source: postlfs/security/polkit.xml@ ad539dbe

10.1 11.0 11.1 11.2 lazarus plabs/python-mods qt5new trunk upgradedb xry111/intltool xry111/soup3 xry111/test-20220226
Last change on this file since ad539dbe was ad539dbe, checked in by Pierre Labastie <pieere@…>, 2 years ago

Linux-PAM: fix for not installing a .service file on sysv
Polkit: reinstate the elogind patch, which is still needed

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23722 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 13.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY polkit-download-http "https://www.freedesktop.org/software/polkit/releases/polkit-&polkit-version;.tar.gz">
8 <!ENTITY polkit-download-ftp " ">
9 <!ENTITY polkit-md5sum "ae3f2a742740069922589ad20ffd54d2">
10 <!ENTITY polkit-size "1.5 MB">
11 <!ENTITY polkit-buildsize "17 MB (add 2 MB for tests)">
12 <!ENTITY polkit-time "0.1 SBU (Using parallelism=4; add 0.3 SBU for tests)">
13]>
14
15<sect1 id="polkit" xreflabel="Polkit-&polkit-version;">
16 <?dbhtml filename="polkit.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Polkit-&polkit-version;</title>
24
25 <indexterm zone="polkit">
26 <primary sortas="a-Polkit">Polkit</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Polkit</title>
31
32 <para>
33 <application>Polkit</application> is a toolkit for defining and handling
34 authorizations. It is used for allowing unprivileged processes to
35 communicate with privileged processes.
36 </para>
37
38 &lfs10_checked;
39
40 <bridgehead renderas="sect3">Package Information</bridgehead>
41 <itemizedlist spacing="compact">
42 <listitem>
43 <para>
44 Download (HTTP): <ulink url="&polkit-download-http;"/>
45 </para>
46 </listitem>
47 <listitem>
48 <para>
49 Download (FTP): <ulink url="&polkit-download-ftp;"/>
50 </para>
51 </listitem>
52 <listitem>
53 <para>
54 Download MD5 sum: &polkit-md5sum;
55 </para>
56 </listitem>
57 <listitem>
58 <para>
59 Download size: &polkit-size;
60 </para>
61 </listitem>
62 <listitem>
63 <para>
64 Estimated disk space required: &polkit-buildsize;
65 </para>
66 </listitem>
67 <listitem>
68 <para>
69 Estimated build time: &polkit-time;
70 </para>
71 </listitem>
72 </itemizedlist>
73
74 <bridgehead renderas="sect3"
75 revision="sysv">Additional Downloads</bridgehead>
76 <itemizedlist spacing="compact" revision="sysv">
77 <listitem>
78 <para>
79 Recommended patch:
80 <ulink url="&patch-root;/polkit-&polkit-version;-fix_elogind_detection-1.patch"/>
81 </para>
82 </listitem>
83 </itemizedlist>
84
85 <bridgehead renderas="sect3">Polkit Dependencies</bridgehead>
86
87 <bridgehead renderas="sect4">Required</bridgehead>
88 <para role="required">
89 <xref linkend="glib2"/> and
90 <xref linkend="js78"/>
91 </para>
92
93 <bridgehead renderas="sect4">Recommended</bridgehead>
94 <para role="recommended">
95 <xref linkend="linux-pam"/>
96 <phrase revision="sysv">and <xref linkend="elogind"/></phrase>
97 </para>
98
99 <note>
100 <para>
101 Since <phrase revision="sysv"><command>elogind</command></phrase>
102 <phrase revision="systemd"><command>systemd-logind</command></phrase>
103 uses PAM to register user sessions, it is a good idea to build
104 <application>Polkit</application> with PAM support so
105 <phrase revision="sysv"><command>elogind</command></phrase>
106 <phrase revision="systemd"><command>systemd-logind</command></phrase>
107 can track <application>Polkit</application> sessions.
108 </para>
109 </note>
110
111
112 <bridgehead renderas="sect4">Optional (Required if building GNOME)</bridgehead>
113 <para role="optional">
114 <xref linkend="gobject-introspection"/>
115 </para>
116
117 <bridgehead renderas="sect4">Optional</bridgehead>
118 <para role="optional">
119 <xref linkend="dbus-python"/> and
120 <xref linkend="python-dbusmock"/> (for tests),
121 <xref linkend="DocBook"/>,
122 <xref linkend="docbook-xsl"/>,
123 <xref linkend="gtk-doc"/>, and
124 <xref linkend="libxslt"/>
125 </para>
126
127 <bridgehead renderas="sect4" revision="systemd">Required Runtime Dependencies</bridgehead>
128 <para role="required" revision="systemd">
129 <xref role="runtime" linkend="systemd"/>
130 </para>
131
132 <bridgehead renderas="sect4" id="polkit-agent" xreflabel="Polkit Authentication Agent">
133 Optional Runtime Dependencies
134 </bridgehead>
135 <para role="optional">
136 One polkit authentication agent for using polkit in the graphical
137 environment:
138 <application>polkit-kde-agent</application> in
139 <xref role="runtime" linkend="plasma5-build"/> for KDE,
140 the agent built in
141 <xref role="runtime" linkend="gnome-shell"/> for GNOME3,
142 <xref role="runtime" linkend="polkit-gnome"/> for XFCE, and
143 <application>lxpolkit</application> in
144 <xref role="runtime" linkend="lxsession"/> for LXDE.
145 </para>
146
147 <note>
148 <para>
149 If <xref linkend="libxslt"/> is installed,
150 then <xref linkend="DocBook"/> and <xref linkend="docbook-xsl"/> are
151 required. If you have installed <xref linkend="libxslt"/>, but you do
152 not want to install any of the DocBook packages mentioned, you will
153 need to use <option>--disable-man-pages</option> in the instructions
154 below.
155 </para>
156 </note>
157
158 <para condition="html" role="usernotes">User Notes:
159 <ulink url="&blfs-wiki;/polkit"/>
160 </para>
161 </sect2>
162
163 <sect2 role="installation">
164 <title>Installation of Polkit</title>
165
166 <para>
167 There should be a dedicated user and group to take control
168 of the <command>polkitd</command> daemon after it is
169 started. Issue the following commands as the
170 <systemitem class="username">root</systemitem> user:
171 </para>
172
173<screen role="root"><userinput>groupadd -fg 27 polkitd &amp;&amp;
174useradd -c "PolicyKit Daemon Owner" -d /etc/polkit-1 -u 27 \
175 -g polkitd -s /bin/false polkitd</userinput></screen>
176
177 <note revision="systemd">
178 <para>
179 When building <application>Polkit</application> with
180 <application>systemd</application> logind support, the
181 <command>configure</command> script explicitly checks if
182 system is booted using <application>systemd</application>.
183 This can cause problems if building the package in chroot,
184 where the <command>configure</command> would fail to
185 detect <application>systemd</application>. To workaround
186 the problem, simply run the following command:
187 </para>
188
189<screen><userinput>sed -i "s:/sys/fs/cgroup/systemd/:/sys:g" configure</userinput></screen>
190 </note>
191
192 <para revision="sysv">
193 Fix an issue introduced in recent <application>Polkit</application>
194 releases with elogind:
195 </para>
196
197<screen revision="sysv"><userinput>patch -Np1 -i ../polkit-&polkit-version;-fix_elogind_detection-1.patch &amp;&amp;
198autoreconf -fi</userinput></screen>
199
200 <para>
201 Install <application>Polkit</application> by running the following
202 commands:
203 </para>
204
205<screen revision="systemd"><userinput>./configure --prefix=/usr \
206 --sysconfdir=/etc \
207 --localstatedir=/var \
208 --disable-static \
209 --with-os-type=LFS &amp;&amp;
210make</userinput></screen>
211
212<screen revision="sysv"><userinput>./configure --prefix=/usr \
213 --sysconfdir=/etc \
214 --localstatedir=/var \
215 --disable-static \
216 --with-os-type=LFS \
217 --disable-libsystemd-login &amp;&amp;
218make</userinput></screen>
219
220 <para>
221 To test the results, first ensure that the system
222 <application>D-Bus</application> daemon is running.
223 Then run <command>make check</command>.
224 </para>
225
226 <para>
227 Now, as the <systemitem class="username">root</systemitem> user:
228 </para>
229
230<screen role="root"><userinput>make install</userinput></screen>
231
232 </sect2>
233
234 <sect2 role="commands">
235 <title>Command Explanations</title>
236
237 <para revision="sysv">
238 <parameter>--disable-libsystemd-login</parameter>: This switch forces
239 polkit to build with elogind support (if available) rather than
240 systemd-logind.
241 </para>
242
243 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
244 href="../../xincludes/static-libraries.xml"/>
245
246 <para>
247 <option>--with-authfw=shadow</option>: This switch enables the
248 package to use the <application>Shadow</application> rather than the
249 <application>Linux PAM</application> Authentication framework. Use it
250 if you have not installed <application>Linux PAM</application>.
251 </para>
252
253 <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
254 href="../../xincludes/gtk-doc-rebuild.xml"/>
255
256 </sect2>
257
258 <sect2 role="configuration">
259 <title>Configuring Polkit</title>
260
261 <sect3>
262 <title>PAM Configuration</title>
263
264 <note>
265 <para>
266 If you did not build <application>Polkit</application> with
267 <application>Linux PAM</application> support, you can skip this
268 section.
269 </para>
270 </note>
271
272 <para>
273 If you have built <application>Polkit</application> with
274 <application>Linux PAM</application> support, you need to modify
275 the default PAM configuration file which was installed by default to get
276 <application>Polkit</application> to work correctly with BLFS. Issue the
277 following commands as the <systemitem class="username">root</systemitem>
278 user to create the configuration file for <application>Linux PAM</application>:
279 </para>
280
281<screen role="root"><userinput>cat &gt; /etc/pam.d/polkit-1 &lt;&lt; "EOF"
282<literal># Begin /etc/pam.d/polkit-1
283
284auth include system-auth
285account include system-account
286password include system-password
287session include system-session
288
289# End /etc/pam.d/polkit-1</literal>
290EOF</userinput></screen>
291
292 </sect3>
293
294 </sect2>
295
296 <sect2 role="content">
297 <title>Contents</title>
298
299 <segmentedlist>
300 <segtitle>Installed Programs</segtitle>
301 <segtitle>Installed Libraries</segtitle>
302 <segtitle>Installed Directories</segtitle>
303
304 <seglistitem>
305 <seg>
306 pkaction, pkcheck, pk-example-frobnicate, pkexec,
307 pkttyagent and polkitd
308 </seg>
309 <seg>
310 libpolkit-agent-1.so and
311 libpolkit-gobject-1.so
312 </seg>
313 <seg>
314 /etc/polkit-1,
315 /usr/include/polkit-1,
316 /usr/lib/polkit-1,
317 /usr/share/gtk-doc/html/polkit-1 and
318 /usr/share/polkit-1
319 </seg>
320 </seglistitem>
321 </segmentedlist>
322
323 <variablelist>
324 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
325 <?dbfo list-presentation="list"?>
326 <?dbhtml list-presentation="table"?>
327
328 <varlistentry id="pkaction">
329 <term><command>pkaction</command></term>
330 <listitem>
331 <para>
332 is used to obtain information about registered PolicyKit actions.
333 </para>
334 <indexterm zone="polkit pkaction">
335 <primary sortas="b-pkaction">pkaction</primary>
336 </indexterm>
337 </listitem>
338 </varlistentry>
339
340 <varlistentry id="pkcheck">
341 <term><command>pkcheck</command></term>
342 <listitem>
343 <para>
344 is used to check whether a process is authorized for action.
345 </para>
346 <indexterm zone="polkit pkcheck">
347 <primary sortas="b-pkcheck">pkcheck</primary>
348 </indexterm>
349 </listitem>
350 </varlistentry>
351
352 <varlistentry id="pk-example-frobnicate">
353 <term><command>pk-example-frobnicate</command></term>
354 <listitem>
355 <para>
356 is an example program to test the <command>pkexec</command>
357 command.
358 </para>
359 <indexterm zone="polkit pk-example-frobnicate">
360 <primary sortas="b-pk-example-frobnicate">pk-example-frobnicate</primary>
361 </indexterm>
362 </listitem>
363 </varlistentry>
364
365 <varlistentry id="pkexec">
366 <term><command>pkexec</command></term>
367 <listitem>
368 <para>
369 allows an authorized user to execute a command as another user.
370 </para>
371 <indexterm zone="polkit pkexec">
372 <primary sortas="b-pkexec">pkexec</primary>
373 </indexterm>
374 </listitem>
375 </varlistentry>
376
377 <varlistentry id="pkttyagent">
378 <term><command>pkttyagent</command></term>
379 <listitem>
380 <para>
381 is used to start a textual authentication agent for the subject.
382 </para>
383 <indexterm zone="polkit pkttyagent">
384 <primary sortas="b-pkttyagent">pkttyagent</primary>
385 </indexterm>
386 </listitem>
387 </varlistentry>
388
389 <varlistentry id="polkitd">
390 <term><command>polkitd</command></term>
391 <listitem>
392 <para>
393 provides the org.freedesktop.PolicyKit1 <application>D-Bus</application>
394 service on the system message bus.
395 </para>
396 <indexterm zone="polkit polkitd">
397 <primary sortas="b-polkitd">polkitd</primary>
398 </indexterm>
399 </listitem>
400 </varlistentry>
401
402 <varlistentry id="libpolkit-agent-1">
403 <term><filename class='libraryfile'>libpolkit-agent-1.so</filename></term>
404 <listitem>
405 <para>
406 contains the <application>Polkit</application> authentication
407 agent API functions.
408 </para>
409 <indexterm zone="polkit libpolkit-agent-1">
410 <primary sortas="c-libpolkit-agent-1">libpolkit-agent-1.so</primary>
411 </indexterm>
412 </listitem>
413 </varlistentry>
414
415 <varlistentry id="libpolkit-gobject-1">
416 <term><filename class='libraryfile'>libpolkit-gobject-1.so</filename></term>
417 <listitem>
418 <para>
419 contains the <application>Polkit</application> authorization API functions.
420 </para>
421 <indexterm zone="polkit libpolkit-gobject-1">
422 <primary sortas="c-libpolkit-gobject-1">libpolkit-gobject-1.so</primary>
423 </indexterm>
424 </listitem>
425 </varlistentry>
426
427 </variablelist>
428
429 </sect2>
430
431</sect1>
Note: See TracBrowser for help on using the repository browser.