fix: allow active users to toggle airplane mode without polkit prompt - #1213
fix: allow active users to toggle airplane mode without polkit prompt#1213fly602 wants to merge 9 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the polkit policy for the airplane mode action so that active sessions can toggle airplane mode without admin authentication, while inactive sessions remain restricted. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
/test github-pr-review-ci |
deepin pr auto review★ 总体评分：40分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 // bin/dde-system-daemon/power.go
// 修复：恢复 sender 参数并补充标准 Polkit 鉴权逻辑
func (d *Daemon) SetIdleState(sender dbus.Sender, state bool) *dbus.Error {
err := d.authorize(sender, "org.deepin.dde.daemon.set-idle-state")
if err != nil {
logger.Warningf("SetIdleState authorization failed: %v", err)
return dbusutil.ToError(err)
}
logger.Infof("SetIdleState %s try set state: %v", d.idleStatePath, state)
return dbusutil.ToError(d.setState(d.idleStatePath, state))
}
func (d *Daemon) SetScreenState(sender dbus.Sender, state bool) *dbus.Error {
err := d.authorize(sender, "org.deepin.dde.daemon.set-screen-state")
if err != nil {
logger.Warningf("SetScreenState authorization failed: %v", err)
return dbusutil.ToError(err)
}
logger.Infof("SetScreenState %s try set state: %v", d.idleScreenStatePath, state)
return dbusutil.ToError(d.setState(d.idleScreenStatePath, state))
}
// 新增标准 Polkit 鉴权辅助函数，替代被移除的 securityloader
func (d *Daemon) authorize(sender dbus.Sender, actionID string) error {
polkit "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.policykit1"
authority := polkit.NewAuthority(d.service.Conn())
subject := polkit.MakeSubject(polkit.SubjectKindSystemBusName)
subject.SetDetail("name", string(sender))
result, err := authority.CheckAuthorization(0, subject, actionID,
nil, polkit.CheckAuthorizationFlagsAllowUserInteraction, "")
if err != nil {
return err
}
if !result.IsAuthorized {
return errors.New("access denied")
}
return nil
}
// system/airplane_mode1/manager.go
// 修复：复用已有的 D-Bus 连接，避免频繁创建新连接带来的性能损耗与安全风险
func checkAuthorization(service *dbusutil.Service, actionId string, sysBusName string) error {
polkit "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.policykit1"
authority := polkit.NewAuthority(service.Conn())
subject := polkit.MakeSubject(polkit.SubjectKindSystemBusName)
subject.SetDetail("name", sysBusName)
ret, err := authority.CheckAuthorization(0, subject, actionId,
nil, polkit.CheckAuthorizationFlagsAllowUserInteraction, "")
if err != nil {
return err
}
if !ret.IsAuthorized {
return errors.New("not authorized")
}
return nil
}
func (mgr *Manager) Enable(sender dbus.Sender, enableAirplaneMode bool) *dbus.Error {
err := checkAuthorization(mgr.service, actionId, string(sender))
if err != nil {
logger.Warningf("checkAuthorization failed, err: %v, actionId=%v", err, actionId)
return dbusutil.ToError(err)
}
err = mgr.block(rfkillTypeAll, enableAirplaneMode)
if err != nil {
logger.Warningf("block all radio failed, err: %v", err)
return dbusutil.ToError(err)
}
return nil
} |
|
@fly602: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
2 participants
Previously, toggling airplane mode required admin authentication via polkit even for active users, causing unnecessary dialog prompts during normal operations. This change sets
allow_activetoyesfor the airplane mode action, while keepingallow_inactiveasnoto restrict non-active users. This improves usability by avoiding repeated authentication prompts for regular users.Log: Active users can now toggle airplane mode without polkit authentication dialogs
Influence:
fix: 允许活跃用户切换飞行模式时无需 polkit 弹窗
之前即使用户处于活跃状态，切换飞行模式也需要通过 polkit 进行管理员
认证，导致正常操作时弹出不必要的授权对话框。此修改将飞行模式操作的
allow_active设置为yes，同时保持allow_inactive为no以限制非 活跃用户。这通过避免常规用户反复认证，提升了易用性。Log: 活跃用户现在可以无需 polkit 认证弹窗切换飞行模式
Influence:
PMS: TASK-393313
Summary by Sourcery
Use direct polkit authorization for airplane mode and streamline daemon security and power-control infrastructure.
New Features:
Bug Fixes:
Enhancements:
Build:
Tests:
Chores: