mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-23 21:34:54 +03:00
1d35f6ffe1
When there isn't a ssh -X type session running and a user has not
been added to the libvirt group, attempts to run 'virsh -c qemu:///system'
commands from an otherwise unprivileged user will fail with rather
generic or opaque error message:
"error: authentication failed: no agent is available to authenticate"
This patch will adjust the error code and message to help reflect the
situation that the problem is the requested mechanism is UNAVAILABLE and
a slightly more descriptive error. The result on a failure then becomes:
"error: authentication unavailable: no polkit agent available to
authenticate action 'org.libvirt.unix.manage'"
A bit more history on this - at one time a failure generated the
following type message when running the 'pkcheck' as a subprocess:
"error: authentication failed: polkit\56retains_authorization_after_challenge=1
Authorization requires authentication but no agent is available."
but, a patch was generated to adjust the error message to help provide
more details about what failed. This was pushed as commit id '96a108c99'.
That patch prepended a "polkit: " to the output. It really didn't solve
the problem, but gave a hint.
After some time it was deemed using DBus API calls directly was a
better way to go (since pkcheck calls them anyway). So, commit id
'1b854c76' (more or less) copied the code from remoteDispatchAuthPolkit
and adjusted it. Then commit id 'c7542573' adjusted the remote.c
code to call the new API (virPolkitCheckAuth). Finally, commit id
'308c0c5a' altered the code to call DBus APIs directly. In doing
so, it reverted the failing error message to the generic message
that would have been received from DBus anyway.
362 lines
9.5 KiB
C
362 lines
9.5 KiB
C
/*
|
|
* Copyright (C) 2013, 2014, 2016 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Author: Daniel P. Berrange <berrange@redhat.com>
|
|
*/
|
|
|
|
#include <config.h>
|
|
|
|
#include "testutils.h"
|
|
|
|
#if defined(WITH_DBUS) && defined(__linux__)
|
|
|
|
# include <stdlib.h>
|
|
# include <dbus/dbus.h>
|
|
|
|
# include "virpolkit.h"
|
|
# include "virdbus.h"
|
|
# include "virlog.h"
|
|
# include "virmock.h"
|
|
# define VIR_FROM_THIS VIR_FROM_NONE
|
|
|
|
VIR_LOG_INIT("tests.systemdtest");
|
|
|
|
/* Some interesting numbers */
|
|
# define THE_PID 1458
|
|
# define THE_TIME 11011000001
|
|
# define THE_UID 1729
|
|
|
|
VIR_MOCK_WRAP_RET_ARGS(dbus_connection_send_with_reply_and_block,
|
|
DBusMessage *,
|
|
DBusConnection *, connection,
|
|
DBusMessage *, message,
|
|
int, timeout_milliseconds,
|
|
DBusError *, error)
|
|
{
|
|
DBusMessage *reply = NULL;
|
|
const char *service = dbus_message_get_destination(message);
|
|
const char *member = dbus_message_get_member(message);
|
|
|
|
VIR_MOCK_REAL_INIT(dbus_connection_send_with_reply_and_block);
|
|
|
|
if (STREQ(service, "org.freedesktop.PolicyKit1") &&
|
|
STREQ(member, "CheckAuthorization")) {
|
|
char *type;
|
|
char *pidkey;
|
|
unsigned int pidval;
|
|
char *timekey;
|
|
unsigned long long timeval;
|
|
char *uidkey;
|
|
int uidval;
|
|
char *actionid;
|
|
char **details;
|
|
size_t detailslen;
|
|
int allowInteraction;
|
|
char *cancellationId;
|
|
const char **retdetails = NULL;
|
|
size_t retdetailslen = 0;
|
|
const char *retdetailscancelled[] = {
|
|
"polkit.dismissed", "true",
|
|
};
|
|
int is_authorized = 1;
|
|
int is_challenge = 0;
|
|
|
|
if (virDBusMessageRead(message,
|
|
"(sa{sv})sa&{ss}us",
|
|
&type,
|
|
3,
|
|
&pidkey, "u", &pidval,
|
|
&timekey, "t", &timeval,
|
|
&uidkey, "i", &uidval,
|
|
&actionid,
|
|
&detailslen,
|
|
&details,
|
|
&allowInteraction,
|
|
&cancellationId) < 0)
|
|
goto error;
|
|
|
|
if (STREQ(actionid, "org.libvirt.test.success")) {
|
|
is_authorized = 1;
|
|
is_challenge = 0;
|
|
} else if (STREQ(actionid, "org.libvirt.test.challenge")) {
|
|
is_authorized = 0;
|
|
is_challenge = 1;
|
|
} else if (STREQ(actionid, "org.libvirt.test.cancelled")) {
|
|
is_authorized = 0;
|
|
is_challenge = 0;
|
|
retdetails = retdetailscancelled;
|
|
retdetailslen = ARRAY_CARDINALITY(retdetailscancelled) / 2;
|
|
} else if (STREQ(actionid, "org.libvirt.test.details")) {
|
|
size_t i;
|
|
is_authorized = 0;
|
|
is_challenge = 0;
|
|
for (i = 0; i < detailslen / 2; i++) {
|
|
if (STREQ(details[i * 2],
|
|
"org.libvirt.test.person") &&
|
|
STREQ(details[(i * 2) + 1],
|
|
"Fred")) {
|
|
is_authorized = 1;
|
|
is_challenge = 0;
|
|
}
|
|
}
|
|
} else {
|
|
is_authorized = 0;
|
|
is_challenge = 0;
|
|
}
|
|
|
|
VIR_FREE(type);
|
|
VIR_FREE(pidkey);
|
|
VIR_FREE(timekey);
|
|
VIR_FREE(uidkey);
|
|
VIR_FREE(actionid);
|
|
VIR_FREE(cancellationId);
|
|
virStringFreeListCount(details, detailslen);
|
|
|
|
if (virDBusCreateReply(&reply,
|
|
"(bba&{ss})",
|
|
is_authorized,
|
|
is_challenge,
|
|
retdetailslen,
|
|
retdetails) < 0)
|
|
goto error;
|
|
} else {
|
|
reply = dbus_message_new(DBUS_MESSAGE_TYPE_METHOD_RETURN);
|
|
}
|
|
|
|
return reply;
|
|
|
|
error:
|
|
virDBusMessageUnref(reply);
|
|
return NULL;
|
|
}
|
|
|
|
|
|
|
|
static int testPolkitAuthSuccess(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
|
|
if (virPolkitCheckAuth("org.libvirt.test.success",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
NULL,
|
|
true) < 0)
|
|
goto cleanup;
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int testPolkitAuthDenied(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
int rv;
|
|
virErrorPtr err;
|
|
|
|
rv = virPolkitCheckAuth("org.libvirt.test.deny",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
NULL,
|
|
true);
|
|
|
|
if (rv == 0) {
|
|
fprintf(stderr, "Unexpected auth success\n");
|
|
goto cleanup;
|
|
} else if (rv != -2) {
|
|
goto cleanup;
|
|
}
|
|
|
|
err = virGetLastError();
|
|
if (!err || !strstr(err->message,
|
|
_("access denied by policy"))) {
|
|
fprintf(stderr, "Incorrect error response\n");
|
|
goto cleanup;
|
|
}
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int testPolkitAuthChallenge(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
int rv;
|
|
virErrorPtr err;
|
|
|
|
rv = virPolkitCheckAuth("org.libvirt.test.challenge",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
NULL,
|
|
true);
|
|
|
|
if (rv == 0) {
|
|
fprintf(stderr, "Unexpected auth success\n");
|
|
goto cleanup;
|
|
} else if (rv != -2) {
|
|
goto cleanup;
|
|
}
|
|
|
|
err = virGetLastError();
|
|
if (!err || err->domain != VIR_FROM_POLKIT ||
|
|
err->code != VIR_ERR_AUTH_UNAVAILABLE ||
|
|
!strstr(err->message, _("no polkit agent available to authenticate"))) {
|
|
fprintf(stderr, "Incorrect error response\n");
|
|
goto cleanup;
|
|
}
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int testPolkitAuthCancelled(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
int rv;
|
|
virErrorPtr err;
|
|
|
|
rv = virPolkitCheckAuth("org.libvirt.test.cancelled",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
NULL,
|
|
true);
|
|
|
|
if (rv == 0) {
|
|
fprintf(stderr, "Unexpected auth success\n");
|
|
goto cleanup;
|
|
} else if (rv != -2) {
|
|
goto cleanup;
|
|
}
|
|
|
|
err = virGetLastError();
|
|
if (!err || !strstr(err->message,
|
|
_("user cancelled authentication process"))) {
|
|
fprintf(stderr, "Incorrect error response\n");
|
|
goto cleanup;
|
|
}
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int testPolkitAuthDetailsSuccess(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
const char *details[] = {
|
|
"org.libvirt.test.person", "Fred",
|
|
NULL,
|
|
};
|
|
|
|
if (virPolkitCheckAuth("org.libvirt.test.details",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
details,
|
|
true) < 0)
|
|
goto cleanup;
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int testPolkitAuthDetailsDenied(const void *opaque ATTRIBUTE_UNUSED)
|
|
{
|
|
int ret = -1;
|
|
int rv;
|
|
virErrorPtr err;
|
|
const char *details[] = {
|
|
"org.libvirt.test.person", "Joe",
|
|
NULL,
|
|
};
|
|
|
|
rv = virPolkitCheckAuth("org.libvirt.test.details",
|
|
THE_PID,
|
|
THE_TIME,
|
|
THE_UID,
|
|
details,
|
|
true);
|
|
|
|
if (rv == 0) {
|
|
fprintf(stderr, "Unexpected auth success\n");
|
|
goto cleanup;
|
|
} else if (rv != -2) {
|
|
goto cleanup;
|
|
}
|
|
|
|
err = virGetLastError();
|
|
if (!err || !strstr(err->message,
|
|
_("access denied by policy"))) {
|
|
fprintf(stderr, "Incorrect error response\n");
|
|
goto cleanup;
|
|
}
|
|
|
|
ret = 0;
|
|
|
|
cleanup:
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int
|
|
mymain(void)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (virtTestRun("Polkit auth success ", testPolkitAuthSuccess, NULL) < 0)
|
|
ret = -1;
|
|
if (virtTestRun("Polkit auth deny ", testPolkitAuthDenied, NULL) < 0)
|
|
ret = -1;
|
|
if (virtTestRun("Polkit auth challenge ", testPolkitAuthChallenge, NULL) < 0)
|
|
ret = -1;
|
|
if (virtTestRun("Polkit auth cancel ", testPolkitAuthCancelled, NULL) < 0)
|
|
ret = -1;
|
|
if (virtTestRun("Polkit auth details success ", testPolkitAuthDetailsSuccess, NULL) < 0)
|
|
ret = -1;
|
|
if (virtTestRun("Polkit auth details deny ", testPolkitAuthDetailsDenied, NULL) < 0)
|
|
ret = -1;
|
|
|
|
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
|
}
|
|
|
|
VIRT_TEST_MAIN_PRELOAD(mymain, abs_builddir "/.libs/virdbusmock.so")
|
|
|
|
#else /* ! (WITH_DBUS && __linux__) */
|
|
int
|
|
main(void)
|
|
{
|
|
return EXIT_AM_SKIP;
|
|
}
|
|
#endif /* ! WITH_DBUS */
|