pkexec', '1'],
['pkcheck', '1'],
['pkaction', '1'],
Expand Down
62 changes: 62 additions & 0 deletions docs/man/polkitd.conf.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
<?xml version="1.0"?>
<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
"http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" [
<!ENTITY version SYSTEM "../version.xml">
]>
<refentry id="polkitd.conf.5">
<refentryinfo>
<title>polkitd.conf</title>
<date>October 2025</date>
<productname>polkit</productname>
</refentryinfo>

<refmeta>
<refentrytitle>polkitd.conf</refentrytitle>
<manvolnum>5</manvolnum>
<refmiscinfo class="version"></refmiscinfo>
</refmeta>

<refnamediv>
<refname>polkitd.conf</refname>
<refpurpose>The polkit system daemon configuration file</refpurpose>
</refnamediv>

<refsect1 id="polkitd-description"><title>DESCRIPTION</title>
<para>
The <command>polkitd.conf</command> file is the configuration
file for the <command>polkitd</command> system daemon. The configuration
format is INI style, with sections and key=value pairs.
</para>

<para>
The configuration file located at
<filename>/etc/polkit-1/polkitd.conf</filename> has the highest precedence,
if found. If not, <filename>/run/polkit-1/polkitd.conf</filename> will be used.
If neither file is found, <filename>/usr/lib/polkit-1/polkitd.conf</filename>
will be used. If no configuration file is found, default settings
compiled into <command>polkitd</command> will be used.
</para>
</refsect1>

<refsect1 id="polkitd-section"><title>[Polkitd] SECTION</title>
<para>
The <literal>[Polkitd]</literal> section accepts the following keys.
</para>

<refsect2 id="polkitd-expiration-seconds"><title>ExpirationSeconds=</title>
<para>
Specifies the default expiration time, in seconds, for temporary
authorizations granted by <command>polkitd</command> via
interactive authentication. The default value is 300 (5 minutes).
</para>
</refsect2>
</refsect1>

<refsect1 id="polkitd-conf-see-also">
<title>SEE ALSO</title>
<para>
<link linkend="polkitd.8"><citerefentry><refentrytitle>polkitd</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
<link linkend="polkit.8"><citerefentry><refentrytitle>polkit</refentrytitle><manvolnum>8</manvolnum></citerefentry></link>,
</para>
</refsect1>
</refentry>
6 changes: 6 additions & 0 deletions docs/man/polkitd.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,12 @@
whenever an application calls into the service.
</para>

<para>
<command>polkitd</command> may be configured via the <link
linkend="polkitd.conf.5"><citerefentry><refentrytitle>polkitd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></link>
configuration file.
</para>

<para>
<command>polkitd</command> can be started as the
<emphasis>polkitd</emphasis> system user directly, or alternatively
Expand Down
104 changes: 96 additions & 8 deletions src/polkitbackend/polkitbackendinteractiveauthority.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,7 @@ static gboolean temporary_authorization_store_has_authorization (TemporaryAuthor
const gchar **out_tmp_authz_id);

static const gchar *temporary_authorization_store_add_authorization (TemporaryAuthorizationStore *store,
guint expiration_seconds,
PolkitSubject *subject,
PolkitSubject *session,
const gchar *action_id);
Expand Down Expand Up @@ -225,8 +226,15 @@ typedef struct
guint name_owner_changed_signal_id;

guint64 agent_serial;

guint expiration_seconds;
} PolkitBackendInteractiveAuthorityPrivate;

enum
{
PROP_EXPIRATION_SECONDS = 1,
};

/* ---------------------------------------------------------------------------------------------------- */

G_DEFINE_TYPE_WITH_PRIVATE (PolkitBackendInteractiveAuthority,
Expand Down Expand Up @@ -351,6 +359,71 @@ polkit_backend_interactive_authority_init (PolkitBackendInteractiveAuthority *au
}
}

static void
polkit_backend_interactive_authority_get_property (GObject *object,
guint prop_id,
GValue *value,
GParamSpec *pspec)
{
PolkitBackendInteractiveAuthority *authority = POLKIT_BACKEND_INTERACTIVE_AUTHORITY (object);

if (prop_id == PROP_EXPIRATION_SECONDS)
g_value_set_uint (value, polkit_backend_interactive_authority_get_expiration_seconds (authority));
else
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
}

static void
polkit_backend_interactive_authority_set_property (GObject *object,
guint prop_id,
const GValue *value,
GParamSpec *pspec)
{
PolkitBackendInteractiveAuthority *authority = POLKIT_BACKEND_INTERACTIVE_AUTHORITY (object);

if (prop_id == PROP_EXPIRATION_SECONDS)
polkit_backend_interactive_authority_set_expiration_seconds (authority, g_value_get_uint (value));
else
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
}


/**
* polkit_backend_interactive_authority_set_expiration_seconds:
* @authority: A #PolkitBackendInteractiveAuthority.
* @seconds: The expiration time in seconds.
*
* Sets the expiration time for interactive authorizations by @authority.
*/
void
polkit_backend_interactive_authority_set_expiration_seconds (PolkitBackendInteractiveAuthority *authority,
guint seconds)
{
PolkitBackendInteractiveAuthorityPrivate *priv;
g_return_if_fail (POLKIT_BACKEND_IS_INTERACTIVE_AUTHORITY (authority));

priv = polkit_backend_interactive_authority_get_instance_private (authority);
priv->expiration_seconds = seconds;
}

/**
* polkit_backend_interactive_authority_get_expiration_seconds:
* @authority: A #PolkitBackendInteractiveAuthority.
*
* Gets the expiration time for interactive authorizations by @authority.
*
* Returns: The expiration time in seconds.
*/
guint
polkit_backend_interactive_authority_get_expiration_seconds (PolkitBackendInteractiveAuthority *authority)
{
PolkitBackendInteractiveAuthorityPrivate *priv;
g_return_val_if_fail (POLKIT_BACKEND_IS_INTERACTIVE_AUTHORITY (authority), 0);

priv = polkit_backend_interactive_authority_get_instance_private (authority);
return priv->expiration_seconds;
}

static void
polkit_backend_interactive_authority_finalize (GObject *object)
{
Expand Down Expand Up @@ -407,6 +480,8 @@ polkit_backend_interactive_authority_class_init (PolkitBackendInteractiveAuthori
authority_class = POLKIT_BACKEND_AUTHORITY_CLASS (klass);

gobject_class->finalize = polkit_backend_interactive_authority_finalize;
gobject_class->get_property = polkit_backend_interactive_authority_get_property;
gobject_class->set_property = polkit_backend_interactive_authority_set_property;

authority_class->get_name = polkit_backend_interactive_authority_get_name;
authority_class->get_version = polkit_backend_interactive_authority_get_version;
Expand All @@ -420,6 +495,25 @@ polkit_backend_interactive_authority_class_init (PolkitBackendInteractiveAuthori
authority_class->enumerate_temporary_authorizations = polkit_backend_interactive_authority_enumerate_temporary_authorizations;
authority_class->revoke_temporary_authorizations = polkit_backend_interactive_authority_revoke_temporary_authorizations;
authority_class->revoke_temporary_authorization_by_id = polkit_backend_interactive_authority_revoke_temporary_authorization_by_id;

/**
* PolkitBackendInteractiveAuthority:expiration_seconds:
*
* The expiration time of interactive authorizations.
*/
g_object_class_install_property (gobject_class,
PROP_EXPIRATION_SECONDS,
g_param_spec_uint ("expiration-seconds",
"Expiration Seconds",
"The expiration time of interactive authorizations in seconds",
0,
G_MAXUINT,
5 * 60, /* default to 5 minutes */
G_PARAM_CONSTRUCT |
G_PARAM_READWRITE |
G_PARAM_STATIC_NAME |
G_PARAM_STATIC_BLURB |
G_PARAM_STATIC_NICK));
}

/* ---------------------------------------------------------------------------------------------------- */
Expand Down Expand Up @@ -686,6 +780,7 @@ check_authorization_challenge_cb (AuthenticationAgent *agent,
is_temp = TRUE;

id = temporary_authorization_store_add_authorization (priv->temporary_authorization_store,
priv->expiration_seconds,
subject,
authentication_agent_get_scope (agent),
action_id);
Expand Down Expand Up @@ -3457,12 +3552,12 @@ temporary_authorization_store_remove_authorizations_for_system_bus_name (Tempora

static const gchar *
temporary_authorization_store_add_authorization (TemporaryAuthorizationStore *store,
guint expiration_seconds,
PolkitSubject *subject,
PolkitSubject *scope,
const gchar *action_id)
{
TemporaryAuthorization *authorization;
guint expiration_seconds;
PolkitSubject *subject_to_use;

g_return_val_if_fail (store != NULL, NULL);
Expand All @@ -3472,13 +3567,6 @@ temporary_authorization_store_add_authorization (TemporaryAuthorizationStore *st

subject_to_use = convert_temporary_authorization_subject (subject);

/* TODO: right now the time the temporary authorization is kept is hard-coded - we
* could make it a propery on the PolkitBackendInteractiveAuthority class (so
* the local authority could read it from a config file) or a vfunc
* (so the local authority could read it from an annotation on the action).
*/
expiration_seconds = 5 * 60;

authorization = g_new0 (TemporaryAuthorization, 1);
authorization->id = g_strdup_printf ("tmpauthz%" G_GUINT64_FORMAT, store->serial++);
authorization->store = store;
Expand Down
4 changes: 4 additions & 0 deletions src/polkitbackend/polkitbackendinteractiveauthority.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,10 @@ PolkitImplicitAuthorization polkit_backend_interactive_authority_check_authoriza
PolkitImplicitAuthorization implicit);
void polkit_backend_interactive_authority_reload (PolkitBackendInteractiveAuthority *authority);

void polkit_backend_interactive_authority_set_expiration_seconds (PolkitBackendInteractiveAuthority *authority,
guint seconds);
guint polkit_backend_interactive_authority_get_expiration_seconds (PolkitBackendInteractiveAuthority *authority);

G_END_DECLS

#endif /* __POLKIT_BACKEND_INTERACTIVE_AUTHORITY_H */
Expand Down
Loading