colin/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth-provider: refactor and simplify

Browse Source 
The auth provider setup is a bit over-engineered. Simplify it by
making a single MMAuthProvider object that may or may not use polkit,
depending on configure options. This object is also setup as a
singleton object using the helper MM_DEFINE_SINGLETON_GETTER().
This commit is contained in:
Aleksander Morgado
2020-01-10 14:47:40 +01:00
committed by Dan Williams
parent a6a3db2184
commit 20ab6550fb
10 changed files with 173 additions and 418 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/Makefile.am
View File

@@ -286,8 +286,6 @@ ModemManager_SOURCES = \
mm-utils.h \
mm-private-boxed-types.h \
mm-private-boxed-types.c \
mm-auth.h \
mm-auth.c \
mm-auth-provider.h \
mm-auth-provider.c \
mm-filter.h \
@@ -355,11 +353,6 @@ ModemManager_SOURCES = \
nodist_ModemManager_SOURCES = $(DAEMON_ENUMS_GENERATED)
# Additional Polkit support
if WITH_POLKIT
ModemManager_SOURCES += mm-auth-provider-polkit.h mm-auth-provider-polkit.c
endif
# Additional suspend/resume support via systemd
if WITH_SYSTEMD_SUSPEND_RESUME
ModemManager_SOURCES += mm-sleep-monitor.h mm-sleep-monitor.c

197
src/mm-auth-provider-polkit.c
View File

@@ -1,197 +0,0 @@
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details:
*
* Copyright (C) 2010 - 2012 Red Hat, Inc.
* Copyright (C) 2012 Google, Inc.
*/
#include <polkit/polkit.h>
#include <config.h>
#include <ModemManager.h>
#include "mm-errors-types.h"
#include "mm-log.h"
#include "mm-auth-provider-polkit.h"
G_DEFINE_TYPE (MMAuthProviderPolkit, mm_auth_provider_polkit, MM_TYPE_AUTH_PROVIDER)
struct _MMAuthProviderPolkitPrivate {
PolkitAuthority *authority;
};
/*****************************************************************************/
MMAuthProvider *
mm_auth_provider_polkit_new (void)
{
return g_object_new (MM_TYPE_AUTH_PROVIDER_POLKIT, NULL);
}
/*****************************************************************************/
typedef struct {
PolkitSubject *subject;
gchar *authorization;
GDBusMethodInvocation *invocation;
} AuthorizeContext;
static void
authorize_context_free (AuthorizeContext *ctx)
{
g_object_unref (ctx->invocation);
g_object_unref (ctx->subject);
g_free (ctx->authorization);
g_free (ctx);
}
static gboolean
authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error)
{
return g_task_propagate_boolean (G_TASK (res), error);
}
static void
check_authorization_ready (PolkitAuthority *authority,
GAsyncResult *res,
GTask *task)
{
PolkitAuthorizationResult *pk_result;
GError *error = NULL;
AuthorizeContext *ctx;
if (g_task_return_error_if_cancelled (task)) {
g_object_unref (task);
return;
}
ctx = g_task_get_task_data (task);
pk_result = polkit_authority_check_authorization_finish (authority, res, &error);
if (!pk_result) {
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_FAILED,
"PolicyKit authorization failed: '%s'",
error->message);
g_error_free (error);
} else {
if (polkit_authorization_result_get_is_authorized (pk_result))
/* Good! */
g_task_return_boolean (task, TRUE);
else if (polkit_authorization_result_get_is_challenge (pk_result))
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_UNAUTHORIZED,
"PolicyKit authorization failed: challenge needed for '%s'",
ctx->authorization);
else
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_UNAUTHORIZED,
"PolicyKit authorization failed: not authorized for '%s'",
ctx->authorization);
g_object_unref (pk_result);
}
g_object_unref (task);
}
static void
authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data)
{
MMAuthProviderPolkit *polkit = MM_AUTH_PROVIDER_POLKIT (self);
AuthorizeContext *ctx;
GTask *task;
/* When creating the object, we actually allowed errors when looking for the
* authority. If that is the case, we'll just forbid any incoming
* authentication request */
if (!polkit->priv->authority) {
g_task_report_new_error (self,
callback,
user_data,
authorize,
MM_CORE_ERROR,
MM_CORE_ERROR_FAILED,
"PolicyKit authorization error: "
"'authority not found'");
return;
}
ctx = g_new (AuthorizeContext, 1);
ctx->invocation = g_object_ref (invocation);
ctx->authorization = g_strdup (authorization);
ctx->subject = polkit_system_bus_name_new (g_dbus_method_invocation_get_sender (ctx->invocation));
task = g_task_new (self, cancellable, callback, user_data);
g_task_set_task_data (task, ctx, (GDestroyNotify)authorize_context_free);
polkit_authority_check_authorization (polkit->priv->authority,
ctx->subject,
authorization,
NULL, /* details */
POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION,
cancellable,
(GAsyncReadyCallback)check_authorization_ready,
task);
}
/*****************************************************************************/
static void
mm_auth_provider_polkit_init (MMAuthProviderPolkit *self)
{
GError *error = NULL;
self->priv = G_TYPE_INSTANCE_GET_PRIVATE (self,
MM_TYPE_AUTH_PROVIDER_POLKIT,
MMAuthProviderPolkitPrivate);
self->priv->authority = polkit_authority_get_sync (NULL, &error);
if (!self->priv->authority) {
/* NOTE: we failed to create the polkit authority, but we still create
* our AuthProvider. Every request will fail, though. */
mm_warn ("failed to create PolicyKit authority: '%s'",
error ? error->message : "unknown");
g_clear_error (&error);
}
}
static void
dispose (GObject *object)
{
g_clear_object (&(MM_AUTH_PROVIDER_POLKIT (object)->priv->authority));
G_OBJECT_CLASS (mm_auth_provider_polkit_parent_class)->dispose (object);
}
static void
mm_auth_provider_polkit_class_init (MMAuthProviderPolkitClass *class)
{
GObjectClass *object_class = G_OBJECT_CLASS (class);
MMAuthProviderClass *auth_provider_class = MM_AUTH_PROVIDER_CLASS (class);
g_type_class_add_private (class, sizeof (MMAuthProviderPolkitPrivate));
/* Virtual methods */
object_class->dispose = dispose;
auth_provider_class->authorize = authorize;
auth_provider_class->authorize_finish = authorize_finish;
}

46
src/mm-auth-provider-polkit.h
View File

@@ -1,46 +0,0 @@
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details:
*
* Copyright (C) 2010 - 2012 Red Hat, Inc.
* Copyright (C) 2012 Google, Inc.
*/
#ifndef MM_AUTH_PROVIDER_POLKIT_H
#define MM_AUTH_PROVIDER_POLKIT_H
#include "mm-auth-provider.h"
#define MM_TYPE_AUTH_PROVIDER_POLKIT (mm_auth_provider_polkit_get_type ())
#define MM_AUTH_PROVIDER_POLKIT(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), MM_TYPE_AUTH_PROVIDER_POLKIT, MMAuthProviderPolkit))
#define MM_AUTH_PROVIDER_POLKIT_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), MM_TYPE_AUTH_PROVIDER_POLKIT, MMAuthProviderPolkitClass))
#define MM_IS_AUTH_PROVIDER_POLKIT(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), MM_TYPE_AUTH_PROVIDER_POLKIT))
#define MM_IS_AUTH_PROVIDER_POLKIT_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), MM_TYPE_AUTH_PROVIDER_POLKIT))
#define MM_AUTH_PROVIDER_POLKIT_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), MM_TYPE_AUTH_PROVIDER_POLKIT, MMAuthProviderPolkitClass))
typedef struct _MMAuthProviderPolkit MMAuthProviderPolkit;
typedef struct _MMAuthProviderPolkitClass MMAuthProviderPolkitClass;
typedef struct _MMAuthProviderPolkitPrivate MMAuthProviderPolkitPrivate;
struct _MMAuthProviderPolkit {
MMAuthProvider parent;
MMAuthProviderPolkitPrivate *priv;
};
struct _MMAuthProviderPolkitClass {
MMAuthProviderClass parent;
};
GType mm_auth_provider_polkit_get_type (void);
MMAuthProvider *mm_auth_provider_polkit_new (void);
#endif /* MM_AUTH_PROVIDER_POLKIT_H */

204
src/mm-auth-provider.c
View File

@@ -12,75 +12,153 @@
*
* Copyright (C) 2010 - 2012 Red Hat, Inc.
* Copyright (C) 2012 Google, Inc.
* Copyright (C) 2020 Aleksander Morgado <aleksander@aleksander.es>
*/
#include <config.h>
#include <ModemManager.h>
#include "mm-errors-types.h"
#include "mm-log.h"
#include "mm-utils.h"
#include "mm-auth-provider.h"
#if defined WITH_POLKIT
# include <polkit/polkit.h>
#endif
struct _MMAuthProvider {
GObject parent;
#if defined WITH_POLKIT
PolkitAuthority *authority;
#endif
};
struct _MMAuthProviderClass {
GObjectClass parent;
};
G_DEFINE_TYPE (MMAuthProvider, mm_auth_provider, G_TYPE_OBJECT)
/*****************************************************************************/
MMAuthProvider *
mm_auth_provider_new (void)
{
return g_object_new (MM_TYPE_AUTH_PROVIDER, NULL);
}
/*****************************************************************************/
gboolean
mm_auth_provider_authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error)
mm_auth_provider_authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error)
{
g_return_val_if_fail (MM_IS_AUTH_PROVIDER (self), FALSE);
return MM_AUTH_PROVIDER_GET_CLASS (self)->authorize_finish (self, res, error);
return g_task_propagate_boolean (G_TASK (res), error);
}
void
mm_auth_provider_authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data)
#if defined WITH_POLKIT
typedef struct {
PolkitSubject *subject;
gchar *authorization;
GDBusMethodInvocation *invocation;
} AuthorizeContext;
static void
authorize_context_free (AuthorizeContext *ctx)
{
g_return_if_fail (MM_IS_AUTH_PROVIDER (self));
MM_AUTH_PROVIDER_GET_CLASS (self)->authorize (self,
invocation,
authorization,
cancellable,
callback,
user_data);
}
/*****************************************************************************/
static gboolean
authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error)
{
/* Null auth; everything passes */
return TRUE;
g_object_unref (ctx->invocation);
g_object_unref (ctx->subject);
g_free (ctx->authorization);
g_free (ctx);
}
static void
authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data)
check_authorization_ready (PolkitAuthority *authority,
GAsyncResult *res,
GTask *task)
{
PolkitAuthorizationResult *pk_result;
GError *error = NULL;
AuthorizeContext *ctx;
if (g_task_return_error_if_cancelled (task)) {
g_object_unref (task);
return;
}
ctx = g_task_get_task_data (task);
pk_result = polkit_authority_check_authorization_finish (authority, res, &error);
if (!pk_result) {
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_FAILED,
"PolicyKit authorization failed: '%s'",
error->message);
g_error_free (error);
} else {
if (polkit_authorization_result_get_is_authorized (pk_result))
/* Good! */
g_task_return_boolean (task, TRUE);
else if (polkit_authorization_result_get_is_challenge (pk_result))
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_UNAUTHORIZED,
"PolicyKit authorization failed: challenge needed for '%s'",
ctx->authorization);
else
g_task_return_new_error (task,
MM_CORE_ERROR,
MM_CORE_ERROR_UNAUTHORIZED,
"PolicyKit authorization failed: not authorized for '%s'",
ctx->authorization);
g_object_unref (pk_result);
}
g_object_unref (task);
}
#endif
void
mm_auth_provider_authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data)
{
GTask *task;
/* Just create the result and complete it */
task = g_task_new (self, cancellable, callback, user_data);
#if defined WITH_POLKIT
{
AuthorizeContext *ctx;
/* When creating the object, we actually allowed errors when looking for the
* authority. If that is the case, we'll just forbid any incoming
* authentication request */
if (!self->authority) {
g_task_return_new_error (task, MM_CORE_ERROR, MM_CORE_ERROR_FAILED,
"PolicyKit authorization error: 'authority not found'");
g_object_unref (task);
return;
}
ctx = g_new (AuthorizeContext, 1);
ctx->invocation = g_object_ref (invocation);
ctx->authorization = g_strdup (authorization);
ctx->subject = polkit_system_bus_name_new (g_dbus_method_invocation_get_sender (ctx->invocation));
g_task_set_task_data (task, ctx, (GDestroyNotify)authorize_context_free);
polkit_authority_check_authorization (self->authority,
ctx->subject,
authorization,
NULL, /* details */
POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION,
cancellable,
(GAsyncReadyCallback)check_authorization_ready,
task);
}
#else
/* Just create the result and complete it */
g_task_return_boolean (task, TRUE);
g_object_unref (task);
#endif
}
/*****************************************************************************/
@@ -88,12 +166,38 @@ authorize (MMAuthProvider *self,
static void
mm_auth_provider_init (MMAuthProvider *self)
{
#if defined WITH_POLKIT
{
GError *error = NULL;
self->authority = polkit_authority_get_sync (NULL, &error);
if (!self->authority) {
/* NOTE: we failed to create the polkit authority, but we still create
* our AuthProvider. Every request will fail, though. */
mm_warn ("failed to create PolicyKit authority: '%s'",
error ? error->message : "unknown");
g_clear_error (&error);
}
}
#endif
}
static void
dispose (GObject *object)
{
#if defined WITH_POLKIT
g_clear_object (&(MM_AUTH_PROVIDER (object)->authority));
#endif
G_OBJECT_CLASS (mm_auth_provider_parent_class)->dispose (object);
}
static void
mm_auth_provider_class_init (MMAuthProviderClass *class)
{
/* Virtual methods */
class->authorize = authorize;
class->authorize_finish = authorize_finish;
GObjectClass *object_class = G_OBJECT_CLASS (class);
object_class->dispose = dispose;
}
MM_DEFINE_SINGLETON_GETTER (MMAuthProvider, mm_auth_provider_get, MM_TYPE_AUTH_PROVIDER)

49
src/mm-auth-provider.h
View File

@@ -17,6 +17,7 @@
#ifndef MM_AUTH_PROVIDER_H
#define MM_AUTH_PROVIDER_H
#include <config.h>
#include <gio/gio.h>
#define MM_TYPE_AUTH_PROVIDER (mm_auth_provider_get_type ())
@@ -37,41 +38,21 @@
#define MM_AUTHORIZATION_TIME "org.freedesktop.ModemManager1.Time"
#define MM_AUTHORIZATION_FIRMWARE "org.freedesktop.ModemManager1.Firmware"
typedef struct _MMAuthProvider MMAuthProvider;
typedef struct _MMAuthProviderClass MMAuthProviderClass;
typedef struct _MMAuthProvider MMAuthProvider;
typedef struct _MMAuthProviderClass MMAuthProviderClass;
typedef struct _MMAuthProviderPrivate MMAuthProviderPrivate;
struct _MMAuthProvider {
GObject parent;
};
GType mm_auth_provider_get_type (void);
MMAuthProvider *mm_auth_provider_get (void);
struct _MMAuthProviderClass {
GObjectClass parent;
/* Perform authorization checks in this request (async).
* Returns TRUE if authorized, FALSE if error is set. */
void (* authorize) (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
gboolean (* authorize_finish) (MMAuthProvider *self,
GAsyncResult *res,
GError **error);
};
GType mm_auth_provider_get_type (void);
MMAuthProvider *mm_auth_provider_new (void);
void mm_auth_provider_authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
gboolean mm_auth_provider_authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error);
void mm_auth_provider_authorize (MMAuthProvider *self,
GDBusMethodInvocation *invocation,
const gchar *authorization,
GCancellable *cancellable,
GAsyncReadyCallback callback,
gpointer user_data);
gboolean mm_auth_provider_authorize_finish (MMAuthProvider *self,
GAsyncResult *res,
GError **error);
#endif /* MM_AUTH_PROVIDER_H */

53
src/mm-auth.c
View File

@@ -1,53 +0,0 @@
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details:
*
* Copyright (C) 2010 - 2012 Red Hat, Inc.
* Copyright (C) 2012 Google, Inc.
*/
#include <string.h>
#include "config.h"
#include "mm-auth.h"
#include "mm-auth-provider.h"
#if defined WITH_POLKIT
# include "mm-auth-provider-polkit.h"
#endif
static MMAuthProvider *authp = NULL;
MMAuthProvider *
mm_auth_get_provider (void)
{
if (!authp) {
#if defined WITH_POLKIT
authp = mm_auth_provider_polkit_new ();
#else
authp = mm_auth_provider_new ();
#endif
}
g_assert (authp);
/* We'll keep the refcount of this object controlled, in order to have
* clean shutdowns */
return g_object_ref (authp);
}
void
mm_auth_shutdown (void)
{
/* Clear the last reference of the auth provider if it was ever set */
g_clear_object (&authp);
}

27
src/mm-auth.h
View File

@@ -1,27 +0,0 @@
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
/*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details:
*
* Copyright (C) 2010 - 2012 Red Hat, Inc.
* Copyright (C) 2012 Google, Inc.
*/
#ifndef MM_AUTH_H
#define MM_AUTH_H
#include "mm-auth-provider.h"
/* Get the default provider */
MMAuthProvider *mm_auth_get_provider (void);
void mm_auth_shutdown (void);
#endif /* MM_AUTH_H */

4
src/mm-base-manager.c
View File

@@ -41,7 +41,7 @@
#include "mm-daemon-enums-types.h"
#include "mm-device.h"
#include "mm-plugin-manager.h"
#include "mm-auth.h"
#include "mm-auth-provider.h"
#include "mm-plugin.h"
#include "mm-filter.h"
#include "mm-log.h"
@@ -1439,7 +1439,7 @@ mm_base_manager_init (MMBaseManager *manager)
MMBaseManagerPrivate);
/* Setup authorization provider */
priv->authp = mm_auth_get_provider ();
priv->authp = mm_auth_provider_get ();
priv->authp_cancellable = g_cancellable_new ();
/* Setup internal lists of device objects */

2
src/mm-base-modem.c
View File

@@ -1516,7 +1516,7 @@ mm_base_modem_init (MMBaseModem *self)
MMBaseModemPrivate);
/* Setup authorization provider */
self->priv->authp = mm_auth_get_provider ();
self->priv->authp = mm_auth_provider_get ();
self->priv->authp_cancellable = g_cancellable_new ();
/* Setup modem-wide cancellable */

2
src/mm-base-modem.h
View File

@@ -28,7 +28,7 @@
#include <mm-gdbus-modem.h>
#include "mm-auth.h"
#include "mm-auth-provider.h"
#include "mm-port.h"
#include "mm-kernel-device.h"
#include "mm-port-serial-at.h"