Merge lp:~aptdaemon-developers/aptdaemon/high-level-privilege into lp:aptdaemon/0.3

[Sebastian Heinlein]

Unmerged revisions

457. By Sebastian Heinlein on 2010-08-22

Check if the user can obtain the high level privilege install-or-remove in
CommitPackages before falling back to the single low level privileges.

=== modified file 'NEWS'
--- NEWS	2010-07-20 14:24:48 +0000
+++ NEWS	2010-08-22 06:52:40 +0000
@@ -1,3 +1,21 @@
+API CHANGES 0.3X
+
+* policykit1 Python module
+
+ - Raise an AuthorizationFailed exception in a non-interactive check if the 
+   user could obtain the privilege in interactive-mode (is_challenged)
+
+
+* errors Python module
+
+ - Make the AuthorizationFailed error an inheritance of NotAuthorizedError
+
+
+* PolicyKit1:
+
+ - Add a new high level privilege install-or-remove
+
+
 API CHANGES 0.32
 
 * PolicyKit1:

=== modified file 'aptdaemon/core.py'
--- aptdaemon/core.py	2010-08-21 06:56:19 +0000
+++ aptdaemon/core.py	2010-08-22 06:52:40 +0000
@@ -1155,14 +1155,46 @@
                 return lst
         packages = [check_empty_list(lst) for lst in [install, reinstall,
                                                       remove, purge, upgrade]]
+        # At first check if the high level privilege can be obtained
+        flags = policykit1.CHECK_AUTH_NONE
+        try:
+            action = policykit1.PK_ACTION_INSTALL_OR_REMOVE_PACKAGES
+            yield policykit1.check_authorization_by_name(sender, action,
+                                                         flags=flags)
+        except errors.AuthorizationFailed:
+            # If an interactive auth is required we get this error
+            pass
+        except errors.NotAuthorizedError:
+            # Fallback to the low level privileges if the privilege cannot be
+            # obtained at all
+            flags = policykit1.CHECK_AUTH_ALLOW_USER_INTERACTION
         if install != [""] or reinstall != [""]:
             action = policykit1.PK_ACTION_INSTALL_PACKAGES
-            yield policykit1.check_authorization_by_name(sender, action)
+            try:
+                yield policykit1.check_authorization_by_name(sender, action,
+                                                             flags=flags)
+            except errors.AuthorizationFailed:
+                if flags:
+                    raise
         elif upgrade != [""]:
             action = policykit1.PK_ACTION_UPGRADE_PACKAGES
-            yield policykit1.check_authorization_by_name(sender, action)
+            try:
+                yield policykit1.check_authorization_by_name(sender, action,
+                                                             flags=flags)
+            except errors.AuthorizationFailed:
+                if flags:
+                    raise
         if remove !=  [""] or purge != [""]:
             action = policykit1.PK_ACTION_REMOVE_PACKAGES
+            try:
+                yield policykit1.check_authorization_by_name(sender, action,
+                                                             flags=flags)
+            except errors.AuthorizationFailed:
+                if flags:
+                    raise
+        if not flags:
+            # Finally check the high level privilege interactively
+            action = policykit1.PK_ACTION_INSTALL_OR_REMOVE_PACKAGES
             yield policykit1.check_authorization_by_name(sender, action)
         uid = yield policykit1.get_uid_from_dbus_name(sender)
         trans = Transaction(enums.ROLE_COMMIT_PACKAGES, self.queue, uid,

=== modified file 'aptdaemon/errors.py'
--- aptdaemon/errors.py	2010-07-18 06:42:39 +0000
+++ aptdaemon/errors.py	2010-08-22 06:52:40 +0000
@@ -115,15 +115,10 @@
         self.subject = subject
 
 
-class AuthorizationFailed(PolicyKitError):
+class AuthorizationFailed(NotAuthorizedError):
 
     _dbus_error_name = "org.freedesktop.PolicyKit.Error.Failed"
 
-    def __init__(self, subject, action_id):
-        dbus.DBusException.__init__(self, "%s: %s" % (subject, action_id))
-        self.action_id = action_id
-        self.subject = subject
-
 
 def convert_dbus_exception(func):
     """A decorator which maps a raised DBbus exception to a native one.

=== modified file 'aptdaemon/policykit1.py'
--- aptdaemon/policykit1.py	2010-07-20 14:22:57 +0000
+++ aptdaemon/policykit1.py	2010-08-22 06:52:40 +0000
@@ -91,7 +91,7 @@
     def policykit_done((authorized, challenged, auth_details)):
         if authorized:
             deferred.callback(auth_details)
-        elif challenged and flags:
+        elif challenged:
             deferred.errback(AuthorizationFailed(subject, action_id))
         else:
             deferred.errback(NotAuthorizedError(subject, action_id))

=== modified file 'data/org.debian.apt.policy.in'
--- data/org.debian.apt.policy.in	2010-08-20 18:42:22 +0000
+++ data/org.debian.apt.policy.in	2010-08-22 06:52:40 +0000
@@ -98,6 +98,18 @@
     </defaults>
   </action>
 
+  <action id="org.debian.apt.install-or-remove-packages">
+    <_description>Install or remove packages</_description>
+    <_message>
+      To install or remove software, you need to authenticate.
+    </_message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
   <action id="org.debian.apt.remove-packages">
     <_description>Remove packages</_description>
     <_message>To remove software, you need to authenticate.</_message>