[cap-talk] Is Polkit (nearly) a powerbox?

[Dan Connolly]

I just learned that Polkit includes a javascript interpreter.

"polkit is an application-level toolkit for defining and handling the
policy that allows unprivileged processes to speak to privileged
processes" -- https://www.freedesktop.org/wiki/Software/polkit/

I wonder if it's a powerbox... or if it can be with a small amount of
adaptation.

For example: we have a jenkins job that crunches some data and then
delivers it to a users home directory. The permissions on home
directories got constrained such that the jenkins user couldn't do
that any more. So we wrote a little setuid program in go to make up
the difference.

I run into this sort of overconstrained chmod puzzle pretty regularly.
I actually started writing a thing where root could do an HMAC on a
piece of javascript and hand the result out as a capability-like
bearer token as in "The bearer of this token may run this javascript
function as root." I wonder if polkit can do that.

Polkit also seems to have some UI that might make it usable as a
powerbox: "Based on its configuration—specified in a so-called
policy—the answer could be yes, no, or needs authentication. " --
https://www.suse.com/documentation/sles-12/book_security/data/cha_security_policykit.html

I'm perhaps getting arbitrary attenuation mixed up with the powerbox pattern.

I'll have to check whether it's supported by the linux distribution we
use for deployment at work.

--
Dan Connolly
http://www.madmode.com/
_______________________________________________
cap-talk mailing list
cap-...@mail.eros-os.org
http://www.eros-os.org/mailman/listinfo/cap-talk