Files

T

vasilito 9f2de2a0b1 docs+build: correct version drift, mangled prose, and toolchain-version gaps

Docs:
- Baseline was stated as 0.3.1 across the canonical set while the branch,
  Cat 0/1 crates and every Cat 2 fork are 0.3.2. AGENTS.md also cited a
  sources/redbear-0.3.1/ archive that does not exist; the only archive
  present is sources/redbear-0.1.0/. Versioning examples now match the
  forks as they actually stand (redoxfs/syscall 0.9.1, libredox 0.1.19).
- Repaired 18 instances of 'immutable archived' across 8 documents, where
  a global find/replace had turned sync/synced/archived into that phrase
  and produced ungrammatical text ('never auto-immutable archived',
  '### Source immutable archived').
- Settled the apply-patches.sh contradiction empirically. Both sides were
  wrong: the GROSS WARNING blocks (x5) described it as routine
  patch-linking, and SCRIPT-BEHAVIOR-MATRIX.md said build-redbear.sh
  'never invokes' it. It is invoked at build-redbear.sh:487, but only to
  auto-repair a failed verify-overlay-integrity.sh check.
- Dropped the dangling reference to a local/AGENTS.md section
  'NO OVERLAY-STYLE PATCHES — SCOPED POLICY' that does not exist.

Build system:
- mk/prefix.mk hardcoded 13.2.0 in the limits.h removal, which silently
  no-ops after a toolchain upgrade and leaves the conflicting header.
  Version-globbed.
- Parameterized GCC_RECIPE so the from-source toolchain path is not
  pinned to gcc13.
- The three cstdlib strtold seds were not idempotent -- the shipped GCC
  13 toolchain carried that comment block 17 times from repeated
  'make prefix' runs. Each is now guarded.

2026-08-03 13:07:25 +03:00

3.3 KiB

Raw Blame History

redbear-polkit — Operator Runbook

Daemon: redbear-polkit Init service: /usr/lib/init.d/70_polkit.service Status check: dbus-send --system --dest=org.freedesktop.PolicyKit1 --type=method_call --print-reply /org/freedesktop/PolicyKit1/Authority org.freedesktop.DBus.Properties.Get string:org.freedesktop.PolicyKit1.Authority string:BackendName Restart: init-svc restart polkit

Logs

Destination: stderr (visible via journalctl -u polkit)
Verbose authorization logging: Every CheckAuthorization call logs subject_kind, uid, action_id, and result.
Connection retry logging: Connection failures emit redbear-polkit: attempt N/3 failed (...) on stderr.

D-Bus Registration

Bus: system
Well-known name: org.freedesktop.PolicyKit1
Object path: /org/freedesktop/PolicyKit1/Authority
Connection retries: 3 attempts at 1-second intervals. Waits up to 30 seconds for the D-Bus socket to appear.

Policy File

Default path: /etc/polkit-1/policy.toml
Override: REDBEAR_POLKIT_POLICY env var
Format: One action per line: action_id = user_spec1, user_spec2, ...
User spec syntax:
- * — match any user
- 1000 — match specific UID
- @wheel — match group membership (from /etc/group + /etc/passwd)
- !1000 — explicit deny (prefix !)
Comments: Lines starting with # are skipped
Default behavior: Unknown actions are denied. UID 0 (root) is always authorized.

User/Group Resolution

/etc/passwd — Default path; override with REDBEAR_POLKIT_PASSWD
/etc/group — Default path; override with REDBEAR_POLKIT_GROUP
Group membership check covers both primary GID (from passwd) and supplementary memberships (from group file).

D-Bus API

See local/docs/dbus-interfaces/redbear-polkit.md for the full D-Bus interface specification.

Signals / SIGTERM Behavior

SIGTERM handler: Tokio-based signal handler (tokio::signal::unix). On receipt, shuts down via watch channel. Daemon exits cleanly with redbear-polkit: shutdown signal received, exiting cleanly.
On Redox, the signal handler uses a fallback path (tokio::signal::ctrl_c() if signal(SIGTERM) fails).

Common Issues

timed out waiting for D-Bus socket — D-Bus system bus daemon not running. Start dbus-daemon --system first. Check DBUS_STARTER_ADDRESS, DBUS_SYSTEM_BUS_ADDRESS, or default /run/dbus/system_bus_socket.
Policy file not found — Default path /etc/polkit-1/policy.toml. Create it or override via REDBEAR_POLKIT_POLICY. Without a policy file, all non-root actions are denied by default.
Group membership check fails for user — Verify the user exists in /etc/passwd (UID parsing requires at least 4 colon-separated fields). Verify the group exists in /etc/group (GID in field 2, members in field 3). Group membership covers both primary GID and supplementary memberships.
Deny rule not working — Explicit deny (!user_spec) must appear in the same policy line as the allow spec. Order matters: *, !1000 denies UID 1000. !1000, * also denies UID 1000 (explicit deny always overrides explicit allow).
Connection attempts 1-3 failing — D-Bus socket appeared but SASL auth handshake is not ready yet. This is normal for the first 1-2 seconds after dbus-daemon starts. The daemon retries automatically.

3.3 KiB Raw Blame History