sys-auth/polkit: backport pkexec help/version fix (fixes gparted)

Closes: https://bugs.gentoo.org/827884
Signed-off-by: Sam James <sam@gentoo.org>

2 files changed, 196 insertions, 0 deletions

diff --git a/sys-auth/polkit/files/polkit-0.120_p20220221-pkexec-suid.patch b/sys-auth/polkit/files/polkit-0.120_p20220221-pkexec-suid.patch
new file mode 100644
index 000000000000..959656b158a1
--- /dev/null
+++ b/sys-auth/polkit/files/polkit-0.120_p20220221-pkexec-suid.patch
@@ -0,0 +1,67 @@
+https://gitlab.freedesktop.org/polkit/polkit/-/commit/7d4b52c4d71c46049d87a0775de695ea914f3f1b
+https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/113
+https://bugs.gentoo.org/827884
+
+From: Matt Turner <mattst88@gmail.com>
+Date: Tue, 3 May 2022 12:54:37 +0000
+Subject: [PATCH] pkexec: Allow --version and --help even if not setuid root
+
+--- a/src/programs/pkexec.c
++++ b/src/programs/pkexec.c
+@@ -514,27 +514,6 @@ main (int argc, char *argv[])
+   /* Disable remote file access from GIO. */
+   setenv ("GIO_USE_VFS", "local", 1);
+ 
+-  /* check for correct invocation */
+-  if (geteuid () != 0)
+-    {
+-      g_printerr ("pkexec must be setuid root\n");
+-      goto out;
+-    }
+-
+-  original_user_name = g_strdup (g_get_user_name ());
+-  if (original_user_name == NULL)
+-    {
+-      g_printerr ("Error getting user name.\n");
+-      goto out;
+-    }
+-
+-  if ((original_cwd = g_get_current_dir ()) == NULL)
+-    {
+-      g_printerr ("Error getting cwd: %s\n",
+-                  g_strerror (errno));
+-      goto out;
+-    }
+-
+   /* First process options and find the command-line to invoke. Avoid using fancy library routines
+    * that depend on environtment variables since we haven't cleared the environment just yet.
+    */
+@@ -595,6 +574,27 @@ main (int argc, char *argv[])
+       goto out;
+     }
+ 
++  /* check for correct invocation */
++  if (geteuid () != 0)
++    {
++      g_printerr ("pkexec must be setuid root\n");
++      goto out;
++    }
++
++  original_user_name = g_strdup (g_get_user_name ());
++  if (original_user_name == NULL)
++    {
++      g_printerr ("Error getting user name.\n");
++      goto out;
++    }
++
++  if ((original_cwd = g_get_current_dir ()) == NULL)
++    {
++      g_printerr ("Error getting cwd: %s\n",
++                  g_strerror (errno));
++      goto out;
++    }
++
+   if (opt_user == NULL)
+     opt_user = g_strdup ("root");
+ 
+GitLab
diff --git a/sys-auth/polkit/polkit-0.120_p20220221-r1.ebuild b/sys-auth/polkit/polkit-0.120_p20220221-r1.ebuild
new file mode 100644
index 000000000000..a1b8221ce450
--- /dev/null
+++ b/sys-auth/polkit/polkit-0.120_p20220221-r1.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson pam pax-utils systemd xdg-utils
+
+DESCRIPTION="Policy framework for controlling privileges for system-wide services"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://gitlab.freedesktop.org/polkit/polkit"
+if [[ ${PV} == *_p* ]] ; then
+	MY_COMMIT="b10a1bdb697045db40774f2a9a8c58ae5c7189c3"
+	SRC_URI="https://gitlab.freedesktop.org/polkit/polkit/-/archive/${MY_COMMIT}/polkit-${MY_COMMIT}.tar.bz2 -> ${P}.tar.bz2"
+	S="${WORKDIR}"/${PN}-${MY_COMMIT}
+else
+	SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz"
+fi
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+duktape examples gtk +introspection kde pam selinux systemd test"
+#RESTRICT="!test? ( test )"
+# Tests currently don't work with meson. See
+#   https://gitlab.freedesktop.org/polkit/polkit/-/issues/144
+RESTRICT="test"
+
+BDEPEND="
+	acct-user/polkitd
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	dev-libs/glib
+	dev-libs/gobject-introspection-common
+	dev-libs/libxslt
+	dev-util/glib-utils
+	sys-devel/gettext
+	virtual/pkgconfig
+	introspection? ( dev-libs/gobject-introspection )
+"
+DEPEND="
+	dev-libs/glib:2
+	dev-libs/expat
+	duktape? ( dev-lang/duktape:= )
+	!duktape? ( dev-lang/spidermonkey:91[-debug] )
+	pam? (
+		sys-auth/pambase
+		sys-libs/pam
+	)
+	!pam? ( virtual/libcrypt:= )
+	systemd? ( sys-apps/systemd:0=[policykit] )
+	!systemd? ( sys-auth/elogind )
+"
+RDEPEND="${DEPEND}
+	acct-user/polkitd
+	selinux? ( sec-policy/selinux-policykit )
+"
+PDEPEND="
+	gtk? ( || (
+		>=gnome-extra/polkit-gnome-0.105
+		>=lxde-base/lxsession-0.5.2
+	) )
+	kde? ( kde-plasma/polkit-kde-agent )
+"
+
+DOCS=( docs/TODO HACKING NEWS README )
+
+QA_MULTILIB_PATHS="
+	usr/lib/polkit-1/polkit-agent-helper-1
+	usr/lib/polkit-1/polkitd"
+
+src_prepare() {
+	local PATCHES=(
+		# musl
+		"${FILESDIR}"/${PN}-0.118-make-netgroup-support-optional.patch
+		# In next release
+		"${FILESDIR}"/${P}-pkexec-suid.patch
+
+		# Pending upstream
+		"${FILESDIR}"/${PN}-0.120-meson.patch
+	)
+
+	default
+
+	# bug #401513
+	sed -i -e 's|unix-group:wheel|unix-user:0|' src/polkitbackend/*-default.rules || die
+}
+
+src_configure() {
+	xdg_environment_reset
+
+	local emesonargs=(
+		--localstatedir="${EPREFIX}"/var
+		-Dauthfw="$(usex pam pam shadow)"
+		-Dexamples=false
+		-Dgtk_doc=false
+		-Dman=true
+		-Dos_type=gentoo
+		-Dsession_tracking="$(usex systemd libsystemd-login libelogind)"
+		-Dsystemdsystemunitdir="$(systemd_get_systemunitdir)"
+		-Djs_engine=$(usex duktape duktape mozjs)
+		$(meson_use introspection)
+		$(meson_use test tests)
+		$(usex pam "-Dpam_module_dir=$(getpam_mod_dir)" '')
+	)
+	meson_src_configure
+}
+
+src_compile() {
+	meson_src_compile
+
+	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
+	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
+}
+
+src_install() {
+	meson_src_install
+
+	if use examples ; then
+		docinto examples
+		dodoc src/examples/{*.c,*.policy*}
+	fi
+
+	diropts -m 0700 -o polkitd
+	keepdir /usr/share/polkit-1/rules.d
+}
+
+pkg_postinst() {
+	chmod 0700 "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+	chown polkitd "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+}