Merge lp:~ycheng-twn/powerd/powerd_allow-non-root-dbus-cmd into lp:powerd

[Yuan-Chen Cheng]

Allow non-root to talk to powerd.

allow non-root to talk to powerd.

[Ricardo Salveti (rsalveti)]

19 --- debian/changelog 2014-01-29 11:24:39 +0000
20 +++ debian/changelog 2014-03-04 09:18:20 +0000

Please don't change the changelog directly, this will be done by the CI train (please make sure the MR commit message contains whatever you wanted in the changelog though).

34 --- debian/powerd.conf 2013-05-20 17:33:44 +0000
35 +++ debian/powerd.conf 2014-03-04 09:18:20 +0000

I'd prefer if we could only open a few dbus properties and methods, instead of everything. We don't want an app to be able to request a suspend blocker, but we can allow the user to use a custom value for brightness.

I changed the powerd.conf file to only export a few interfaces by default, check http://paste.ubuntu.com/7154678/ (already tested).

8 - myeuid = geteuid();
9 - if (myeuid != 0) {
10 - fprintf(stderr,"You must be root to run %s\n",argv[0]);
11 - return -1;
12 - }

As we might just be exporting a few interfaces, I'd just remove the line with 'return -1', and change the error message saying that running as user is not fully supported.

review: Needs Fixing

[Ricardo Salveti (rsalveti)]

Looks good, thanks!

review: Approve

[Ricardo Salveti (rsalveti)]

10 + fprintf(stderr,"%s: Running as user is not fully supported.", argv[0]);

Minor fix, please add '\n' in the end.

$ powerd-cli list
powerd-cli: Running as user is not fully supported.System State Requests:
...

review: Needs Fixing

[lp:~ycheng-twn/powerd/powerd_allow-non-root-dbus-cmd]

116. By Yuan-Chen Cheng on 2014-03-26

add newline

117. By Yuan-Chen Cheng on 2014-03-26

typo fix

[Ricardo Salveti (rsalveti)]

Looks good, thanks!

review: Approve

[Oliver Grawert (ogra)]

Just a FYI, i had to add the "at_console" policy back since it broke all autopilot image tests (scripts need to unlock the screen via adb shell before running)

https://code.launchpad.net/~ogra/powerd/fix-1298869 has the change

Bug #1298869 has details

=== modified file 'cli/powerd-cli.c'
--- cli/powerd-cli.c	2013-09-24 14:49:49 +0000
+++ cli/powerd-cli.c	2014-03-26 04:58:12 +0000
@@ -1035,8 +1035,7 @@
 
     myeuid = geteuid();
     if (myeuid != 0) {
-        fprintf(stderr,"You must be root to run %s\n",argv[0]);
-        return -1;
+        fprintf(stderr,"%s: Running as user is not fully supported.\n", argv[0]);
     }
 
     signal(SIGINT, sigint_quit);

=== modified file 'debian/powerd.conf'
--- debian/powerd.conf	2013-05-20 17:33:44 +0000
+++ debian/powerd.conf	2014-03-26 04:58:12 +0000
@@ -5,20 +5,58 @@
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
 
-  <!-- ../system.conf have denied everything, so we just punch some holes -->
-
+  <!-- Only the root user can own the powerd name -->
   <policy user="root">
     <allow own="com.canonical.powerd"/>
+  </policy>
+
+  <!-- Permit the root user to invoke all of the methods on powerd,
+       and to get and set properties. -->
+  <policy user="root">
     <allow send_destination="com.canonical.powerd"/>
     <allow send_interface="com.canonical.powerd"/>
   </policy>
 
-  <policy at_console="true">
-    <allow send_destination="com.canonical.powerd"/>
-  </policy>
-
+  <!-- Allow any user to introspect powerd's interfaces, to obtain the
+       values of properties and only set some of them (brightness). -->
   <policy context="default">
-    <deny send_destination="com.canonical.powerd"/>
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="org.freedesktop.DBus.Introspectable" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="org.freedesktop.DBus.Properties"
+	   send_type="method_call" send_member="Get" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="org.freedesktop.DBus.Properties"
+	   send_type="method_call" send_member="GetAll" />
+
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="userAutobrightnessEnable" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="getBrightnessParams" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="setUserBrightness" />
+
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="listSysRequests" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="listDisplayRequests" />
+
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="getSysRequestStats" />
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="getDispRequestStats" />
+
+    <allow send_destination="com.canonical.powerd"
+	   send_interface="com.canonical.powerd"
+	   send_type="method_call" send_member="userAutobrightnessEnable" />
+
   </policy>
 
 </busconfig>