From d0478fe42c2219454e272f96b1cbd29ab37ee566 Mon Sep 17 00:00:00 2001 From: Ilya Zlobintsev Date: Wed, 19 Aug 2026 17:42:08 +0300 Subject: [PATCH] fix: pass uid from unix socket creds instead of inferring from pid in polkit checks --- lact-daemon/src/server.rs | 7 +++++-- lact-daemon/src/server/handler.rs | 5 +++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lact-daemon/src/server.rs b/lact-daemon/src/server.rs index dd0bd385..29676cc8 100644 --- a/lact-daemon/src/server.rs +++ b/lact-daemon/src/server.rs @@ -78,8 +78,10 @@ impl Server { let client_credentials = getsockopt(&stream, PeerCredentials) .inspect_err(|err| warn!("could not get client credentials: {err:#}")) .ok(); + let ctx = ClientContext { - client_pid: client_credentials.map(|creds| creds.pid().cast_unsigned()), + pid: client_credentials.map(|creds| creds.pid().cast_unsigned()), + uid: client_credentials.map(|creds| creds.uid()), }; let handler = unix_handler.clone(); tokio::task::spawn_local(async move { @@ -125,7 +127,8 @@ impl Server { #[derive(Clone, Copy, Debug, Default)] pub(crate) struct ClientContext { - pub client_pid: Option, + pub pid: Option, + pub uid: Option, } #[instrument(level = "debug", skip(stream, handler))] diff --git a/lact-daemon/src/server/handler.rs b/lact-daemon/src/server/handler.rs index 1ce00a15..8a9c7905 100644 --- a/lact-daemon/src/server/handler.rs +++ b/lact-daemon/src/server/handler.rs @@ -1282,8 +1282,9 @@ impl<'a> Handler { .as_ref() .context("Polkit not available, cannot ask for authorization")?; - let pid = ctx.client_pid.context("No client PID available")?; - let subject = policykit1::Subject::new_for_owner(pid, None, None)?; + let pid = ctx.pid.context("No client PID available")?; + let uid = ctx.uid.context("No client UID available")?; + let subject = policykit1::Subject::new_for_owner(pid, None, Some(uid))?; let result = polkit_proxy .check_authorization( &subject,