`e76249f`

Send cookie only to socket helper

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: e76249f555190e1f654ea3eb87307dfcafff9366
Parents: f2eb902
Tree: 3cbb92b

1 changed file

Status	File	+	-
M	`garcard/src/polkit_helper.rs`	8	11

garcard/src/polkit_helper.rsmodified

          cookie: &str,
          prompts: &mut P,
      ) -> Result<HelperOutcome> {
 -        let username_line = sanitize_control_line(username);
 +        let username_label = sanitize_control_line(username);
          let cookie_line = sanitize_control_line(cookie);
          let mut stream = UnixStream::connect(&self.socket_path).with_context(|| {
              format!(
          })?;
          let cookie_preview: String = cookie_line.chars().take(16).collect();
          tracing::debug!(
 -            username = %username_line,
 +            username = %username_label,
              cookie_len = cookie_line.len(),
              cookie_preview = %cookie_preview,
              socket = %self.socket_path.display(),
 +            protocol = "socket-activated-cookie-only",
              "Connected to polkit helper socket"
          );
 -        if username_line.len() != username.len() || cookie_line.len() != cookie.len() {
 +        if username_label.len() != username.len() || cookie_line.len() != cookie.len() {
              tracing::debug!(
                  original_username_len = username.len(),
 -                normalized_username_len = username_line.len(),
 +                normalized_username_len = username_label.len(),
                  original_cookie_len = cookie.len(),
                  normalized_cookie_len = cookie_line.len(),
                  "Normalized helper auth control lines before send"
              .context("failed to clone helper socket stream")?;
          let mut reader = BufReader::new(read_stream);
 -        write_line(&mut stream, &username_line).context("failed to send helper username")?;
 +        // socket-activated polkit helper resolves identity from peer credentials.
 +        // It expects only the cookie line from the agent protocol stream.
          write_line(&mut stream, &cookie_line).context("failed to send helper cookie")?;
          loop {
              let read_stream = stream.try_clone().expect("clone");
              let mut reader = BufReader::new(read_stream);
 -            let mut username = String::new();
 -            reader.read_line(&mut username).expect("read username");
              let mut cookie = String::new();
              reader.read_line(&mut cookie).expect("read cookie");
+             {
                  let mut lines = transcript_for_thread.lock().expect("lock transcript");
 -                lines.push(username.trim().to_string());
                  lines.push(cookie.trim().to_string());
                  lines.push(secret.trim().to_string());
+             }
          server.join().expect("server join");
          let lines = transcript.lock().expect("lock transcript");
 -        assert_eq!(lines.as_slice(), ["alice", "cookie-123", "correct horse"]);
 +        assert_eq!(lines.as_slice(), ["cookie-123", "correct horse"]);
          let _ = std::fs::remove_file(&socket_path);
+     }
              let read_stream = stream.try_clone().expect("clone");
              let mut reader = BufReader::new(read_stream);
 -            let mut username = String::new();
 -            reader.read_line(&mut username).expect("read username");
              let mut cookie = String::new();
              reader.read_line(&mut cookie).expect("read cookie");