Files

T

vasilito 9f2de2a0b1 docs+build: correct version drift, mangled prose, and toolchain-version gaps

Docs:
- Baseline was stated as 0.3.1 across the canonical set while the branch,
  Cat 0/1 crates and every Cat 2 fork are 0.3.2. AGENTS.md also cited a
  sources/redbear-0.3.1/ archive that does not exist; the only archive
  present is sources/redbear-0.1.0/. Versioning examples now match the
  forks as they actually stand (redoxfs/syscall 0.9.1, libredox 0.1.19).
- Repaired 18 instances of 'immutable archived' across 8 documents, where
  a global find/replace had turned sync/synced/archived into that phrase
  and produced ungrammatical text ('never auto-immutable archived',
  '### Source immutable archived').
- Settled the apply-patches.sh contradiction empirically. Both sides were
  wrong: the GROSS WARNING blocks (x5) described it as routine
  patch-linking, and SCRIPT-BEHAVIOR-MATRIX.md said build-redbear.sh
  'never invokes' it. It is invoked at build-redbear.sh:487, but only to
  auto-repair a failed verify-overlay-integrity.sh check.
- Dropped the dangling reference to a local/AGENTS.md section
  'NO OVERLAY-STYLE PATCHES — SCOPED POLICY' that does not exist.

Build system:
- mk/prefix.mk hardcoded 13.2.0 in the limits.h removal, which silently
  no-ops after a toolchain upgrade and leaves the conflicting header.
  Version-globbed.
- Parameterized GCC_RECIPE so the from-source toolchain path is not
  pinned to gcc13.
- The three cstdlib strtold seds were not idempotent -- the shipped GCC
  13 toolchain carried that comment block 17 times from repeated
  'make prefix' runs. Each is now guarded.

2026-08-03 13:07:25 +03:00

2.7 KiB

Raw Blame History

redbear-polkit — D-Bus Interface

Bus: system Well-known name: org.freedesktop.PolicyKit1 Object paths:

/org/freedesktop/PolicyKit1/Authority — Authority object

Interface: `org.freedesktop.PolicyKit1.Authority`

Methods

Method	Signature	Description
`CheckAuthorization`	`(subject_kind: s, subject: a{sv}, action_id: s, details: a{sv}, flags: u, cancellation_id: s) → (b, b, a{sv})`	Check if a subject is authorized for an action. Returns `(authorized, is_challenge, details)`. The subject dictionary must contain `uid` (U32 or I32). UID 0 (root) is always authorized. Other UIDs are checked against the policy file.
`RegisterAuthenticationAgent`	`(session: (s, o), locale: s, object_path: s) → ()`	No-op stub (authentication agents are not supported)
`UnregisterAuthenticationAgent`	`(session: (s, o), object_path: s) → ()`	No-op stub
`EnumerateActions`	`(locale: s) → (a(sssssu(a{sv})))`	Returns empty list (action enumeration not implemented)

Properties

Property	Type	Description
`BackendName`	`s`	`"redbear-uid-policy"` (const)
`BackendVersion`	`s`	`"0.2.0"` (const)

Authorization Decision Logic

Extract UID from subject dictionary (field uid, accepts U32 and I32 types)
If UID is 0 → authorized (root bypass)
Look up action ID in the TOML policy file (/etc/polkit-1/policy.toml or REDBEAR_POLKIT_POLICY)
Evaluate user specs on the matching line, left to right:
- * → match any user
- N (decimal integer) → match specific UID
- @group → match if UID is a member of the named group
- !spec → explicit deny
Explicit deny overrides any explicit allow
Unknown action → denied by default

Subject Format

The subject dictionary is a HashMap<String, Value>. Supported fields:

uid (u32 or i32): The UID to authorize. Required.

The subject_kind string (e.g. "unix-user" or "unix-process") is logged but not used for authorization decisions — only the uid field matters.

Details Format

The details dictionary (third return value) is always empty. The upstream spec allows backends to return additional key-value pairs; Red Bear's implementation returns an empty HashMap.

References

PolicyKit D-Bus API
Conformance: Minimal implementation. CheckAuthorization with UID-based policy file evaluation. No authentication agent support (Register/Unregister are no-ops). No action enumeration. No JavaScript rules.d support. Backend is a simple TOML key-value store.

2.7 KiB Raw Blame History