polkit: create hook to check for polkit permissions

pkg/lib/hooks.js

@@ -20,6 +20,7 @@
 import cockpit from 'cockpit';
 import { useState, useEffect, useRef, useReducer } from 'react';
 import deep_equal from "deep-equal";
+import { superuser } from 'superuser';
 
 /* HOOKS
  *
@@ -324,3 +325,53 @@ export function useEvent(obj, event, handler) {
 export function useInit(func, deps, comps, destroy = null) {
     return useObject(func, destroy, deps || [], comps);
 }
+
+/* - usePolkitPermissions(actions)
+*
+ * function Component(arg) {
+ *   const permissions = usePolkitPermissions([
+ *     'org.freedesktop.NetworkManager.reload',
+ *     'org.freedesktop.NetworkManager.network-control'
+ *   ]);
+ *
+ *   ...
+ *  }
+ *
+ * The returned value from the hook is an object of string: boolean,
+ * mapped by action to whether the action is allowed or not.
+ * This also checks if 'superuser.allowed' is true and bypasses the
+ * pkcheck if so.
+ * ]);
+*/
+export function usePolkitPermissions(actions) {
+    useEvent(superuser, "changed");
+
+    const [permissions, setPermissions] = useState(() =>
+        actions.reduce((acc, action) => {
+            acc[action] = false;
+            return acc;
+        }, {})
+    );
+
+    useEffect(() => {
+        if (superuser.allowed) {
+            setPermissions(actions.reduce((acc, action) => {
+                acc[action] = true;
+                return acc;
+            }, {}));
+        }
+
+        Promise.allSettled(actions.map((action) =>
+            // pkcheck returns a 0 status code if the check passed
+            cockpit.spawn(['sh', '-c', `pkcheck --action-id ${action} --process $$ --allow-user-interaction 2>&1`], { superuser: 'try' })
+        )).then((results) => {
+            setPermissions(results.reduce((acc, result, index) => {
+                acc[actions[index]] = result.status === 'fulfilled';
+                return acc;
+            }, {}));
+        });
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [JSON.stringify(actions), superuser.allowed]);
+
+    return permissions;
+}

pkg/networkmanager/networkmanager.jsx

@@ -33,11 +33,11 @@ import { UsageMonitor } from './helpers.js';
 
 import * as service from 'service.js';
 import { init as initDialogs, NetworkManagerModel } from './interfaces.js';
-import { superuser } from 'superuser';
 import { PlotState } from 'plot';
 
 import { useObject, useEvent, usePageLocation } from "hooks";
 import { WithDialogs } from "dialogs.jsx";
+import { usePolkitPermissions } from '../lib/hooks.js';
 
 const _ = cockpit.gettext;
 
@@ -55,7 +55,19 @@ const App = () => {
 
     const { path } = usePageLocation();
 
-    useEvent(superuser, "changed");
+    // This uses polkit but falls back to superuser.allowed
+    const polkitPermissions = usePolkitPermissions([
+        'org.freedesktop.NetworkManager.reload',
+        'org.freedesktop.NetworkManager.checkpoint-rollback',
+        'org.freedesktop.NetworkManager.network-control',
+        'org.freedesktop.NetworkManager.settings.modify.global-dns',
+        'org.freedesktop.NetworkManager.settings.modify.hostname',
+        'org.freedesktop.NetworkManager.settings.modify.own',
+        'org.freedesktop.NetworkManager.settings.modify.system'
+    ]);
+
+    // For now we require all of the permissions to be true
+    const privileged = Object.values(polkitPermissions).every(Boolean);
 
     const usage_monitor = useObject(() => new UsageMonitor(), null, []);
     const plot_state_main = useObject(() => new PlotState(), null, []);
@@ -117,7 +129,7 @@ const App = () => {
         return (
             <ModelContext.Provider value={model}>
                 <WithDialogs key="1">
-                    <NetworkPage privileged={superuser.allowed}
+                    <NetworkPage privileged={privileged}
                                  operationInProgress={model.operationInProgress}
                                  usage_monitor={usage_monitor}
                                  plot_state={plot_state_main}
@@ -132,7 +144,7 @@ const App = () => {
             return (
                 <ModelContext.Provider value={model}>
                     <WithDialogs key="2">
-                        <NetworkInterfacePage privileged={superuser.allowed}
+                        <NetworkInterfacePage privileged={privileged}
                                               operationInProgress={model.operationInProgress}
                                               usage_monitor={usage_monitor}
                                               plot_state={plot_state_iface}