Beyond Linux® From Scratch - Version 2012-01-16

Chapter 4. Security

PolicyKit-0.9

Introduction to PolicyKit

The PolicyKit package is an application-level toolkit for defining and handling the policy that allows unprivileged processes to speak to privileged processes.

This package is known to build and work properly using an LFS-6.5 platform.

Package Information

PolicyKit Dependencies

Required

D-Bus GLib Bindings-0.98, Linux-PAM-1.1.5, intltool-0.50.0, and DocBook XSL Stylesheets-1.76.1

Optional

GTK-Doc-1.18

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/policykit

Installation of PolicyKit

It is a requirement to have a dedicated user and group for PolicyKit to function correctly. Issue the following commands as the root user: 

groupadd -fg 27 polkituser &&
useradd -c "Policy Kit Daemon User" -d /dev/null -u 27 \
    -g polkituser -s /bin/false polkituser || [ $? == 9 ]

Install PolicyKit by running the following commands as an unprivileged user: 

./configure --prefix=/usr --sysconfdir=/etc \
    --libexecdir=/usr/lib/PolicyKit --localstatedir=/var &&
make

This package does not come with a test suite.

Now, as the root user: 

make install &&
install -v -d -m755 /usr/share/doc/PolicyKit-0.9 &&
cp -v -r doc/html /usr/share/doc/PolicyKit-0.9

Command Explanations

--enable-gtk-doc: Use this parameter if GTK-Doc is installed and you wish to rebuild and install the API documentation.

Configuring PolicyKit

Config Files

/etc/PolicyKit/PolicyKit.conf

Configuration Information

See manual page PolicyKit.conf(5).

Contents

Installed Programs: polkit-auth, polkit-policy-file-validate, polkit-config-file-validate, polkit-action, polkit-read-auth-helper, polkit-grant-helper-pam, polkit-grant-helper, polkit-revoke-helper, polkitd, polkit-explicit-grant-helper, polkit-set-default-helper, and polkit-resolve-exe-helper
Installed Libraries: libpolkit.{so,a}, libpolkit-dbus.{so,a}, and libpolkit-grant.{so,a}
Installed Directories: /etc/PolicyKit, /usr/lib/PolicyKit, /usr/include/PolicyKit/polkit, /usr/include/PolicyKit/polkit-dbus, /usr/include/PolicyKit/polkit-grant, /usr/share/PolicyKit/policy, /var/lib/misc, /var/lib/PolicyKit, /var/lib/PolicyKit-public, and /usr/share/doc/PolicyKit-0.9

Short Descriptions

polkit-auth

is used to inspect, obtain, grant and revoke PolicyKit authorizations.

polkit-policy-file-validate

is used to verify that one or more PolicyKit .policy files are valid.

polkit-config-file-validate

is used to verify that a given PolicyKit configuration file is valid.

polkit-action

is used to list and modify the PolicyKit actions that are registered on the system.

polkit-read-auth-helper

is the setgid polkituser helper for PolicyKit to read authorizations.

polkit-grant-helper-pam

is the setuid root pam grant helper for PolicyKit.

polkit-grant-helper

is the setgid polkituser grant helper for PolicyKit.

polkit-revoke-helper

is used to revoke authorizations.

polkitd

is the PolicyKit daemon.

polkit-explicit-grant-helper

is used to grant authorizations.

polkit-set-default-helper

is the setgid polkituser helper for PolicyKit.

polkit-resolve-exe-helper

is used to find the executable name for a process.

libpolkit.{so,a}

contains the PolicyKit API functions.

libpolkit-dbus.{so,a}

contains functions for obtaining seat, session and caller information via D-Bus and ConsoleKit.

libpolkit-grant.{so,a}

contains functions for obtaining authorizations through authentication.

Last updated on 2011-11-29 12:24:08 +0000