source: postlfs/security/polkit.xml@ ac53dc9

xry111/spidermonkey128
Last change on this file since ac53dc9 was ac53dc9, checked in by Xi Ruoyao <xry111@…>, 6 weeks ago

polkit: Adapt for SpiderMonkey 128

  • Property mode set to 100644
File size: 15.1 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY polkit-download-http "https://github.com/polkit-org/polkit/archive/&polkit-version;/polkit-&polkit-version;.tar.gz">
8 <!ENTITY polkit-download-ftp " ">
9 <!ENTITY polkit-md5sum "8e9f2377fc7b4010bd29b97d2e288b4f">
10 <!ENTITY polkit-size "444 KB">
11 <!ENTITY polkit-buildsize "7.2 MB (with tests)">
12 <!ENTITY polkit-time "0.3 SBU (with tests; using parallelism=4)">
13]>
14
15<sect1 id="polkit" xreflabel="Polkit-&polkit-version;">
16 <?dbhtml filename="polkit.html"?>
17
18
19 <title>Polkit-&polkit-version;</title>
20
21 <indexterm zone="polkit">
22 <primary sortas="a-Polkit">Polkit</primary>
23 </indexterm>
24
25 <sect2 role="package">
26 <title>Introduction to Polkit</title>
27
28 <para>
29 <application>Polkit</application> is a toolkit for defining and handling
30 authorizations. It is used for allowing unprivileged processes to
31 communicate with privileged processes.
32 </para>
33
34 &lfs121_checked;
35
36 <bridgehead renderas="sect3">Package Information</bridgehead>
37 <itemizedlist spacing="compact">
38 <listitem>
39 <para>
40 Download (HTTP): <ulink url="&polkit-download-http;"/>
41 </para>
42 </listitem>
43 <listitem>
44 <para>
45 Download (FTP): <ulink url="&polkit-download-ftp;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download MD5 sum: &polkit-md5sum;
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download size: &polkit-size;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Estimated disk space required: &polkit-buildsize;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated build time: &polkit-time;
66 </para>
67 </listitem>
68 </itemizedlist>
69
70<!--
71 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
72 <itemizedlist spacing="compact">
73 <listitem>
74 <para>
75 Required patch:
76 <ulink url="&patch-root;/polkit-&polkit-version;-security_fixes-1.patch"/>
77 </para>
78 </listitem>
79 <listitem>
80 <para>
81 Required patch:
82 <ulink url="&patch-root;/polkit-&polkit-version;-js91-1.patch"/>
83 </para>
84 </listitem>
85 </itemizedlist>
86-->
87
88 <bridgehead renderas="sect3">Polkit Dependencies</bridgehead>
89
90 <bridgehead renderas="sect4">Required</bridgehead>
91 <para role="required">
92 <xref linkend="glib2"/> (GObject Introspection recommended)
93 </para>
94
95 <bridgehead renderas="sect4">Recommended</bridgehead>
96 <para role="recommended">
97 <!-- For jhalfs just make it required to avoid over-complexity. -->
98 <xref role="required" linkend="duktape"/>,
99 <xref linkend="libxslt"/>,<phrase revision="systemd"> and</phrase>
100 <xref linkend="linux-pam"/><phrase revision="sysv">, and
101 <xref linkend="elogind"/>
102 </phrase>
103 </para>
104
105 <note>
106 <para>
107 Since <phrase revision="sysv"><command>elogind</command></phrase>
108 <phrase revision="systemd"><command>systemd-logind</command></phrase>
109 uses PAM to register user sessions, it is a good idea to build
110 <application>Polkit</application> with PAM support so
111 <phrase revision="sysv"><command>elogind</command></phrase>
112 <phrase revision="systemd"><command>systemd-logind</command></phrase>
113 can track <application>Polkit</application> sessions.
114 </para>
115 </note>
116
117 <bridgehead renderas="sect4">Optional</bridgehead>
118 <para role="optional">
119 <xref linkend="gtk-doc"/>,
120 <xref linkend="python-dbusmock"/>, and
121 <xref linkend="spidermonkey"/> (can be used in place of duktape)
122 </para>
123
124 <bridgehead renderas="sect4" revision="systemd">Required Runtime Dependencies</bridgehead>
125 <para role="required" revision="systemd">
126 <xref role="runtime" linkend="systemd"/>
127 </para>
128
129 <bridgehead renderas="sect4" id="polkit-agent" xreflabel="Polkit Authentication Agent">
130 Optional Runtime Dependencies
131 </bridgehead>
132 <para role="optional">
133 One polkit authentication agent for using polkit in the graphical
134 environment:
135 <application>polkit-kde-agent</application> in
136 <xref role="runtime" linkend="plasma-build"/> for KDE,
137 the agent built in
138 <xref role="runtime" linkend="gnome-shell"/> for GNOME3,
139 <xref role="runtime" linkend="polkit-gnome"/> for XFCE, and
140 <xref role="runtime" linkend="lxqt-policykit"/> for LXQt
141 </para>
142
143 <note>
144 <para>
145 If <xref linkend="libxslt"/> is installed,
146 then <xref linkend="DocBook"/> and <xref linkend="docbook-xsl"/> are
147 required. If you have installed <xref linkend="libxslt"/>, but you do
148 not want to install any of the DocBook packages mentioned, you will
149 need to use <option>-D man=false</option> in the instructions
150 below.
151 </para>
152 </note>
153
154 </sect2>
155
156 <sect2 role="kernel" id="polkit-test-kernel">
157 <title>Kernel Configuration</title>
158
159 <para>
160 Some tests need user namespace. If running the test suite, enable it:
161 </para>
162
163 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
164 href="polkit-test-kernel.xml"/>
165
166 <indexterm zone="polkit polkit-test-kernel">
167 <primary sortas="d-polkit">polkit (testing)</primary>
168 </indexterm>
169 </sect2>
170
171 <sect2 role="installation">
172 <title>Installation of Polkit</title>
173
174 <para>
175 There should be a dedicated user and group to take control
176 of the <command>polkitd</command> daemon after it is
177 started. Issue the following commands as the
178 <systemitem class="username">root</systemitem> user:
179 </para>
180
181<screen role="root"><userinput>groupadd -fg 27 polkitd &amp;&amp;
182useradd -c "PolicyKit Daemon Owner" -d /etc/polkit-1 -u 27 \
183 -g polkitd -s /bin/false polkitd</userinput></screen>
184
185 <para revision='sysv'>
186 First fix a build problem for sysV based systems:
187 </para>
188
189<screen revision="sysv"><userinput>sed -i '/systemd_sysusers_dir/s/^/#/' meson.build</userinput></screen>
190
191 <para>
192 Adapt this package to allow building with SpiderMonkey from
193 Firefox-128.1.0 or later (this has no effect but does no harm if
194 building with <xref linkend='duktape'/>):
195 </para>
196
197 <screen><userinput>sed '/mozjs/s/115/128/' -i meson.build &amp;&amp;
198sed 's/? report->filename/&amp;.c_str()/' \
199 -i src/polkitbackend/polkitbackendjsauthority.cpp</userinput></screen>
200
201 <para>
202 Install <application>Polkit</application> by running the following
203 commands:
204 </para>
205
206<screen revision="systemd"><userinput>mkdir build &amp;&amp;
207cd build &amp;&amp;
208
209meson setup .. \
210 --prefix=/usr \
211 --buildtype=release \
212 -D man=true \
213 -D session_tracking=logind \
214 -D tests=true</userinput></screen>
215
216<screen revision="sysv"><userinput>mkdir build &amp;&amp;
217cd build &amp;&amp;
218
219meson setup .. \
220 --prefix=/usr \
221 --buildtype=release \
222 -D man=true \
223 -D session_tracking=elogind \
224 -D tests=true</userinput></screen>
225
226 <!-- We have to do this after meson setup because mocklibc is extracted
227 from a tarball by the meson setup command. Also note that
228 test/mocklibc is useless and patching it won't work. -->
229 <para>
230 Now adapt the shipped mocklibc copy to allow building the test suite
231 with GCC 14 or later:
232 </para>
233
234<screen><userinput>grep 'print_indent' ../subprojects/mocklibc-1.0/src/netgroup.c \
235 | sed 's/ {/;/' >> ../subprojects/mocklibc-1.0/src/netgroup.h &amp;&amp;
236
237sed -i '1 i #include &lt;stdio.h&gt;' ../subprojects/mocklibc-1.0/src/netgroup.h</userinput></screen>
238
239 <para>
240 Build the package:
241 </para>
242
243<screen><userinput>ninja</userinput></screen>
244
245 <para>
246 To test the results, first ensure that the system
247 <application>D-Bus</application> daemon is running,
248 and both <xref linkend='dbus-python'/> and
249 <xref linkend='python-dbusmock'/> are installed.
250 Then run <command>ninja test</command>.
251 </para>
252
253 <para>
254 Now, as the <systemitem class="username">root</systemitem> user:
255 </para>
256
257<screen role="root"><userinput>ninja install</userinput></screen>
258
259 </sect2>
260
261 <sect2 role="commands">
262 <title>Command Explanations</title>
263
264 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
265 href="../../xincludes/meson-buildtype-release.xml"/>
266
267 <para>
268 <parameter>-D tests=true</parameter>: This switch allows to run the
269 test suite of this package. As <application>Polkit</application> is
270 used for authorizations, its integrity can affect system security.
271 So it's recommended to run the test suite building this package.
272 </para>
273
274 <para>
275 <option>-D js_engine=mozjs</option>: This switch allows using the
276 <xref linkend="spidermonkey"/> JavaScript engine instead of the
277 <xref linkend='duktape'/> JavaScript engine.
278 </para>
279
280 <!--
281 <para revision="sysv">
282 <parameter>- -disable-libsystemd-login</parameter>: This switch forces
283 polkit to build with elogind support (if available) rather than
284 systemd-logind.
285 </para>
286
287
288 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
289 href="../../xincludes/static-libraries.xml"/>
290 -->
291
292 <para>
293 <option>-D os_type=lfs</option>: Use this switch if you did not create
294 the <filename>/etc/lfs-release</filename> file or distribution auto
295 detection will fail and you will be unable to use
296 <application>Polkit</application>.
297 </para>
298
299 <para>
300 <option>-D authfw=shadow</option>: This switch enables the
301 package to use the <application>Shadow</application> rather than the
302 <application>Linux PAM</application> Authentication framework. Use it
303 if you have not installed <application>Linux PAM</application>.
304 </para>
305
306 <!--
307 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
308 href="../../xincludes/gtk-doc-rebuild.xml"/>
309 -->
310
311 <para>
312 <option>-D introspection=false</option>: Use this option if you are certain
313 that you do not need gobject-introspection files for polkit, or do not have
314 installed <xref linkend='glib2'/> with GObject Introspection.
315 </para>
316
317 <para>
318 <option>-D man=false</option>: Use this option to disable generating and
319 installing manual pages. This is useful if libxslt is not installed.
320 </para>
321
322 <para>
323 <option>-D examples=true</option>: Use this option to build the example
324 programs.
325 </para>
326
327 <para>
328 <option>-D gtk_doc=true</option>: Use this option to enable building and
329 installing the API documentation.
330 </para>
331
332 </sect2>
333
334 <sect2 role="content">
335 <title>Contents</title>
336
337 <segmentedlist>
338 <segtitle>Installed Programs</segtitle>
339 <segtitle>Installed Libraries</segtitle>
340 <segtitle>Installed Directories</segtitle>
341
342 <seglistitem>
343 <seg>
344 pkaction, pkcheck, <!--pk-example-frobnicate,--> pkexec,
345 pkttyagent, and polkitd
346 </seg>
347 <seg>
348 libpolkit-agent-1.so and
349 libpolkit-gobject-1.so
350 </seg>
351 <seg>
352 /etc/polkit-1,
353 /usr/include/polkit-1,
354 /usr/lib/polkit-1,
355 /usr/share/gtk-doc/html/polkit-1, and
356 /usr/share/polkit-1
357 </seg>
358 </seglistitem>
359 </segmentedlist>
360
361 <variablelist>
362 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
363 <?dbfo list-presentation="list"?>
364 <?dbhtml list-presentation="table"?>
365
366 <varlistentry id="pkaction">
367 <term><command>pkaction</command></term>
368 <listitem>
369 <para>
370 is used to obtain information about registered PolicyKit actions
371 </para>
372 <indexterm zone="polkit pkaction">
373 <primary sortas="b-pkaction">pkaction</primary>
374 </indexterm>
375 </listitem>
376 </varlistentry>
377
378 <varlistentry id="pkcheck">
379 <term><command>pkcheck</command></term>
380 <listitem>
381 <para>
382 is used to check whether a process is authorized for action
383 </para>
384 <indexterm zone="polkit pkcheck">
385 <primary sortas="b-pkcheck">pkcheck</primary>
386 </indexterm>
387 </listitem>
388 </varlistentry>
389
390<!--
391 <varlistentry id="pk-example-frobnicate">
392 <term><command>pk-example-frobnicate</command></term>
393 <listitem>
394 <para>
395 is an example program to test the <command>pkexec</command>
396 command
397 </para>
398 <indexterm zone="polkit pk-example-frobnicate">
399 <primary sortas="b-pk-example-frobnicate">pk-example-frobnicate</primary>
400 </indexterm>
401 </listitem>
402 </varlistentry>
403-->
404
405 <varlistentry id="pkexec">
406 <term><command>pkexec</command></term>
407 <listitem>
408 <para>
409 allows an authorized user to execute a command as another user
410 </para>
411 <indexterm zone="polkit pkexec">
412 <primary sortas="b-pkexec">pkexec</primary>
413 </indexterm>
414 </listitem>
415 </varlistentry>
416
417 <varlistentry id="pkttyagent">
418 <term><command>pkttyagent</command></term>
419 <listitem>
420 <para>
421 is used to start a textual authentication agent for the subject
422 </para>
423 <indexterm zone="polkit pkttyagent">
424 <primary sortas="b-pkttyagent">pkttyagent</primary>
425 </indexterm>
426 </listitem>
427 </varlistentry>
428
429 <varlistentry id="polkitd">
430 <term><command>polkitd</command></term>
431 <listitem>
432 <para>
433 provides the org.freedesktop.PolicyKit1 <application>D-Bus</application>
434 service on the system message bus
435 </para>
436 <indexterm zone="polkit polkitd">
437 <primary sortas="b-polkitd">polkitd</primary>
438 </indexterm>
439 </listitem>
440 </varlistentry>
441
442 <varlistentry id="libpolkit-agent-1">
443 <term><filename class="libraryfile">libpolkit-agent-1.so</filename></term>
444 <listitem>
445 <para>
446 contains the <application>Polkit</application> authentication
447 agent API functions
448 </para>
449 <indexterm zone="polkit libpolkit-agent-1">
450 <primary sortas="c-libpolkit-agent-1">libpolkit-agent-1.so</primary>
451 </indexterm>
452 </listitem>
453 </varlistentry>
454
455 <varlistentry id="libpolkit-gobject-1">
456 <term><filename class="libraryfile">libpolkit-gobject-1.so</filename></term>
457 <listitem>
458 <para>
459 contains the <application>Polkit</application> authorization API functions
460 </para>
461 <indexterm zone="polkit libpolkit-gobject-1">
462 <primary sortas="c-libpolkit-gobject-1">libpolkit-gobject-1.so</primary>
463 </indexterm>
464 </listitem>
465 </varlistentry>
466
467 </variablelist>
468
469 </sect2>
470
471</sect1>
Note: See TracBrowser for help on using the repository browser.