Beyond Linux® From Scratch (System V Edition) - Version 2021-04-13

Chapter 4. Security

Polkit-0.118

Introduction to Polkit

Polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to communicate with privileged processes.

This package is known to build and work properly using an LFS-10.1 platform.

Package Information

Additional Downloads

Polkit Dependencies

Required

GLib-2.68.1 and js78-78.9.0

Recommended

Linux-PAM-1.5.1 and elogind-246.10

[Note]

Note

Since elogind uses PAM to register user sessions, it is a good idea to build Polkit with PAM support so elogind can track Polkit sessions.

Optional (Required if building GNOME)

gobject-introspection-1.68.0

Optional

D-Bus Python-1.2.16 and dbusmock-0.23.0 (for tests), docbook-xml-4.5, docbook-xsl-1.79.2, GTK-Doc-1.33.2, and libxslt-1.1.34

Optional Runtime Dependencies

One polkit authentication agent for using polkit in the graphical environment: polkit-kde-agent in Plasma-5.21.1 for KDE, the agent built in gnome-shell-40.0 for GNOME3, polkit-gnome-0.105 for XFCE, and lxpolkit in LXSession-0.5.5 for LXDE.

[Note]

Note

If libxslt-1.1.34 is installed, then docbook-xml-4.5 and docbook-xsl-1.79.2 are required. If you have installed libxslt-1.1.34, but you do not want to install any of the DocBook packages mentioned, you will need to use --disable-man-pages in the instructions below.

User Notes: http://wiki.linuxfromscratch.org/blfs/wiki/polkit

Installation of Polkit

There should be a dedicated user and group to take control of the polkitd daemon after it is started. Issue the following commands as the root user: 

groupadd -fg 27 polkitd &&
useradd -c "PolicyKit Daemon Owner" -d /etc/polkit-1 -u 27 \
        -g polkitd -s /bin/false polkitd

Fix an issue introduced in recent Polkit releases with elogind: 

patch -Np1 -i ../polkit-0.118-fix_elogind_detection-1.patch &&
autoreconf -fv

Install Polkit by running the following commands: 

./configure --prefix=/usr        \
            --sysconfdir=/etc    \
            --localstatedir=/var \
            --disable-static     \
            --with-os-type=LFS   \
            --disable-libsystemd-login &&
make

To test the results, first ensure that the system D-Bus daemon is running. Then run make check.

Now, as the root user: 

make install

Command Explanations

--disable-libsystemd-login: This switch forces polkit to build with elogind support (if available) rather than systemd-logind.

--disable-static: This switch prevents installation of static versions of the libraries.

--with-authfw=shadow: This switch enables the package to use the Shadow rather than the Linux PAM Authentication framework. Use it if you have not installed Linux PAM.

--enable-gtk-doc: Use this parameter if GTK-Doc is installed and you wish to rebuild and install the API documentation.

Configuring Polkit

PAM Configuration

[Note]

Note

If you did not build Polkit with Linux PAM support, you can skip this section.

If you have built Polkit with Linux PAM support, you need to modify the default PAM configuration file which was installed by default to get Polkit to work correctly with BLFS. Issue the following commands as the root user to create the configuration file for Linux PAM: 

cat > /etc/pam.d/polkit-1 << "EOF"
# Begin /etc/pam.d/polkit-1

auth     include        system-auth
account  include        system-account
password include        system-password
session  include        system-session

# End /etc/pam.d/polkit-1
EOF

Contents

Installed Programs: pkaction, pkcheck, pk-example-frobnicate, pkexec, pkttyagent and polkitd
Installed Libraries: libpolkit-agent-1.so and libpolkit-gobject-1.so
Installed Directories: /etc/polkit-1, /usr/include/polkit-1, /usr/lib/polkit-1, /usr/share/gtk-doc/html/polkit-1 and /usr/share/polkit-1

Short Descriptions

pkaction

is used to obtain information about registered PolicyKit actions

pkcheck

is used to check whether a process is authorized for action

pk-example-frobnicate

is an example program to test the pkexec command

pkexec

allows an authorized user to execute a command as another user

pkttyagent

is used to start a textual authentication agent for the subject

polkitd

provides the org.freedesktop.PolicyKit1 D-Bus service on the system message bus

libpolkit-agent-1.so

contains the Polkit authentication agent API functions

libpolkit-gobject-1.so

contains the Polkit authorization API functions

Last updated on 2021-02-20 19:41:49 -0600