#polkit

hai I’m Azamina :3 my main is @strongest-soldier-jyl

This is a sideblog that is intended to be similar to the many other oss-official blogs like x11-official, kde-plasma-official, etc.

I intend to dump my tech related ramblings here :3

Feel free to send asks rambling about anything tech related too! I love hearing people gush about how they finally got some technology working on their machine or whatever :3 be excited! i love seeing you all excited :3

Some stuff that’s less about the blog and more about me under the cut

CISA Says ‘PwnKit’ Linux Vulnerability Exploited in Attacks

Home › Virus & Threats CISA Says ‘PwnKit’ Linux Vulnerability Exploited in Attacks By Eduard Kovacs on June 28, 2022 Tweet The US Cybersecurity and Infrastructure Security Agency (CISA) says a Linux vulnerability tracked as CVE-2021-4034 and PwnKit has been exploited in attacks. The flaw, which came to light in January, affects Polkit, a component designed for controlling system-wide privileges…

Old Code Can Give Root To Unprivileged Users

It looks like IT teams have no respite. Following all the hassles caused by Log4j (and its variants), there is a new high profile, high-risk vulnerability making the rounds. CVE-2021-4034, or PwnKit if you’re into fancy CVE nicknames, is a polkit vulnerability that lets unprivileged users gain root privileges on basically any Linux system out there that has polkit installed. NOTE: Patches are now…

PolKit has two types of configuration items: rules and actions. The actions available to the application are defined in XML files stored in /usr/share/polkit-1/actions. After version 0.106 of polkit (CentOS-6.5 is 0.96-5) the rules controlling the privilege of the application are written in JavaScript.. For CentOS-6.5 we need to follow the old instructions using the pkla formatted rules instead.

rpm -qi polkit* polkit-gnome-0.96-3.el6.x86_64 polkit-0.96-5.el6_4.x86_64 polkit-desktop-policy-0.96-5.el6_4.noarch

We can re-configure the default local authority, which starts off with an empty set of local rules, and add in one with a unique name ending in the the extension .pkla Reverse DNS naming schemes are suggested in the manpage. :

# ls -al /etc/polkit-1/localauthority/50-local.d/ total 8 drwxr-xr-x. 2 root root 4096 Sep 19 2013 . drwx------. 7 root root 4096 Sep 19 2013 ..

to allow access to virt-manager for the session user (named "ush") in this case:

less /etc/polkit-1/localauthority/50-local.d/com.no-ip.rabelais-libvirt-ush.pkla [libvirtd access for user ush] Identity=unix-user:ush Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes

Now, clicking on the virt-manager icon will bring up the list of managed vms without any need to input the password. There was no need to restart any daemons or explicitly re-load any configuration.

If you don't use gnome as your window manager and starts virt-manager, you might get the error bellow:

Unable to connect to libvirt. authentication failed: polkit: polkit\56retains_authorization_after_challenge=1 Authorization requires authentication but no agent is available. Libvirt URI is: qemu:///system Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/connection.py", line 1027, in _open_thread self.vmm = self._try_open() File "/usr/share/virt-manager/virtManager/connection.py", line 1009, in _try_open flags) File "/usr/lib64/python2.7/site-packages/libvirt.py", line 102, in openAuth if ret is None:raise libvirtError('virConnectOpenAuth() failed') libvirtError: authentication failed: polkit: polkit\56retains_authorization_after_challenge=1 Authorization requires authentication but no agent is available.

As the error says, this happens because the authentication agent is not available. You have two options: run the agent or disable the check.

Option 1: Run the agent

In fedora the agent is in the /usr/libexec/, just run it. You can put this in yours window manager file in order to run everytime you start a session:

/usr/libexec/polkit-gnome-authentication-agent-1 &

Done! Now when you run virt-manager again, a box asking for the password will be shown.

Option 2: Disable the check

Edit the file /usr/share/polkit-1/actions/org.libvirt.unix.policy file and change the lines with the values bellow:

<allow_any>auth_admin</allow_any> <allow_inactive>auth_admin</allow_inactive> <allow_active>auth_admin_keep</allow_active>

To:

<allow_any>yes</allow_any> <allow_inactive>yes</allow_inactive> <allow_active>yes</allow_active>