source: postlfs/security/polkit.xml@ 5c2fdde

12.2 lazarus trunk xry111/for-12.3 xry111/spidermonkey128
Last change on this file since 5c2fdde was 5c2fdde, checked in by Xi Ruoyao <xry111@…>, 6 weeks ago

polkit: Test suite needs user namespace

Also regenerate kernel configuration files with Linux 6.10.2.

  • Property mode set to 100644
File size: 14.7 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY polkit-download-http "https://github.com/polkit-org/polkit/archive/&polkit-version;/polkit-&polkit-version;.tar.gz">
8 <!ENTITY polkit-download-ftp " ">
9 <!ENTITY polkit-md5sum "8e9f2377fc7b4010bd29b97d2e288b4f">
10 <!ENTITY polkit-size "444 KB">
11 <!ENTITY polkit-buildsize "7.2 MB (with tests)">
12 <!ENTITY polkit-time "0.3 SBU (with tests; using parallelism=4)">
13]>
14
15<sect1 id="polkit" xreflabel="Polkit-&polkit-version;">
16 <?dbhtml filename="polkit.html"?>
17
18
19 <title>Polkit-&polkit-version;</title>
20
21 <indexterm zone="polkit">
22 <primary sortas="a-Polkit">Polkit</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to Polkit</title>
27
28 <para>
29 <application>Polkit</application> is a toolkit for defining and handling
30 authorizations. It is used for allowing unprivileged processes to
31 communicate with privileged processes.
32 </para>
33
34 &lfs121_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&polkit-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&polkit-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &polkit-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &polkit-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &polkit-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &polkit-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69
70<!--
71 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
72 <itemizedlist spacing="compact">
73 <listitem>
74 <para>
75 Required patch:
76 <ulink url="&patch-root;/polkit-&polkit-version;-security_fixes-1.patch"/>
77 </para>
78 </listitem>
79 <listitem>
80 <para>
81 Required patch:
82 <ulink url="&patch-root;/polkit-&polkit-version;-js91-1.patch"/>
83 </para>
84 </listitem>
85 </itemizedlist>
86-->
87
88 <bridgehead renderas="sect3">Polkit Dependencies</bridgehead>
89
90 <bridgehead renderas="sect4">Required</bridgehead>
91 <para role="required">
92 <xref linkend="glib2"/> (GObject Introspection recommended)
93 </para>
94
95 <bridgehead renderas="sect4">Recommended</bridgehead>
96 <para role="recommended">
97 <!-- For jhalfs just make it required to avoid over-complexity. -->
98 <xref role="required" linkend="duktape"/>,
99 <xref linkend="libxslt"/>,<phrase revision="systemd"> and</phrase>
100 <xref linkend="linux-pam"/><phrase revision="sysv">, and
101 <xref linkend="elogind"/>
102 </phrase>
103 </para>
104
105 <note>
106 <para>
107 Since <phrase revision="sysv"><command>elogind</command></phrase>
108 <phrase revision="systemd"><command>systemd-logind</command></phrase>
109 uses PAM to register user sessions, it is a good idea to build
110 <application>Polkit</application> with PAM support so
111 <phrase revision="sysv"><command>elogind</command></phrase>
112 <phrase revision="systemd"><command>systemd-logind</command></phrase>
113 can track <application>Polkit</application> sessions.
114 </para>
115 </note>
116
117 <bridgehead renderas="sect4">Optional</bridgehead>
118 <para role="optional">
119 <xref linkend="gtk-doc"/>,
120 <xref linkend="python-dbusmock"/>, and
121 <xref linkend="spidermonkey"/> (can be used in place of duktape)
122 </para>
123
124 <bridgehead renderas="sect4" revision="systemd">Required Runtime Dependencies</bridgehead>
125 <para role="required" revision="systemd">
126 <xref role="runtime" linkend="systemd"/>
127 </para>
128
129 <bridgehead renderas="sect4" id="polkit-agent" xreflabel="Polkit Authentication Agent">
130 Optional Runtime Dependencies
131 </bridgehead>
132 <para role="optional">
133 One polkit authentication agent for using polkit in the graphical
134 environment:
135 <application>polkit-kde-agent</application> in
136 <xref role="runtime" linkend="plasma-build"/> for KDE,
137 the agent built in
138 <xref role="runtime" linkend="gnome-shell"/> for GNOME3,
139 <xref role="runtime" linkend="polkit-gnome"/> for XFCE, and
140 <xref role="runtime" linkend="lxqt-policykit"/> for LXQt
141 </para>
142
143 <note>
144 <para>
145 If <xref linkend="libxslt"/> is installed,
146 then <xref linkend="DocBook"/> and <xref linkend="docbook-xsl"/> are
147 required. If you have installed <xref linkend="libxslt"/>, but you do
148 not want to install any of the DocBook packages mentioned, you will
149 need to use <option>-D man=false</option> in the instructions
150 below.
151 </para>
152 </note>
153
154 </sect2>
155
156 <sect2 role="kernel" id="polkit-test-kernel">
157 <title>Kernel Configuration</title>
158
159 <para>
160 Some tests need user namespace. If running the test suite, enable it:
161 </para>
162
163 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
164 href="polkit-test-kernel.xml"/>
165
166 <indexterm zone="polkit polkit-test-kernel">
167 <primary sortas="d-polkit">polkit (testing)</primary>
168 </indexterm>
169 </sect2>
170
171 <sect2 role="installation">
172 <title>Installation of Polkit</title>
173
174 <para>
175 There should be a dedicated user and group to take control
176 of the <command>polkitd</command> daemon after it is
177 started. Issue the following commands as the
178 <systemitem class="username">root</systemitem> user:
179 </para>
180
181<screen role="root"><userinput>groupadd -fg 27 polkitd &amp;&amp;
182useradd -c "PolicyKit Daemon Owner" -d /etc/polkit-1 -u 27 \
183 -g polkitd -s /bin/false polkitd</userinput></screen>
184
185 <para revision='sysv'>
186 First fix a build problem for sysV based systems:
187 </para>
188
189<screen revision="sysv"><userinput>sed -i '/systemd_sysusers_dir/s/^/#/' meson.build</userinput></screen>
190
191 <para>
192 Install <application>Polkit</application> by running the following
193 commands:
194 </para>
195
196<screen revision="systemd"><userinput>mkdir build &amp;&amp;
197cd build &amp;&amp;
198
199meson setup .. \
200 --prefix=/usr \
201 --buildtype=release \
202 -D man=true \
203 -D session_tracking=logind \
204 -D tests=true</userinput></screen>
205
206<screen revision="sysv"><userinput>mkdir build &amp;&amp;
207cd build &amp;&amp;
208
209meson setup .. \
210 --prefix=/usr \
211 --buildtype=release \
212 -D man=true \
213 -D session_tracking=elogind \
214 -D tests=true</userinput></screen>
215
216 <!-- We have to do this after meson setup because mocklibc is extracted
217 from a tarball by the meson setup command. Also note that
218 test/mocklibc is useless and patching it won't work. -->
219 <para>
220 Now adapt the shipped mocklibc copy to allow building the test suite
221 with GCC 14 or later:
222 </para>
223
224<screen><userinput>grep 'print_indent' ../subprojects/mocklibc-1.0/src/netgroup.c \
225 | sed 's/ {/;/' >> ../subprojects/mocklibc-1.0/src/netgroup.h &amp;&amp;
226
227sed -i '1 i #include &lt;stdio.h&gt;' ../subprojects/mocklibc-1.0/src/netgroup.h</userinput></screen>
228
229 <para>
230 Build the package:
231 </para>
232
233<screen><userinput>ninja</userinput></screen>
234
235 <para>
236 To test the results, first ensure that the system
237 <application>D-Bus</application> daemon is running,
238 and both <xref linkend='dbus-python'/> and
239 <xref linkend='python-dbusmock'/> are installed.
240 Then run <command>ninja test</command>.
241 </para>
242
243 <para>
244 Now, as the <systemitem class="username">root</systemitem> user:
245 </para>
246
247<screen role="root"><userinput>ninja install</userinput></screen>
248
249 </sect2>
250
251 <sect2 role="commands">
252 <title>Command Explanations</title>
253
254 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
255 href="../../xincludes/meson-buildtype-release.xml"/>
256
257 <para>
258 <parameter>-D tests=true</parameter>: This switch allows to run the
259 test suite of this package. As <application>Polkit</application> is
260 used for authorizations, its integrity can affect system security.
261 So it's recommended to run the test suite building this package.
262 </para>
263
264 <para>
265 <option>-D js_engine=mozjs</option>: This switch allows using the
266 <xref linkend="spidermonkey"/> JavaScript engine instead of the
267 <xref linkend='duktape'/> JavaScript engine.
268 </para>
269
270 <!--
271 <para revision="sysv">
272 <parameter>- -disable-libsystemd-login</parameter>: This switch forces
273 polkit to build with elogind support (if available) rather than
274 systemd-logind.
275 </para>
276
277
278 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
279 href="../../xincludes/static-libraries.xml"/>
280 -->
281
282 <para>
283 <option>-D os_type=lfs</option>: Use this switch if you did not create
284 the <filename>/etc/lfs-release</filename> file or distribution auto
285 detection will fail and you will be unable to use
286 <application>Polkit</application>.
287 </para>
288
289 <para>
290 <option>-D authfw=shadow</option>: This switch enables the
291 package to use the <application>Shadow</application> rather than the
292 <application>Linux PAM</application> Authentication framework. Use it
293 if you have not installed <application>Linux PAM</application>.
294 </para>
295
296 <!--
297 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
298 href="../../xincludes/gtk-doc-rebuild.xml"/>
299 -->
300
301 <para>
302 <option>-D introspection=false</option>: Use this option if you are certain
303 that you do not need gobject-introspection files for polkit, or do not have
304 installed <xref linkend='glib2'/> with GObject Introspection.
305 </para>
306
307 <para>
308 <option>-D man=false</option>: Use this option to disable generating and
309 installing manual pages. This is useful if libxslt is not installed.
310 </para>
311
312 <para>
313 <option>-D examples=true</option>: Use this option to build the example
314 programs.
315 </para>
316
317 <para>
318 <option>-D gtk_doc=true</option>: Use this option to enable building and
319 installing the API documentation.
320 </para>
321
322 </sect2>
323
324 <sect2 role="content">
325 <title>Contents</title>
326
327 <segmentedlist>
328 <segtitle>Installed Programs</segtitle>
329 <segtitle>Installed Libraries</segtitle>
330 <segtitle>Installed Directories</segtitle>
331
332 <seglistitem>
333 <seg>
334 pkaction, pkcheck, <!--pk-example-frobnicate,--> pkexec,
335 pkttyagent, and polkitd
336 </seg>
337 <seg>
338 libpolkit-agent-1.so and
339 libpolkit-gobject-1.so
340 </seg>
341 <seg>
342 /etc/polkit-1,
343 /usr/include/polkit-1,
344 /usr/lib/polkit-1,
345 /usr/share/gtk-doc/html/polkit-1, and
346 /usr/share/polkit-1
347 </seg>
348 </seglistitem>
349 </segmentedlist>
350
351 <variablelist>
352 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
353 <?dbfo list-presentation="list"?>
354 <?dbhtml list-presentation="table"?>
355
356 <varlistentry id="pkaction">
357 <term><command>pkaction</command></term>
358 <listitem>
359 <para>
360 is used to obtain information about registered PolicyKit actions
361 </para>
362 <indexterm zone="polkit pkaction">
363 <primary sortas="b-pkaction">pkaction</primary>
364 </indexterm>
365 </listitem>
366 </varlistentry>
367
368 <varlistentry id="pkcheck">
369 <term><command>pkcheck</command></term>
370 <listitem>
371 <para>
372 is used to check whether a process is authorized for action
373 </para>
374 <indexterm zone="polkit pkcheck">
375 <primary sortas="b-pkcheck">pkcheck</primary>
376 </indexterm>
377 </listitem>
378 </varlistentry>
379
380<!--
381 <varlistentry id="pk-example-frobnicate">
382 <term><command>pk-example-frobnicate</command></term>
383 <listitem>
384 <para>
385 is an example program to test the <command>pkexec</command>
386 command
387 </para>
388 <indexterm zone="polkit pk-example-frobnicate">
389 <primary sortas="b-pk-example-frobnicate">pk-example-frobnicate</primary>
390 </indexterm>
391 </listitem>
392 </varlistentry>
393-->
394
395 <varlistentry id="pkexec">
396 <term><command>pkexec</command></term>
397 <listitem>
398 <para>
399 allows an authorized user to execute a command as another user
400 </para>
401 <indexterm zone="polkit pkexec">
402 <primary sortas="b-pkexec">pkexec</primary>
403 </indexterm>
404 </listitem>
405 </varlistentry>
406
407 <varlistentry id="pkttyagent">
408 <term><command>pkttyagent</command></term>
409 <listitem>
410 <para>
411 is used to start a textual authentication agent for the subject
412 </para>
413 <indexterm zone="polkit pkttyagent">
414 <primary sortas="b-pkttyagent">pkttyagent</primary>
415 </indexterm>
416 </listitem>
417 </varlistentry>
418
419 <varlistentry id="polkitd">
420 <term><command>polkitd</command></term>
421 <listitem>
422 <para>
423 provides the org.freedesktop.PolicyKit1 <application>D-Bus</application>
424 service on the system message bus
425 </para>
426 <indexterm zone="polkit polkitd">
427 <primary sortas="b-polkitd">polkitd</primary>
428 </indexterm>
429 </listitem>
430 </varlistentry>
431
432 <varlistentry id="libpolkit-agent-1">
433 <term><filename class="libraryfile">libpolkit-agent-1.so</filename></term>
434 <listitem>
435 <para>
436 contains the <application>Polkit</application> authentication
437 agent API functions
438 </para>
439 <indexterm zone="polkit libpolkit-agent-1">
440 <primary sortas="c-libpolkit-agent-1">libpolkit-agent-1.so</primary>
441 </indexterm>
442 </listitem>
443 </varlistentry>
444
445 <varlistentry id="libpolkit-gobject-1">
446 <term><filename class="libraryfile">libpolkit-gobject-1.so</filename></term>
447 <listitem>
448 <para>
449 contains the <application>Polkit</application> authorization API functions
450 </para>
451 <indexterm zone="polkit libpolkit-gobject-1">
452 <primary sortas="c-libpolkit-gobject-1">libpolkit-gobject-1.so</primary>
453 </indexterm>
454 </listitem>
455 </varlistentry>
456
457 </variablelist>
458
459 </sect2>
460
461</sect1>
Note: See TracBrowser for help on using the repository browser.