Switching from PAM to Polkit.

Author: Skyost

lib/utils/local_authentication/method_channel.dart

@@ -12,56 +12,7 @@ class LocalAuthenticationMethodChannel extends LocalAuthentication {
   final MethodChannel _methodChannel = const MethodChannel('app.openauthenticator.localauth');
 
   @override
-  Future<bool> authenticate(BuildContext context, String reason) async {
-    String? realName = await _methodChannel.invokeMethod<String>('localAuth.getRealName');
-    String? avatarPath = await _methodChannel.invokeMethod<String>('localAuth.getAvatarPath');
-    File? avatarFile = avatarPath == null ? null : File(avatarPath);
-    if (avatarFile != null && !avatarFile.existsSync()) {
-      avatarFile = null;
-    }
-
-    String? password;
-    bool isValid = false;
-    while (!isValid) {
-      if (!context.mounted) {
-        return isValid;
-      }
-      password = await TextInputDialog.prompt(
-        context,
-        title: translations.localAuth.methodChannel.title,
-        message: reason,
-        initialValue: password,
-        validator: password == null ? null : ((input) => input == password ? translations.localAuth.methodChannel.wrongPassword : null),
-        children: [
-          if (avatarFile != null)
-            Center(
-              child: Padding(
-                padding: EdgeInsets.only(top: 20, bottom: 10),
-                child: CircleAvatar(
-                  backgroundImage: FileImage(avatarFile),
-                  radius: 50,
-                ),
-              ),
-            ),
-          if (avatarPath != null && realName != null)
-            Padding(
-              padding: EdgeInsets.only(bottom: 20),
-              child: Text(
-                realName,
-                style: Theme.of(context).textTheme.titleMedium,
-                textAlign: TextAlign.center,
-              ),
-            ),
-        ],
-        password: true,
-      );
-      if (password == null) {
-        break;
-      }
-      isValid = await _methodChannel.invokeMethod<bool>('localAuth.authenticate', {'password': password}) == true;
-    }
-    return isValid;
-  }
+  Future<bool> authenticate(BuildContext context, String _) async => await _methodChannel.invokeMethod<bool>('localAuth.authenticate') == true;
 
   @override
   Future<bool> isSupported() async => (await _methodChannel.invokeMethod<bool>('localAuth.isDeviceSupported')) == true;

linux/CMakeLists.txt

@@ -76,11 +76,8 @@ target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::GTK)
 
 set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}/cmake/modules/")
 
-find_package(PAM REQUIRED)
-
-target_include_directories(${BINARY_NAME} PRIVATE ${PAM_INCLUDE_DIRS})
-target_link_libraries(${BINARY_NAME} PRIVATE ${PAM_LIBRARIES})
-
+pkg_check_modules(POLKIT REQUIRED IMPORTED_TARGET polkit-gobject-1)
+target_link_libraries(${BINARY_NAME} PRIVATE PkgConfig::POLKIT)
 
 # Run the Flutter tool portions of the build. This must not be removed.
 add_dependencies(${BINARY_NAME} flutter_assemble)

linux/cmake/modules/FindPAM.cmake

@@ -5,10 +5,7 @@
 #include <gdk/gdkx.h>
 #endif
 
-#include <pwd.h>
-#include <security/pam_appl.h>
-#include <sys/types.h>
-#include <unistd.h>
+#include <polkit/polkit.h>
 
 #include <iostream>
 #include <map>
@@ -21,149 +18,76 @@ struct _MyApplication {
     char** dart_entrypoint_arguments;
 };
 
-struct pam_response_t {
-    const char* password;
-};
-
 G_DEFINE_TYPE(MyApplication, my_application, GTK_TYPE_APPLICATION)
 
-static gboolean can_authenticate() {
-    pam_handle_t* pamh = nullptr;
-    struct pam_conv conv = {nullptr, nullptr};
-
-    int ret = pam_start("login", nullptr, &conv, &pamh);
-    if (ret != PAM_SUCCESS) {
-        return FALSE;
+static void can_authenticate(FlMethodCall* method_call) {
+    GError* error = nullptr;
+    PolkitAuthority* authority = polkit_authority_get_sync(nullptr, &error);
+    if (error) {
+        fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_error_response_new("authCheckError", error->message, nullptr)), nullptr);
+        g_clear_error(&error);
+        return;
     }
-
-    pam_end(pamh, ret);
-    return TRUE;
+    if (authority == nullptr) {
+        fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_success_response_new(fl_value_new_bool(false))), nullptr);
+        return;
+    }
+    fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_success_response_new(fl_value_new_bool(true))), nullptr);
 }
 
-static gchar* get_real_name() {
+static void authenticate_async_callback(PolkitAuthority* authority, GAsyncResult* result, gpointer user_data) {
     GError* error = nullptr;
-    GDBusConnection* connection = g_bus_get_sync(G_BUS_TYPE_SYSTEM, nullptr, &error);
-    if (!connection) return strdup("Unknown");
-
-    gchar* user_path = nullptr;
-    GVariant* result = g_dbus_connection_call_sync(
-            connection,
-            "org.freedesktop.Accounts",
-            "/org/freedesktop/Accounts",
-            "org.freedesktop.Accounts",
-            "FindUserByName",
-            g_variant_new("(s)", getenv("USER")),
-            G_VARIANT_TYPE("(o)"),
-            G_DBUS_CALL_FLAGS_NONE,
-            -1,
-            nullptr,
-            &error
-    );
-
-    if (!result) return strdup("Unknown");
-
-    g_variant_get(result, "(&o)", &user_path);
-
-    // Now get the RealName property
-    GVariant* name_result = g_dbus_connection_call_sync(
-            connection,
-            "org.freedesktop.Accounts",
-            user_path,
-            "org.freedesktop.DBus.Properties",
-            "Get",
-            g_variant_new("(ss)", "org.freedesktop.Accounts.User", "RealName"),
-            G_VARIANT_TYPE("(v)"),
-            G_DBUS_CALL_FLAGS_NONE,
-            -1,
-            nullptr,
-            &error
-    );
-
-    if (!name_result) return strdup("Unknown");
-
-    GVariant* name_value = nullptr;
-    g_variant_get(name_result, "(v)", &name_value);
-
-    const char* real_name = g_variant_get_string(name_value, nullptr);
-    return strdup(real_name);
-}
 
-static gchar* get_avatar_path() {
-  std::string path = "/var/lib/AccountsService/icons/";
-  path += getenv("USER");
-  return strdup(path.c_str());
-}
-
-static int pam_conversation(int num_msg, const struct pam_message** msg, struct pam_response** resp, void* appdata_ptr) {
-    struct pam_response_t* data = static_cast<struct pam_response_t*>(appdata_ptr);
-    // Allocate response memory
-    *resp = static_cast<struct pam_response*>(
-    calloc(num_msg, sizeof(struct pam_response)));
-  
-    if (*resp == nullptr) {
-      return PAM_CONV_ERR;
-    }
+    // Retrieve the result from the async operation
+    PolkitAuthorizationResult* auth_result = polkit_authority_check_authorization_finish(authority, result, &error);
 
-    for (int i = 0; i < num_msg; i++) {
-      (*resp)[i].resp = strdup(data->password);
+    if (error) {
+        std::cout << error->message << std::endl;
+        fl_method_call_respond((FlMethodCall*)user_data, FL_METHOD_RESPONSE(fl_method_error_response_new("authError", error->message, nullptr)), nullptr);
+        g_clear_error(&error);
+        g_object_unref(user_data);
+        return;
     }
-
-    return PAM_SUCCESS;
-}
-
-static void authenticate(const gchar* password, FlMethodCall* method_call) {
-    // Get the current username
-    struct passwd* pw = getpwuid(getuid());
-    if (pw == nullptr) {
-        fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_error_response_new("authError", "Cannot get current user.", nullptr)), nullptr);
+    if (auth_result == nullptr) {
+        fl_method_call_respond((FlMethodCall*)user_data, FL_METHOD_RESPONSE(fl_method_success_response_new(fl_value_new_bool(false))), nullptr);
+        g_object_unref(user_data);
         return;
     }
 
-    // Set up PAM conversation
-    struct pam_response_t data;
-    data.password = password;
+    gboolean success = polkit_authorization_result_get_is_authorized(auth_result);
+    fl_method_call_respond((FlMethodCall*)user_data, FL_METHOD_RESPONSE(fl_method_success_response_new(fl_value_new_bool(success))), nullptr);
 
-    struct pam_conv conv;
-    conv.conv = pam_conversation;
-    conv.appdata_ptr = &data;
+    g_object_unref(user_data); // Unref the method call after use
+}
 
-    // Start PAM session
-    pam_handle_t* pamh = nullptr;
-    int ret = pam_start("login", pw->pw_name, &conv, &pamh);
-    if (ret != PAM_SUCCESS) {
-        fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_error_response_new("authError", "Could not start authentication session.", nullptr)), nullptr);
+static void authenticate(FlMethodCall* method_call) {
+    GError* error = nullptr;
+    PolkitAuthority* authority = polkit_authority_get_sync(nullptr, &error);
+    if (error || authority == nullptr) {
+        fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_error_response_new("authError", error->message, nullptr)), nullptr);
         return;
     }
 
-    // Try to authenticate
-    ret = pam_authenticate(pamh, 0);
-
-    // Clean up
-    pam_end(pamh, ret);
-
-    FlValue* success = fl_value_new_bool(ret == PAM_SUCCESS);
-    fl_method_call_respond(method_call, FL_METHOD_RESPONSE(fl_method_success_response_new(success)), nullptr);
+    PolkitSubject* subject = polkit_unix_process_new_for_owner(getpid(), 0, -1);
+    polkit_authority_check_authorization(
+        authority,
+        subject,
+        "app.openauthenticator.authenticate",
+        nullptr,
+        POLKIT_CHECK_AUTHORIZATION_FLAGS_ALLOW_USER_INTERACTION,
+        nullptr,
+        (GAsyncReadyCallback) authenticate_async_callback,
+        g_object_ref(method_call)
+    );
 }
 
 static void method_call_cb(FlMethodChannel* channel, FlMethodCall* method_call, gpointer user_data) {
     const gchar* method = fl_method_call_get_name(method_call);
 
     if (strcmp(method, "localAuth.isDeviceSupported") == 0) {
-        g_autoptr(FlValue) result = fl_value_new_bool(can_authenticate());
-        g_autoptr(FlMethodResponse) response = FL_METHOD_RESPONSE(fl_method_success_response_new(result));
-        fl_method_call_respond(method_call, response, nullptr);
-    } else if (strcmp(method, "localAuth.getRealName") == 0) {
-        g_autoptr(FlValue) result = fl_value_new_string(get_real_name());
-        g_autoptr(FlMethodResponse) response = FL_METHOD_RESPONSE(fl_method_success_response_new(result));
-        fl_method_call_respond(method_call, response, nullptr);
-    } else if (strcmp(method, "localAuth.getAvatarPath") == 0) {
-        g_autoptr(FlValue) result = fl_value_new_string(get_avatar_path());
-        g_autoptr(FlMethodResponse) response = FL_METHOD_RESPONSE(fl_method_success_response_new(result));
-        fl_method_call_respond(method_call, response, nullptr);
+        can_authenticate(method_call);
     } else if (strcmp(method, "localAuth.authenticate") == 0) {
-        FlValue* args = fl_method_call_get_args(method_call);
-        FlValue* password = fl_value_lookup_string(args, "password");
-        authenticate(fl_value_get_string(password), method_call);
+        authenticate(method_call);
     } else {
         g_autoptr(FlMethodResponse) response = FL_METHOD_RESPONSE(fl_method_not_implemented_response_new());
         fl_method_call_respond(method_call, response, nullptr);