PolicyKit
Summary
PolicyKit provides a flexible framework for granting users access to privileged operations. It is meant to replace the old userhelper approach, and overcome some of its shortcomings.
Owner
- Name: DavidZeuthen
Current status
- Targeted release: Fedora 8
- Last updated: 2007-10-03
- Percentage of completion: 100%
Detailed Description
PolicyKit is currently being developed in the context of the hal project. An initial release has just happened . hal support for PolicyKit is developed in parallel and will appear in hal 0.5.10.
David recently released PolicyKit 0.5 and a hal 0.5.10rc1 that depends on it. Rawhide contains git snapshots of PolicyKit 0.6 and hal 0.5.10.
Dbus system-bus activation has been implemented by RichardHughes and is included in dbus 1.1.2 in rawhide.
In Fedora 8, the only user of PolicyKit will be hal. The clock-setting feature of the panel clock has been implemented, but came to late for F8. It is now being proposed as an F9 feature .
Usage cases/rationale
1. David wants to format his USB stick. When he activates the corresponding item from the context menu, the system presents a dialog asking him for the root password.
2. Matt needs to adjust the clock of his computer. The context menu of the panel clock lets him do this without asking for passwords. (Or, depending on the policy, allows him to authenticate with his own password like sudo or Mac OS X.)
3. When Ray shuts down his system, gdm asks him if he really wants to shut down while his girlfriend has a session running on the system. When he is the only user on the system, gdm shuts down without further questions.
4. David administrates his familys desktop system. He wants to allow every family member to format removable media without giving them the root password. He achieves this by editing the xml file that defines the policy for PolicyKit.
Scope
Requires PolicyKit packages and changes to hal, system-config-date, gdm.
Test Plan
Verify that the use cases above all work.
Dependencies
Depends on an upstream PolicyKit release, which has happened now, packages are in rawhide. The clock setting part requires dbus system-bus activation, which is in dbus 1.1.2 in rawhide.
Details
For the clock setting part, implement a small dbus service for changing time/date, and use dbus system-bus activation to use it. system-config-date should also be changed to use this dbus service.
Contingency Plan
The transition to PolicyKit will be gradual. It can happily coexist with the traditional userhelper approach.
Documentation
PolicyKit ships man pages for its commandline utilities and for its configuration file format. It also includes the PolicyKit specification. More information at http://blog.fubar.dk/?p=66, http://people.freedesktop.org/~david/polkit-spec.html and http://lists.freedesktop.org/archives/hal/2006-March/004770.html.