Replace Polkit's JS backend
Closed, ResolvedPublic

Subscribers
Tokens
"Y So Serious" token, awarded by kyrios123."Like" token, awarded by mcritchlow."Like" token, awarded by miwilc."Cup of Joe" token, awarded by samuelcecilio."Party Time" token, awarded by JoshStrobl.
Assigned To
Authored By
ikey, Oct 20 2017

Description

The JS backend must go. Having JS slows down PolKit startup time and simple rule execution, and can quite trivially be made to use another format.

Note: polkit in Solus unstable is broken, as I had the bright spark idea of replacing mozjs with duktape, which then broke it further. I then got sick
entirely of polkit even having JS (to the point of offence) and I'm now replacing it with a new format like so:

[Policy]
Rules=gtk.rules; libvirt.rules; systemd.rules; udisks.rules;
AdminRules=polkit-default.admin

[polkit-default.admin]
InUnixGroups=wheel
# InNetGroups=blah

[gtk.rules]
Actions=org.gtk.vfs.file-operations-helper
SubjectActive=true
SubjectLocal=true
# SubjectPID=
# SubjectSeat=
# SubjectSession=
InUnixGroups=wheel
Result=yes

[libvirt.rules]
Actions=org.libvirt.unix.manage
InUnixGroups=libvirt
Result=yes
# Explicitly set a result if the condition is NOT matched
# ResultInverse=auth_self_keep

[systemd.rules]
Actions=org.freedesktop.locale1.set-locale; org.freedesktop.locale1.set-keyboard; org.freedesktop.hostname1.set-static-hostname; org.freedesktop.hostname1.set-hostname; org.gnome.controlcenter.datetime.configure
SubjectActive=true
SubjectLocal=true
InUnixGroups=wheel
Result=yes

# Cranky example to make the polkit manpage happy.
[udisks.rules]
ActionContains=org.freedesktop.udisks2.
ExpectedKeys=drive.vendor; drive.model
ExpectedValues=SEAGATE; ST3300657SS
Result=yes
ikey created this task.Oct 20 2017, 1:27 AM
Herald removed ikey as the assignee of this task. · View Herald TranscriptOct 20 2017, 1:27 AM
ikey claimed this task.Oct 20 2017, 1:27 AM

Feck off Herald

ikey triaged this task as "Unbreak Now!" priority.Oct 20 2017, 1:27 AM

Must be completed prior to sync because spidermonkey ain't going back in.

Note we'll still support package-provided rule files, I just provided a consolidated example to help me design the new format. Once we have this in play we'll attempt to get it upstreamed too.

ikey added a comment.Oct 20 2017, 1:30 AM

Also the InUnixGroups key should support a special %wheel% parameter so that we can stop having to worry about who is actually wheel group, and configure it once from polkit build time.
I noticed our org.gtk.vfs.file-operations-helper rules has invalid wheel group while doing this (we use sudo group.)

ikey added a comment.Oct 20 2017, 3:12 PM

Sent notice upstream so nobody thinks we're up to some NIH fork tricks https://lists.freedesktop.org/archives/polkit-devel/2017-October/000547.html

ikey changed the task status from "Open" to "In Progress".Oct 20 2017, 9:57 PM
ikey closed this task as "Resolved".Oct 21 2017, 1:29 AM

Now resolved, moving into stable. Will continue the patchwork now to upstream it, but its working perfectly fine for Solus atm.