Bug#501576: [Fwd: Re: PK: suid binaries, libpolkit]

[Michael Biebl]

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

--- Begin Message ---

David Zeuthen wrote:

On Wed, 2008-04-23 at 01:54 +0200, Michael Biebl wrote:

Ok, I guess I have to say a few words about that. In Debian library packages are usually named $libraryname$soversion. Atm this would be

libpolkit2, where libpolkit2 contains:

/usr/lib/libpolkit.so.2.0.0
/usr/lib/libpolkit.so.2

The reason for this is, that library packages with different sonames are coninstallable, which makes library transitions (i.e. libpolkit2 -> libpolkit3) easier. If I would put /var/lib/misc/PolicyKit.reload into libpolkit2 and libpolkit3, I'd have a file conflict between those two packages.

Is /var/lib/misc/PolicyKit.reload the only file that is required by libpolkit, or does libpolkit also expect /var/lib/PolicyKit(-public) to be existent?

The problem is what to do in polkit-set-default-helper if the
directory /var/lib/PolicyKit-public doesn't exist... we'd have to
return an error. Ditto for /var/{run,lib}/PolicyKit and the helpers
there

Well, polkit-set-default-helper (and the other helper tools in libexec) are currently in the Debian policykit package, which ships the necessary directories, so I'd say we are on the safe side here.

Hm, /var/lib/misc/PolicyKit.reload could be split into a separate package libpolkit-common or so. But that would be additional effort and overhead (a separate package for an empty file ;-) )

If this was an RPM based system I'd just create the file in %post ;-).
Somewhat a hack but I bet it would work .. modulo SELinux labeling
problems.

Sounds like an idea.

But maybe there is an easier way. Since both PolicyKit.reload
and /var/{lib,run}/PolicyKit, /var/lib/PolicyKit-public are pure
implementation details (just like the helpers) we should probably change
their names (also for the helpers) to include the so-number on the next
so-bump. Would that work for you? I mean, then you'd include these in
libpolkit2 for now and in libpolkit3 they would be named differently.

Cheers,
Michael


--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

But this could also complicate things, as you'd have to transition credentials from one version (directory) to the other. On the other hand, if libpolkit2 and libpolkit3 would use a different file format, you'd need some kind of versioning anyhow (I have to check the code first, if libpolkit is actually directly reading from/writing to the files in var/{lib,run}/PolicyKit, /var/lib/PolicyKit-public, or if this is done only by the helper tools). So I'd only version the directories if you expect the file format to change (and a soname bump is not necessarily aligned with a file format change).

signature.asc
Description: OpenPGP digital signature

--- End Message ---

signature.asc
Description: OpenPGP digital signature