Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #173646 > unrolled thread
| Started by | kjonca@poczta.onet.pl (Kamil Jońca) |
|---|---|
| First post | 2016-10-20 19:30 +0200 |
| Last post | 2016-10-20 22:30 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.user
polickit rules - what wrong kjonca@poczta.onet.pl (Kamil Jońca) - 2016-10-20 19:30 +0200
Re: polickit rules - what wrong Brian <ad44@cityscape.co.uk> - 2016-10-20 20:40 +0200
Re: polickit rules - what wrong Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2016-10-20 20:40 +0200
Re: polickit rules - what wrong Brian <ad44@cityscape.co.uk> - 2016-10-20 21:20 +0200
Re: polickit rules - what wrong Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2016-10-20 22:30 +0200
| From | kjonca@poczta.onet.pl (Kamil Jońca) |
|---|---|
| Date | 2016-10-20 19:30 +0200 |
| Subject | polickit rules - what wrong |
| Message-ID | <supkd-28v-19@gated-at.bofh.it> |
I try to allow ordinary user to start/stop system service.
I try to make
/etc/polkit-1/localauthority/50-local.d/49-nopasswd_limited.conf
which contains:
--8<---------------cut here---------------start------------->8---
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units") {
if (action.lookup("unit") == "openvpn.service") {
var verb = action.lookup("verb");
if (verb == "start" || verb == "stop" || verb == "restart") {
return polkit.Result.YES;
}
}
}
});
--8<---------------cut here---------------end--------------->8---
but no effect.
What do I wrong?
KJ
--
http://wolnelektury.pl/wesprzyj/teraz/
"Sęk w tym, że człowiek rozumny jest statystycznie głupi" - Stanisław Lem.
[toc] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2016-10-20 20:40 +0200 |
| Message-ID | <suqpY-2Pv-35@gated-at.bofh.it> |
| In reply to | #173646 |
On Thu 20 Oct 2016 at 19:05:27 +0200, Kamil Jońca wrote:
>
> I try to allow ordinary user to start/stop system service.
>
> I try to make
> /etc/polkit-1/localauthority/50-local.d/49-nopasswd_limited.conf
> which contains:
> --8<---------------cut here---------------start------------->8---
> polkit.addRule(function(action, subject) {
> if (action.id == "org.freedesktop.systemd1.manage-units") {
> if (action.lookup("unit") == "openvpn.service") {
> var verb = action.lookup("verb");
> if (verb == "start" || verb == "stop" || verb == "restart") {
> return polkit.Result.YES;
> }
> }
> }
> });
> --8<---------------cut here---------------end--------------->8---
> but no effect.
> What do I wrong?
Where did you get that script from?
--
Brian.
[toc] | [prev] | [next] | [standalone]
| From | Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> |
|---|---|
| Date | 2016-10-20 20:40 +0200 |
| Message-ID | <suqpY-2Pv-33@gated-at.bofh.it> |
| In reply to | #173646 |
Hi,
Kamil Jońca writes:
> I try to make
> /etc/polkit-1/localauthority/50-local.d/49-nopasswd_limited.conf
> which contains:
> polkit.addRule(function(action, subject) {
[ Javascript ]
> });
> but no effect.
> What do I wrong?
Which version of policykit-1 do you have installed?
In Debian, only the version from experimental (0.113) supports the
newer, JavaScript-using rules. 0.105 from stable/testing/unstable does
*not* support them, but uses an older format (which also lacks some
features).
Ansgar
[toc] | [prev] | [next] | [standalone]
| From | Brian <ad44@cityscape.co.uk> |
|---|---|
| Date | 2016-10-20 21:20 +0200 |
| Message-ID | <sur2F-3iX-1@gated-at.bofh.it> |
| In reply to | #173652 |
On Thu 20 Oct 2016 at 20:38:35 +0200, Ansgar Burchardt wrote:
> Kamil Jońca writes:
> > I try to make
> > /etc/polkit-1/localauthority/50-local.d/49-nopasswd_limited.conf
> > which contains:
> > polkit.addRule(function(action, subject) {
> [ Javascript ]
> > });
> > but no effect.
> > What do I wrong?
>
> Which version of policykit-1 do you have installed?
>
> In Debian, only the version from experimental (0.113) supports the
> newer, JavaScript-using rules. 0.105 from stable/testing/unstable does
> *not* support them, but uses an older format (which also lacks some
> features).
What features does the .pkla format lack?
--
Brian.
[toc] | [prev] | [next] | [standalone]
| From | Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> |
|---|---|
| Date | 2016-10-20 22:30 +0200 |
| Message-ID | <sus8p-3Z6-3@gated-at.bofh.it> |
| In reply to | #173656 |
Brian writes:
> On Thu 20 Oct 2016 at 20:38:35 +0200, Ansgar Burchardt wrote:
>> Kamil Jońca writes:
>> > I try to make
>> > /etc/polkit-1/localauthority/50-local.d/49-nopasswd_limited.conf
>> > which contains:
>> > polkit.addRule(function(action, subject) {
>> [ Javascript ]
>> > });
>> > but no effect.
>> > What do I wrong?
>>
>> Which version of policykit-1 do you have installed?
>>
>> In Debian, only the version from experimental (0.113) supports the
>> newer, JavaScript-using rules. 0.105 from stable/testing/unstable does
>> *not* support them, but uses an older format (which also lacks some
>> features).
>
> What features does the .pkla format lack?
>From the original mail:
+---
| if (action.id == "org.freedesktop.systemd1.manage-units") {
| if (action.lookup("unit") == "openvpn.service") {
| var verb = action.lookup("verb");
| if (verb == "start" || verb == "stop" || verb == "restart") {
+---
The .pkla files only have Action=xyz (equivalent to action.id == "..."),
but additional variables can be provided (action.lookup(...)) that the
old system cannot use (as far as I know).
In particular here systemd also provides the unit and verb so one can
allow a user to only start and stop the "openvpn.service" unit. The old
system could only allow managing all units (and all unit-actions).
Ansgar
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web