fix: pass uid from unix socket creds instead of inferring from pid in polkit checks

lact-daemon/src/server.rs

@@ -78,8 +78,10 @@ impl Server {
                         let client_credentials = getsockopt(&stream, PeerCredentials)
                             .inspect_err(|err| warn!("could not get client credentials: {err:#}"))
                             .ok();
+
                         let ctx = ClientContext {
-                            client_pid: client_credentials.map(|creds| creds.pid().cast_unsigned()),
+                            pid: client_credentials.map(|creds| creds.pid().cast_unsigned()),
+                            uid: client_credentials.map(|creds| creds.uid()),
                         };
                         let handler = unix_handler.clone();
                         tokio::task::spawn_local(async move {
@@ -125,7 +127,8 @@ impl Server {
 
 #[derive(Clone, Copy, Debug, Default)]
 pub(crate) struct ClientContext {
-    pub client_pid: Option<u32>,
+    pub pid: Option<u32>,
+    pub uid: Option<u32>,
 }
 
 #[instrument(level = "debug", skip(stream, handler))]

lact-daemon/src/server/handler.rs

@@ -1282,8 +1282,9 @@ impl<'a> Handler {
             .as_ref()
             .context("Polkit not available, cannot ask for authorization")?;
 
-        let pid = ctx.client_pid.context("No client PID available")?;
-        let subject = policykit1::Subject::new_for_owner(pid, None, None)?;
+        let pid = ctx.pid.context("No client PID available")?;
+        let uid = ctx.uid.context("No client UID available")?;
+        let subject = policykit1::Subject::new_for_owner(pid, None, Some(uid))?;
         let result = polkit_proxy
             .check_authorization(
                 &subject,