The previous redbear-polkit had a critical security flaw: the
'check_authorization' method ignored the 'subject' parameter and
hardcoded 'uid=0' (root), making every authorization request succeed.
Any caller could perform any action as 'root'. This was flagged as
5/5 security fragility in the DBUS assessment.
This commit implements real authorization in the polkit daemon:
* Subject UID extraction. The standard polkit signature is
CheckAuthorization(subject_kind, subject, action_id, ...). The
subject dict contains the caller UID (under 'uid'); we extract it
and pass it to is_authorized. No more hardcoded root.
* Comprehensive policy syntax. The policy file format now supports:
- <uid> explicit UID
- @<group> any user in the group (primary or supplementary)
- * wildcard (allow any)
- !<uid> explicit deny
- !@<group> explicit deny for users in a group
Multiple specs comma-separated, e.g. '@wheel, 1000, !@restricted'.
* Default-deny for unknown actions. Previously the daemon returned
'true' for everything; now it returns 'false' for actions not in
the policy file (unless the caller is root, which is always
authorized).
* match_user_spec returns None for non-match. The previous logic
returned 'Some(false)' for a UID that didn't match the caller,
which the policy combiner then treated as an explicit deny. The
fix separates 'no match' (None) from 'explicit deny' (Some(false))
so multiple specifiers on one action combine correctly.
* Env-var override for tests. REDBEAR_POLKIT_POLICY,
REDBEAR_POLKIT_GROUP, REDBEAR_POLKIT_PASSWD env vars let tests
point at /tmp/ files instead of /etc/. 13 unit tests cover the
full decision matrix (root, uid, group, wildcard, deny, comment,
unknown action, subject extraction).
* Policy file staged in redbear-full.toml and redbear-mini.toml.
The default /etc/polkit-1/policy.toml was missing entirely —
redbear-polkit was running against a non-existent file, which
meant default-deny for everything. The new policy.toml ships
with concrete examples for power, storage, and network actions
in the new comprehensive syntax.
* BackendVersion bumped to 0.2.0 to reflect the contract change.
DBUS-PLAN bumped to v3.2 (2026-07-26). §3.1 status table now lists
redbear-polkit v0.2 as done. §14.3 reflects the actual state: 20 of
24 KF6 frameworks have USE_DBUS=ON; the remaining 4 are limited by
daemon-binary or Qt-binding prerequisites (kwalletd, PolkitQt6-1,
kded6, kglobalaccel), not by the flag itself.
Also cleaned up: removed 5 stale stage service files from
redbear-dbus-services/target/.../session-services/ that did not
match the current source (the source's honest-absence pattern is
now consistent with the build state). The cleanup is a local
filesystem operation; the .gitignore already excludes that path.
Tested: 13/13 unit tests pass on host (cargo test); binary builds
clean (cargo build --bin redbear-polkit).
Red Bear OS Builder
bdc56ddd58