Replace Polkit's JS backend
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	ikey
	Oct 20 2017, 1:27 AM

Description

The JS backend must go. Having JS slows down PolKit startup time and simple rule execution, and can quite trivially be made to use another format.

Note: polkit in Solus unstable is broken, as I had the bright spark idea of replacing mozjs with duktape, which then broke it further. I then got sick
entirely of polkit even having JS (to the point of offence) and I'm now replacing it with a new format like so:

[Policy]
Rules=gtk.rules; libvirt.rules; systemd.rules; udisks.rules;
AdminRules=polkit-default.admin

[polkit-default.admin]
InUnixGroups=wheel
# InNetGroups=blah

[gtk.rules]
Actions=org.gtk.vfs.file-operations-helper
SubjectActive=true
SubjectLocal=true
# SubjectPID=
# SubjectSeat=
# SubjectSession=
InUnixGroups=wheel
Result=yes

[libvirt.rules]
Actions=org.libvirt.unix.manage
InUnixGroups=libvirt
Result=yes
# Explicitly set a result if the condition is NOT matched
# ResultInverse=auth_self_keep

[systemd.rules]
Actions=org.freedesktop.locale1.set-locale; org.freedesktop.locale1.set-keyboard; org.freedesktop.hostname1.set-static-hostname; org.freedesktop.hostname1.set-hostname; org.gnome.controlcenter.datetime.configure
SubjectActive=true
SubjectLocal=true
InUnixGroups=wheel
Result=yes

# Cranky example to make the polkit manpage happy.
[udisks.rules]
ActionContains=org.freedesktop.udisks2.
ExpectedKeys=drive.vendor; drive.model
ExpectedValues=SEAGATE; ST3300657SS
Result=yes

Revisions and Commits

R2893 shadow
	R2893:78131dada87b Bump for real shadow inclusion, add missing pam_loginuid for polkit
R766 flatpak
	R766:4908396b64b9 Install keyrules for new polkit backend per T4824
R2273 os-installer
	R2273:ff582dab09d1 Install keyrules for new polkit backend per T4824
R1126 gvfs
	R1126:7689241b3570 Add keyrules for new polkit backend per T4842
R955 gnome-control-center
	R955:4ac83f8b3728 Install keyrules for new polkit
R2462 polkit
	R2462:8e6561508710 Testing: Move polkit to our "noscript" fork
R1891 libvirt
	R1891:ab17e2be050a Install keyrules for new polkit backend per T4824

Related Objects
Search...

Status	Assigned	Task
Wontfix	None	T4235 Meta: Post-release blues
Resolved	ikey	T4686 Throttle the last breaths out of mozilla JS
Resolved	ikey	T4824 Replace Polkit's JS backend

Event Timeline

ikey created this task.Oct 20 2017, 1:27 AM

Herald removed ikey as the assignee of this task. · View Herald TranscriptOct 20 2017, 1:27 AM

Feck off Herald

Must be completed prior to sync because spidermonkey ain't going back in.

Note we'll still support package-provided rule files, I just provided a consolidated example to help me design the new format. Once we have this in play we'll attempt to get it upstreamed too.

JoshStrobl awarded a token.Oct 20 2017, 1:29 AM

Also the InUnixGroups key should support a special %wheel% parameter so that we can stop having to worry about who is actually wheel group, and configure it once from polkit build time.
I noticed our org.gtk.vfs.file-operations-helper rules has invalid wheel group while doing this (we use sudo group.)