`18ebea4`

Prefer session user for helper auth

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 18ebea40bbd216b351b5d97c393014a8bb874344
Parents: 5ad012e
Tree: f0cdfeb

2 changed files

Status	File	+	-
M	`garcard/src/agent.rs`	50	8
M	`garcard/src/polkit_helper.rs`	19	15

garcard/src/agent.rsmodified

                  action_id = %active.action_id,
                  icon_name = %active.icon_name,
                  detail_count = active.detail_count,
 +                username = %active.username,
                  "Processing polkit auth request"
              );
+ }
  fn resolve_identity_username(identities: &[Subject]) -> Option<String> {
 +    let current = current_username();
 +    if let Some(current_name) = current.as_deref() {
 +        for (kind, details) in identities {
 +            if kind != "unix-user" {
 +                continue;
 +            }
++
 +            if let Some(name) = identity_name(details) {
 +                if name == current_name {
 +                    return Some(name);
 +                }
 +            }
 +        }
 +    }
++
      for (kind, details) in identities {
          if kind != "unix-user" {
              continue;
+         }
 -        if let Some(value) = details.get("name") {
 -            if let Ok(name) = <&str>::try_from(value) {
 -                return Some(name.to_string());
 -            }
 +        if let Some(name) = identity_name(details) {
 +            return Some(name);
+         }
 +    }
 -        if let Some(uid) = details.get("uid").and_then(parse_uid) {
 -            if let Some(name) = username_for_uid(uid) {
 -                return Some(name);
 -            }
 +    None
 +}
++
 +fn identity_name(details: &HashMap<String, OwnedValue>) -> Option<String> {
 +    if let Some(value) = details.get("name") {
 +        if let Ok(name) = <&str>::try_from(value) {
 +            return Some(name.to_string());
+         }
+     }
 +    if let Some(uid) = details.get("uid").and_then(parse_uid) {
 +        return username_for_uid(uid);
 +    }
++
      None
+ }
          let resolved = resolve_identity_username(&identities);
          assert_eq!(resolved, current_username());
+     }
++
 +    #[test]
 +    fn resolve_identity_username_prefers_current_user_name() {
 +        let mut first = HashMap::new();
 +        first.insert("uid".to_string(), OwnedValue::from(0_u32));
++
 +        let mut second = HashMap::new();
 +        second.insert(
 +            "uid".to_string(),
 +            OwnedValue::from(nix::unistd::geteuid().as_raw()),
 +        );
++
 +        let identities = vec![
 +            ("unix-user".to_string(), first),
 +            ("unix-user".to_string(), second),
 +        ];
++
 +        let resolved = resolve_identity_username(&identities);
 +        assert_eq!(resolved, current_username());
 +    }
+ }

garcard/src/polkit_helper.rsmodified

              if bytes == 0 {
                  anyhow::bail!("helper closed connection unexpectedly");
+             }
 +            tracing::debug!(
 +                helper_line = %line.trim_end_matches('\n').trim_end_matches('\r'),
 +                "Received helper protocol line"
 +            );
              let event = match parse_helper_line(&line) {
                  Ok(event) => event,
          return Ok(HelperEvent::Info(message.to_string()));
+     }
 -    // Some helper builds emit plain-text diagnostics instead of PAM_* protocol
 -    // lines. Classify known auth failures so callers can present proper retry UX
 -    // without treating successful paths as generic errors.
 -    let lower = line.to_ascii_lowercase();
 -    if lower.contains("pam_authenticate failed")
 -        || lower.contains("authentication failure")
 -        || lower.contains("no session for cookie")
 -    {
 -        return Ok(HelperEvent::Failure);
 -    }
      if line.starts_with("polkit-agent-helper-1:") {
 +        let lower = line.to_ascii_lowercase();
 +        if lower.contains("pam_authenticate failed")
 +            || lower.contains("authentication failure")
 +            || lower.contains("no session for cookie")
 +        {
 +            return Ok(HelperEvent::Error(line.to_string()));
 +        }
          return Ok(HelperEvent::Info(line.to_string()));
+     }
+     }
      #[test]
 -    fn parse_helper_line_maps_plaintext_failure_diagnostics() {
 +    fn parse_helper_line_maps_plaintext_failure_diagnostics_to_error() {
          assert_eq!(
              parse_helper_line(
                  "polkit-agent-helper-1: pam_authenticate failed: Authentication failure"
+             )
 -            .expect("maps failure"),
 -            HelperEvent::Failure
 +            .expect("maps error"),
 +            HelperEvent::Error(
 +                "polkit-agent-helper-1: pam_authenticate failed: Authentication failure"
 +                    .to_string()
 +            )
          );
          assert_eq!(
              parse_helper_line("polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie")
 -                .expect("maps cookie failure"),
 -            HelperEvent::Failure
 +                .expect("maps cookie error"),
 +            HelperEvent::Error("polkit-agent-helper-1: error response to PolicyKit daemon: GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed: No session for cookie".to_string())
          );
+     }