On (21/11/15 15:44), Jakub Hrozek wrote:
On Sat, Nov 21, 2015 at 12:16:07PM +0100, Sumit Bose wrote:
> On Fri, Nov 20, 2015 at 08:50:50PM +0100, Lukas Slebodnik wrote:
> > On (20/11/15 18:58), Jakub Hrozek wrote:
> > >The attached patch tries to detect if the build platform has the rules.d
> > >polkit directory and only installs the file from contrib if so. As an
> > >additional improvement we might add a config option that specifies the
> > >directory directly, but I don't think it's needed at the moment.
> > >
> > >I ran a local mock build of epel-6 and fedora and those passed. Now the
> > >patch is in CI to check Debian.
> > >
> > >Sorry again for the careless review of the first patch.
> >
> > >From 060b224356acf387eafa6f7daeca87ce71fabaa5 Mon Sep 17 00:00:00 2001
> > >From: Jakub Hrozek <jhrozek(a)redhat.com>
> > >Date: Fri, 20 Nov 2015 18:54:13 +0100
> > >Subject: [PATCH] BUILD: Install polkit rules file only on platforms that
> > > support it
> > >
> > >---
> > > Makefile.am | 2 ++
> > > configure.ac | 8 ++++++++
> > > contrib/ci/deps.sh | 1 +
> > > contrib/sssd.spec.in | 1 +
> > > 4 files changed, 12 insertions(+)
> > >
> > >diff --git a/Makefile.am b/Makefile.am
> > >index
212440c9b174de10ca4b8481af350f06b090cc34..d6ca1cf1b79859cf4de6788ecdc306b614630a42 100644
> > >--- a/Makefile.am
> > >+++ b/Makefile.am
> > >@@ -151,10 +151,12 @@ endif
> > > if HAVE_NSS
> > > sssdlibexec_PROGRAMS += p11_child
> > > if SSSD_USER
> > >+if HAVE_POLKIT_RULES_D
> > > polkit_rulesdir = $(datadir)/polkit-1/rules.d
> > > dist_polkit_rules_DATA = contrib/sssd-pcsc.rules
> > > endif
> > > endif
> > >+endif
> > >
> > > if BUILD_PAC_RESPONDER
> > > sssdlibexec_PROGRAMS += sssd_pac
> > >diff --git a/configure.ac b/configure.ac
> > >index
f7254c096659e7d8e395b4d0b0c71b5aa28d38f1..f68aef59b4ab48cc5e8fcac06925706f744cf4be 100644
> > >--- a/configure.ac
> > >+++ b/configure.ac
> > >@@ -424,6 +424,14 @@ SSS_ENABLE_INTGCHECK_REQS
> > >
> > > AM_CONDITIONAL([HAVE_DEVSHM], [test -d /dev/shm])
> > >
> > >+# Check if we're building on a platform with new polkit scheme
> > >+AC_PATH_PROG([PKCHECK],[pkcheck])
> > a) there is a missing space after ','
> > b) binary pkcheck is unused. It would make sense to use it
> > if pkcheck was used for detecting version of polkit and version of
> > polkit to distinguish if /usr/share/polkit-1/rules.d/ is used in such version.
> > c) It should be sufficient to test if directory exists.
> >
> > >+if test ! -x "$PKCHECK"; then
> > >+ AC_MSG_WARN([pkcheck not found, will not install polkit rules])
> > >+else
> > >+ AM_CONDITIONAL([HAVE_POLKIT_RULES_D], [test -d
${datadir}/polkit-1/rules.d ])
> > >+fi
> > > abs_build_dir=`pwd`
> > > AC_DEFINE_UNQUOTED([ABS_BUILD_DIR], ["$abs_build_dir"], [Absolute
path to the build directory])
> > > AC_SUBST([abs_builddir], $abs_build_dir)
> > >diff --git a/contrib/ci/deps.sh b/contrib/ci/deps.sh
> > >index
c9a8a6384a31c796a7b79e4f94d89f3e94ce6542..508c512b75d2d5a4e333fe657de5430f8e72c0c4 100644
> > >--- a/contrib/ci/deps.sh
> > >+++ b/contrib/ci/deps.sh
> > >@@ -114,6 +114,7 @@ if [[ "$DISTRO_BRANCH" == -debian-* ]]; then
> > > python-ldap
> > > ldap-utils
> > > slapd
> > >+ policykit-1
> > Debian (stable, testing, unstable) has old version of policykit which does not
> > support policy kit rules.
> >
> > $ pkcheck --version
> > pkcheck version 0.105
> >
> > > )
> > > DEPS_INTGCHECK_SATISFIED=true
> > > fi
> > >diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
> > >index
cff77b29ec55788fa45c2fa948f15d3ed7a06897..698694686945a25ba551dcfa22eb1753bbc780ae 100644
> > >--- a/contrib/sssd.spec.in
> > >+++ b/contrib/sssd.spec.in
> > >@@ -160,6 +160,7 @@ BuildRequires: nfs-utils-lib-devel
> > >
> > > BuildRequires: samba4-devel
> > > BuildRequires: libsmbclient-devel
> > >+BuildRequires: polkit
> > >
> > > %description
> > > Provides a set of daemons to manage access to remote directories and
> >
> > I have a slightly off topic question.
> > Why did we used /usr/share/polkit-1/rules.d/ and not /etc/polkit-1/rules.d/
> > for storing polkit rules?
>
> For me it looks like /etc/polkit-1/rules.d/ is used by polkit
> components while /usr/share/polkit-1/rules.d/ is used by other packages
> as well. But I haven't found this written down somewhere.
>
> >
> > How will p11_child work on rhel6 (debian) without policy kit rule and without
> > suid bit?
>
> It works on RHEL6 because the version of pcscd used there allows every
> user to access the Smartcard. I didn't check debian so far.
Sumit,
I can check on debian and other distributions
but I don't know what should I look for.
Is SC auth on Debian expected to work in general? (NSS vs. libcrypto..)
That's
good question.
LS