Ticket #44655: AuthServicesBackend.patch

kdelibs-4.12.5//kdecore/auth/backends/mac/

@@ -1 +1 @@
 /*
 *   Copyright (C) 2008 Nicola Gigante <nicola.gigante@gmail.com>
+*   Modifications (C) 2014 René Bertin <rjvbertin@gmail.com>
 *
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU Lesser General Public License as published by
@@ -21 +22 @@
 #include <Security/Security.h>
 
 #include <QtCore/qplugin.h>
+#include <QtCore/QtCore>
 
 namespace KAuth
 {
@@ -34 +36 @@
     if (!s_authRef) {
         AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &s_authRef);
     }
-
     return s_authRef;
 }
 
+static OSStatus GetActionRights(const QString &action, AuthorizationFlags flags, AuthorizationRef auth=NULL)
+{
+    AuthorizationItem item;
+    item.name = action.toUtf8();
+    item.valueLength = 0;
+    item.value = NULL;
+    item.flags = 0;
+
+    AuthorizationRights rights;
+    rights.count = 1;
+    rights.items = &item;
+
+    OSStatus result = AuthorizationCopyRights( (auth)? auth : authRef(),
+                                              &rights,
+                                              kAuthorizationEmptyEnvironment,
+                                              flags, NULL);
+    return result;
+}
+
+// On OS X, the suggestion is to make the helper grant the actual privilege. The app does instead a
+// "pre-authorization", that's equivalent to look at isCallerAuthorized() in policykit.
+// RJVB: grab the privilege from here, the client.
 AuthServicesBackend::AuthServicesBackend()
     : AuthBackend()
 {
-    setCapabilities(AuthorizeFromHelperCapability | CheckActionExistenceCapability);
+    setCapabilities(AuthorizeFromClientCapability | CheckActionExistenceCapability);
 }
 
 void AuthServicesBackend::setupAction(const QString&)
@@ -51 +74 @@
 
 // On OS X, the suggestion is to make the helper grant the actual privilege. The app does instead a
 // "pre-authorization", that's equivalent to look at isCallerAuthorized() in policykit.
+// RJVB: grab the privilege from here, the client.
 Action::AuthStatus AuthServicesBackend::authorizeAction(const QString &action)
 {
-    return actionStatus(action);
+    OSStatus result = GetActionRights( action, kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed );
+//    qWarning() << "AuthServicesBackend::authorizeAction(" << action << ") AuthorizationCopyRights returned" << result;
+    switch (result) {
+        case errAuthorizationSuccess:
+            return Action::Authorized;
+        case errAuthorizationInteractionNotAllowed:
+        default:
+            return Action::Denied;
+    }
 }
 
 Action::AuthStatus AuthServicesBackend::actionStatus(const QString &action)
 {
-    AuthorizationItem item;
-    item.name = action.toUtf8();
-    item.valueLength = 0;
-    item.value = NULL;
-    item.flags = 0;
-
-    AuthorizationRights rights;
-    rights.count = 1;
-    rights.items = &item;
-
-    OSStatus result = AuthorizationCopyRights(authRef(),
-                      &rights,
-                      kAuthorizationEmptyEnvironment,
-                      kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize,
-                      NULL);
-
+    OSStatus result = GetActionRights( action, kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize );
+//    qWarning() << "AuthServicesBackend::actionStatus(" << action << ") AuthorizationCopyRights returned" << result;
     switch (result) {
     case errAuthorizationSuccess:
         return Action::Authorized;
@@ -101 +119 @@
 
     AuthorizationRef auth;
 
-    if (AuthorizationCreateFromExternalForm(&ext, &auth) != noErr)
+    if (AuthorizationCreateFromExternalForm(&ext, &auth) != noErr){
+//        qWarning() << "AuthorizationCreateFromExternalForm(" << action << "," << callerID.constData() << ") failed";
         return false;
+    }
 
-    AuthorizationItem item;
-    item.name = action.toUtf8();
-    item.valueLength = 0;
-    item.value = NULL;
-    item.flags = 0;
-
-    AuthorizationRights rights;
-    rights.count = 1;
-    rights.items = &item;
-
-    OSStatus result = AuthorizationCopyRights(auth,
-                      &rights,
-                      kAuthorizationEmptyEnvironment,
-                      kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed,
-                      NULL);
+    OSStatus result = GetActionRights( action, kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed,
+                      auth);
 
     AuthorizationFree(auth, kAuthorizationFlagDefaults);
+//    qWarning() << "AuthServicesBackend::isCallerAuthorized(" << action << "," << callerID.constData() << ") AuthorizationCopyRights returned" << result;
 
     return result == errAuthorizationSuccess;
 }
 
+// RJVB: OS X doesn't distinguish between "action doesn't exist" and "action not allowed". So the
+// best thing we can do is return true and hope that the action will be created if it didn't exist...
 bool AuthServicesBackend::actionExists(const QString& action)
 {
     OSStatus exists = AuthorizationRightGet(action.toUtf8(), NULL);
+//    qWarning() << "AuthServicesBackend::actionExists(" << action << ") AuthorizationRightGet returned" << exists;
 
-    return exists == errAuthorizationSuccess;
+    return true;//exists == errAuthorizationSuccess;
 }
 
 }; // namespace KAuth

kdelibs-4.12.5//kdecore/auth/

@@ -356 +356 @@
         return executeActions(QList<Action>() << *this, NULL, helperID) ?
             ActionReply::SuccessReply : ActionReply::AuthorizationDeniedReply;
     } else {
+#if defined(Q_OS_MACX) || defined(__APPLE__) || defined(__MACH__)
+        if( BackendsManager::authBackend()->capabilities() & KAuth::AuthBackend::AuthorizeFromClientCapability ){
+            // RJVB: authorisation through DBus seems to be flaky (at least when using the OSX keychain ... maybe because DBus
+            // isn't built with Keychain support in MacPorts?)
+            return ActionReply::SuccessReply;
+        }
+#endif //APPLE
         if (hasHelper()) {
             // Perform the pre auth here
             if (BackendsManager::authBackend()->capabilities() & KAuth::AuthBackend::PreAuthActionCapability) {