polkit

The polkit module is the check behind every admin action of an Atlas root helper: a D-Bus service on the system bus, started on demand. Call it at the top of each method that does something only an administrator should. It needs the polkit feature of atlas-framework-system.

The subject is the caller's unique bus name (system-bus-name): polkit asks the bus who is behind it, so a caller cannot pass for another process, as it can with a PID (a PID can be reused by the time polkit looks). Anything but a clear yes is an error, so the check fails closed.

It runs on Tokio with timers enabled (#[tokio::main] and Builder::enable_all do that). A non-interactive check gives up after 25 seconds; an interactive one waits for the person at the password prompt.

Example

use atlas_framework_system::polkit;

struct Helper;

#[zbus::interface(name = "net.eterneon.atlas.Example1")]
impl Helper {
    async fn do_thing(
        &self,
        #[zbus(header)] header: zbus::message::Header<'_>,
        #[zbus(connection)] conn: &zbus::Connection,
    ) -> zbus::fdo::Result<()> {
        polkit::check(conn, &header, "net.eterneon.atlas.example.do-thing", true)
            .await
            .map_err(|e| zbus::fdo::Error::AccessDenied(e.to_string()))?;
        // ... validate the arguments, then act
        Ok(())
    }
}

The action ID must be declared in a polkit policy file the helper's package ships.

Items

Denied