system/polkit: add PAM-enabled PolicyKit

1 files changed, 1008 insertions, 0 deletions

diff --git a/system/polkit/CVE-2015-4625.patch b/system/polkit/CVE-2015-4625.patch
new file mode 100644
index 000000000..4a43fb433
--- /dev/null
+++ b/system/polkit/CVE-2015-4625.patch
@@ -0,0 +1,1008 @@
+From ea544ffc18405237ccd95d28d7f45afef49aca17 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@redhat.com>
+Date: Thu, 4 Jun 2015 12:15:18 -0400
+Subject: CVE-2015-4625: Use unpredictable cookie values, keep them secret
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Tavis noted that it'd be possible with a 32 bit counter for someone to
+cause the cookie to wrap by creating Authentication requests in a
+loop.
+
+Something important to note here is that wrapping of signed integers
+is undefined behavior in C, so we definitely want to fix that.  All
+counter integers used in this patch are unsigned.
+
+See the comment above `authentication_agent_generate_cookie` for
+details, but basically we're now using a cookie of the form:
+
+```
+        <agent serial> - <agent random id> - <session serial> - <session
+random id>
+```
+
+Which has multiple 64 bit counters, plus unpredictable random 128 bit
+integer ids (effectively UUIDs, but we're not calling them that
+because we don't need to be globally unique.
+
+We further ensure that the cookies are not visible to other processes
+by changing the setuid helper to accept them over standard input.  This
+means that an attacker would have to guess both ids.
+
+In any case, the security hole here is better fixed with the other
+change to bind user id (uid) of the agent with cookie lookups, making
+cookie guessing worthless.
+
+Nevertheless, I think it's worth doing this change too, for defense in
+depth.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90832
+CVE: CVE-2015-4625
+Reported-by: Tavis Ormandy <taviso@google.com>
+Reviewed-by: Miloslav Trmač <mitr@redhat.com>
+Signed-off-by: Colin Walters <walters@redhat.com>
+
+diff --git a/src/polkitagent/polkitagenthelper-pam.c b/src/polkitagent/polkitagenthelper-pam.c
+index 937386e..19062aa 100644
+--- a/src/polkitagent/polkitagenthelper-pam.c
++++ b/src/polkitagent/polkitagenthelper-pam.c
+@@ -65,7 +65,7 @@ main (int argc, char *argv[])
+ {
+   int rc;
+   const char *user_to_auth;
+-  const char *cookie;
++  char *cookie = NULL;
+   struct pam_conv pam_conversation;
+   pam_handle_t *pam_h;
+   const void *authed_user;
+@@ -97,7 +97,7 @@ main (int argc, char *argv[])
+   openlog ("polkit-agent-helper-1", LOG_CONS | LOG_PID, LOG_AUTHPRIV);
+ 
+   /* check for correct invocation */
+-  if (argc != 3)
++  if (!(argc == 2 || argc == 3))
+     {
+       syslog (LOG_NOTICE, "inappropriate use of helper, wrong number of arguments [uid=%d]", getuid ());
+       fprintf (stderr, "polkit-agent-helper-1: wrong number of arguments. This incident has been logged.\n");
+@@ -105,7 +105,10 @@ main (int argc, char *argv[])
+     }
+ 
+   user_to_auth = argv[1];
+-  cookie = argv[2];
++
++  cookie = read_cookie (argc, argv);
++  if (!cookie)
++    goto error;
+ 
+   if (getuid () != 0)
+     {
+@@ -203,6 +206,8 @@ main (int argc, char *argv[])
+       goto error;
+     }
+ 
++  free (cookie);
++
+ #ifdef PAH_DEBUG
+   fprintf (stderr, "polkit-agent-helper-1: successfully sent D-Bus message to PolicyKit daemon\n");
+ #endif /* PAH_DEBUG */
+@@ -212,6 +217,7 @@ main (int argc, char *argv[])
+   return 0;
+ 
+ error:
++  free (cookie);
+   if (pam_h != NULL)
+     pam_end (pam_h, rc);
+ 
+diff --git a/src/polkitagent/polkitagenthelper-shadow.c b/src/polkitagent/polkitagenthelper-shadow.c
+index a4f73ac..e877915 100644
+--- a/src/polkitagent/polkitagenthelper-shadow.c
++++ b/src/polkitagent/polkitagenthelper-shadow.c
+@@ -46,7 +46,7 @@ main (int argc, char *argv[])
+ {
+   struct spwd *shadow;
+   const char *user_to_auth;
+-  const char *cookie;
++  char *cookie = NULL;
+   time_t now;
+ 
+   /* clear the entire environment to avoid attacks with
+@@ -67,7 +67,7 @@ main (int argc, char *argv[])
+   openlog ("polkit-agent-helper-1", LOG_CONS | LOG_PID, LOG_AUTHPRIV);
+ 
+   /* check for correct invocation */
+-  if (argc != 3)
++  if (!(argc == 2 || argc == 3))
+     {
+       syslog (LOG_NOTICE, "inappropriate use of helper, wrong number of arguments [uid=%d]", getuid ());
+       fprintf (stderr, "polkit-agent-helper-1: wrong number of arguments. This incident has been logged.\n");
+@@ -86,7 +86,10 @@ main (int argc, char *argv[])
+     }
+ 
+   user_to_auth = argv[1];
+-  cookie = argv[2];
++
++  cookie = read_cookie (argc, argv);
++  if (!cookie)
++    goto error;
+ 
+ #ifdef PAH_DEBUG
+   fprintf (stderr, "polkit-agent-helper-1: user to auth is '%s'.\n", user_to_auth);
+@@ -153,6 +156,8 @@ main (int argc, char *argv[])
+       goto error;
+     }
+ 
++  free (cookie);
++
+ #ifdef PAH_DEBUG
+   fprintf (stderr, "polkit-agent-helper-1: successfully sent D-Bus message to PolicyKit daemon\n");
+ #endif /* PAH_DEBUG */
+@@ -162,6 +167,7 @@ main (int argc, char *argv[])
+   return 0;
+ 
+ error:
++  free (cookie);
+   fprintf (stdout, "FAILURE\n");
+   flush_and_wait ();
+   return 1;
+diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
+index cfa77fc..e23f9f5 100644
+--- a/src/polkitagent/polkitagenthelperprivate.c
++++ b/src/polkitagent/polkitagenthelperprivate.c
+@@ -23,6 +23,7 @@
+ #include "config.h"
+ #include "polkitagenthelperprivate.h"
+ #include <stdio.h>
++#include <string.h>
+ #include <stdlib.h>
+ #include <unistd.h>
+ 
+@@ -45,6 +46,38 @@ _polkit_clearenv (void)
+ #endif
+ 
+ 
++char *
++read_cookie (int argc, char **argv)
++{
++  /* As part of CVE-2015-4625, we started passing the cookie
++   * on standard input, to ensure it's not visible to other
++   * processes.  However, to ensure that things continue
++   * to work if the setuid binary is upgraded while old
++   * agents are still running (this will be common with
++   * package managers), we support both modes.
++   */
++  if (argc == 3)
++    return strdup (argv[2]);
++  else
++    {
++      char *ret = NULL;
++      size_t n = 0;
++      ssize_t r = getline (&ret, &n, stdin);
++      if (r == -1)
++        {
++          if (!feof (stdin))
++            perror ("getline");
++          free (ret);
++          return NULL;
++        }
++      else
++        {
++          g_strchomp (ret);
++          return ret;
++        }
++    }
++}
++
+ gboolean
+ send_dbus_message (const char *cookie, const char *user)
+ {
+diff --git a/src/polkitagent/polkitagenthelperprivate.h b/src/polkitagent/polkitagenthelperprivate.h
+index aeca2c7..547fdcc 100644
+--- a/src/polkitagent/polkitagenthelperprivate.h
++++ b/src/polkitagent/polkitagenthelperprivate.h
+@@ -38,6 +38,8 @@
+ 
+ int _polkit_clearenv (void);
+ 
++char *read_cookie (int argc, char **argv);
++
+ gboolean send_dbus_message (const char *cookie, const char *user);
+ 
+ void flush_and_wait ();
+diff --git a/src/polkitagent/polkitagentsession.c b/src/polkitagent/polkitagentsession.c
+index f014773..8b93ad0 100644
+--- a/src/polkitagent/polkitagentsession.c
++++ b/src/polkitagent/polkitagentsession.c
+@@ -55,6 +55,7 @@
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <sys/wait.h>
++#include <gio/gunixoutputstream.h>
+ #include <pwd.h>
+ 
+ #include "polkitagentmarshal.h"
+@@ -88,7 +89,7 @@ struct _PolkitAgentSession
+   gchar *cookie;
+   PolkitIdentity *identity;
+ 
+-  int child_stdin;
++  GOutputStream *child_stdin;
+   int child_stdout;
+   GPid child_pid;
+ 
+@@ -129,7 +130,6 @@ G_DEFINE_TYPE (PolkitAgentSession, polkit_agent_session, G_TYPE_OBJECT);
+ static void
+ polkit_agent_session_init (PolkitAgentSession *session)
+ {
+-  session->child_stdin = -1;
+   session->child_stdout = -1;
+ }
+ 
+@@ -395,11 +395,7 @@ kill_helper (PolkitAgentSession *session)
+       session->child_stdout = -1;
+     }
+ 
+-  if (session->child_stdin != -1)
+-    {
+-      g_warn_if_fail (close (session->child_stdin) == 0);
+-      session->child_stdin = -1;
+-    }
++  g_clear_object (&session->child_stdin);
+ 
+   session->helper_is_running = FALSE;
+ 
+@@ -545,9 +541,9 @@ polkit_agent_session_response (PolkitAgentSession *session,
+ 
+   add_newline = (response[response_len] != '\n');
+ 
+-  write (session->child_stdin, response, response_len);
++  (void) g_output_stream_write_all (session->child_stdin, response, response_len, NULL, NULL, NULL);
+   if (add_newline)
+-    write (session->child_stdin, newline, 1);
++    (void) g_output_stream_write_all (session->child_stdin, newline, 1, NULL, NULL, NULL);
+ }
+ 
+ /**
+@@ -567,8 +563,9 @@ polkit_agent_session_initiate (PolkitAgentSession *session)
+ {
+   uid_t uid;
+   GError *error;
+-  gchar *helper_argv[4];
++  gchar *helper_argv[3];
+   struct passwd *passwd;
++  int stdin_fd = -1;
+ 
+   g_return_if_fail (POLKIT_AGENT_IS_SESSION (session));
+ 
+@@ -600,10 +597,8 @@ polkit_agent_session_initiate (PolkitAgentSession *session)
+ 
+   helper_argv[0] = PACKAGE_PREFIX "/lib/polkit-1/polkit-agent-helper-1";
+   helper_argv[1] = passwd->pw_name;
+-  helper_argv[2] = session->cookie;
+-  helper_argv[3] = NULL;
++  helper_argv[2] = NULL;
+ 
+-  session->child_stdin = -1;
+   session->child_stdout = -1;
+ 
+   error = NULL;
+@@ -615,7 +610,7 @@ polkit_agent_session_initiate (PolkitAgentSession *session)
+                                  NULL,
+                                  NULL,
+                                  &session->child_pid,
+-                                 &session->child_stdin,
++                                 &stdin_fd,
+                                  &session->child_stdout,
+                                  NULL,
+                                  &error))
+@@ -628,6 +623,13 @@ polkit_agent_session_initiate (PolkitAgentSession *session)
+   if (G_UNLIKELY (_show_debug ()))
+     g_print ("PolkitAgentSession: spawned helper with pid %d\n", (gint) session->child_pid);
+ 
++  session->child_stdin = (GOutputStream*)g_unix_output_stream_new (stdin_fd, TRUE);
++
++  /* Write the cookie on stdin so it can't be seen by other processes */
++  (void) g_output_stream_write_all (session->child_stdin, session->cookie, strlen (session->cookie),
++                                    NULL, NULL, NULL);
++  (void) g_output_stream_write_all (session->child_stdin, "\n", 1, NULL, NULL, NULL);
++
+   session->child_stdout_channel = g_io_channel_unix_new (session->child_stdout);
+   session->child_stdout_watch_source = g_io_create_watch (session->child_stdout_channel,
+                                                           G_IO_IN | G_IO_ERR | G_IO_HUP);
+diff --git a/src/polkitbackend/polkitbackendinteractiveauthority.c b/src/polkitbackend/polkitbackendinteractiveauthority.c
+index 3f339e9..15adc6a 100644
+--- a/src/polkitbackend/polkitbackendinteractiveauthority.c
++++ b/src/polkitbackend/polkitbackendinteractiveauthority.c
+@@ -214,6 +214,8 @@ typedef struct
+ 
+   GDBusConnection *system_bus_connection;
+   guint name_owner_changed_signal_id;
++
++  guint64 agent_serial;
+ } PolkitBackendInteractiveAuthorityPrivate;
+ 
+ /* ---------------------------------------------------------------------------------------------------- */
+@@ -439,11 +441,15 @@ struct AuthenticationAgent
+   volatile gint ref_count;
+ 
+   PolkitSubject *scope;
++  guint64 serial;
+ 
+   gchar *locale;
+   GVariant *registration_options;
+   gchar *object_path;
+   gchar *unique_system_bus_name;
++  GRand *cookie_pool;
++  gchar *cookie_prefix;
++  guint64  cookie_serial;
+ 
+   GDBusProxy *proxy;
+ 
+@@ -1427,9 +1433,54 @@ authentication_session_cancelled_cb (GCancellable *cancellable,
+   authentication_session_cancel (session);
+ }
+ 
++/* We're not calling this a UUID, but it's basically
++ * the same thing, just not formatted that way because:
++ *
++ *  - I'm too lazy to do it
++ *  - If we did, people might think it was actually
++ *    generated from /dev/random, which we're not doing
++ *    because this value doesn't actually need to be
++ *    globally unique.
++ */
++static void
++append_rand_u128_str (GString *buf,
++                      GRand   *pool)
++{
++  g_string_append_printf (buf, "%08x%08x%08x%08x",
++                          g_rand_int (pool),
++                          g_rand_int (pool),
++                          g_rand_int (pool),
++                          g_rand_int (pool));
++}
++
++/* A value that should be unique to the (AuthenticationAgent, AuthenticationSession)
++ * pair, and not guessable by other agents.
++ *
++ * <agent serial> - <agent uuid> - <session serial> - <session uuid>
++ *
++ * See http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html
++ *
++ */
++static gchar *
++authentication_agent_generate_cookie (AuthenticationAgent *agent)
++{
++  GString *buf = g_string_new ("");
++
++  g_string_append (buf, agent->cookie_prefix);
++  
++  g_string_append_c (buf, '-');
++  agent->cookie_serial++;
++  g_string_append_printf (buf, "%" G_GUINT64_FORMAT, 
++                          agent->cookie_serial);
++  g_string_append_c (buf, '-');
++  append_rand_u128_str (buf, agent->cookie_pool);
++
++  return g_string_free (buf, FALSE);
++}
++
++
+ static AuthenticationSession *
+ authentication_session_new (AuthenticationAgent         *agent,
+-                            const gchar                 *cookie,
+                             PolkitSubject               *subject,
+                             PolkitIdentity              *user_of_subject,
+                             PolkitSubject               *caller,
+@@ -1447,7 +1498,7 @@ authentication_session_new (AuthenticationAgent         *agent,
+ 
+   session = g_new0 (AuthenticationSession, 1);
+   session->agent = authentication_agent_ref (agent);
+-  session->cookie = g_strdup (cookie);
++  session->cookie = authentication_agent_generate_cookie (agent);
+   session->subject = g_object_ref (subject);
+   session->user_of_subject = g_object_ref (user_of_subject);
+   session->caller = g_object_ref (caller);
+@@ -1496,16 +1547,6 @@ authentication_session_free (AuthenticationSession *session)
+   g_free (session);
+ }
+ 
+-static gchar *
+-authentication_agent_new_cookie (AuthenticationAgent *agent)
+-{
+-  static gint counter = 0;
+-
+-  /* TODO: use a more random-looking cookie */
+-
+-  return g_strdup_printf ("cookie%d", counter++);
+-}
+-
+ static PolkitSubject *
+ authentication_agent_get_scope (AuthenticationAgent *agent)
+ {
+@@ -1553,12 +1594,15 @@ authentication_agent_unref (AuthenticationAgent *agent)
+       g_free (agent->unique_system_bus_name);
+       if (agent->registration_options != NULL)
+         g_variant_unref (agent->registration_options);
++      g_rand_free (agent->cookie_pool);
++      g_free (agent->cookie_prefix);
+       g_free (agent);
+     }
+ }
+ 
+ static AuthenticationAgent *
+-authentication_agent_new (PolkitSubject *scope,
++authentication_agent_new (guint64      serial,
++                          PolkitSubject *scope,
+                           const gchar *unique_system_bus_name,
+                           const gchar *locale,
+                           const gchar *object_path,
+@@ -1592,6 +1636,7 @@ authentication_agent_new (PolkitSubject *scope,
+ 
+   agent = g_new0 (AuthenticationAgent, 1);
+   agent->ref_count = 1;
++  agent->serial = serial;
+   agent->scope = g_object_ref (scope);
+   agent->object_path = g_strdup (object_path);
+   agent->unique_system_bus_name = g_strdup (unique_system_bus_name);
+@@ -1599,6 +1644,25 @@ authentication_agent_new (PolkitSubject *scope,
+   agent->registration_options = registration_options != NULL ? g_variant_ref (registration_options) : NULL;
+   agent->proxy = proxy;
+ 
++  {
++    GString *cookie_prefix = g_string_new ("");
++    GRand *agent_private_rand = g_rand_new ();
++
++    g_string_append_printf (cookie_prefix, "%" G_GUINT64_FORMAT "-", agent->serial);
++
++    /* Use a uniquely seeded PRNG to get a prefix cookie for this agent,
++     * whose sequence will not correlate with the per-authentication session
++     * cookies.
++     */
++    append_rand_u128_str (cookie_prefix, agent_private_rand);
++    g_rand_free (agent_private_rand);
++
++    agent->cookie_prefix = g_string_free (cookie_prefix, FALSE);
++    
++    /* And a newly seeded pool for per-session cookies */
++    agent->cookie_pool = g_rand_new ();
++  }
++
+   return agent;
+ }
+ 
+@@ -2193,7 +2257,6 @@ authentication_agent_initiate_challenge (AuthenticationAgent         *agent,
+ {
+   PolkitBackendInteractiveAuthorityPrivate *priv = POLKIT_BACKEND_INTERACTIVE_AUTHORITY_GET_PRIVATE (authority);
+   AuthenticationSession *session;
+-  gchar *cookie;
+   GList *l;
+   GList *identities;
+   gchar *localized_message;
+@@ -2215,8 +2278,6 @@ authentication_agent_initiate_challenge (AuthenticationAgent         *agent,
+                                     &localized_icon_name,
+                                     &localized_details);
+ 
+-  cookie = authentication_agent_new_cookie (agent);
+-
+   identities = NULL;
+ 
+   /* select admin user if required by the implicit authorization */
+@@ -2279,7 +2340,6 @@ authentication_agent_initiate_challenge (AuthenticationAgent         *agent,
+     user_identities = g_list_prepend (NULL, polkit_unix_user_new (0));
+ 
+   session = authentication_session_new (agent,
+-                                        cookie,
+                                         subject,
+                                         user_of_subject,
+                                         caller,
+@@ -2335,7 +2395,6 @@ authentication_agent_initiate_challenge (AuthenticationAgent         *agent,
+   g_list_free_full (user_identities, g_object_unref);
+   g_list_foreach (identities, (GFunc) g_object_unref, NULL);
+   g_list_free (identities);
+-  g_free (cookie);
+ 
+   g_free (localized_message);
+   g_free (localized_icon_name);
+@@ -2482,7 +2541,9 @@ polkit_backend_interactive_authority_register_authentication_agent (PolkitBacken
+       goto out;
+     }
+ 
+-  agent = authentication_agent_new (subject,
++  priv->agent_serial++;
++  agent = authentication_agent_new (priv->agent_serial,
++                                    subject,
+                                     polkit_system_bus_name_get_name (POLKIT_SYSTEM_BUS_NAME (caller)),
+                                     locale,
+                                     object_path,
+-- 
+cgit v0.10.2
+
+From 493aa5dc1d278ab9097110c1262f5229bbaf1766 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@redhat.com>
+Date: Wed, 17 Jun 2015 13:07:02 -0400
+Subject: CVE-2015-4625: Bind use of cookies to specific uids
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html
+
+The "cookie" value that Polkit hands out is global to all polkit
+users.  And when `AuthenticationAgentResponse` is invoked, we
+previously only received the cookie and *target* identity, and
+attempted to find an agent from that.
+
+The problem is that the current cookie is just an integer
+counter, and if it overflowed, it would be possible for
+an successful authorization in one session to trigger a response
+in another session.
+
+The overflow and ability to guess the cookie were fixed by the
+previous patch.
+
+This patch is conceptually further hardening on top of that.  Polkit
+currently treats uids as equivalent from a security domain
+perspective; there is no support for
+SELinux/AppArmor/etc. differentiation.
+
+We can retrieve the uid from `getuid()` in the setuid helper, which
+allows us to ensure the uid invoking `AuthenticationAgentResponse2`
+matches that of the agent.
+
+Then the authority only looks at authentication sessions matching the
+cookie that were created by a matching uid, thus removing the ability
+for different uids to interfere with each other entirely.
+
+Several fixes to this patch were contributed by:
+Miloslav Trmač <mitr@redhat.com>
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90837
+CVE: CVE-2015-4625
+Reported-by: Tavis Ormandy <taviso@google.com>
+Reviewed-by: Miloslav Trmač <mitr@redhat.com>
+Signed-off-by: Colin Walters <walters@redhat.com>
+
+diff --git a/data/org.freedesktop.PolicyKit1.AuthenticationAgent.xml b/data/org.freedesktop.PolicyKit1.AuthenticationAgent.xml
+index 3b519c2..5beef7d 100644
+--- a/data/org.freedesktop.PolicyKit1.AuthenticationAgent.xml
++++ b/data/org.freedesktop.PolicyKit1.AuthenticationAgent.xml
+@@ -8,7 +8,19 @@
+     <annotation name="org.gtk.EggDBus.DocString" value="<para>This D-Bus interface is used for communication between the system-wide PolicyKit daemon and one or more authentication agents each running in a user session.</para><para>An authentication agent must implement this interface and register (passing the object path of the object implementing the interface) using the org.freedesktop.PolicyKit1.Authority.RegisterAuthenticationAgent() and org.freedesktop.PolicyKit1.Authority.UnregisterAuthenticationAgent() methods on the #org.freedesktop.PolicyKit1.Authority interface of the PolicyKit daemon.</para>"/>
+ 
+     <method name="BeginAuthentication">
+-      <annotation name="org.gtk.EggDBus.DocString" value="<para>Called by the PolicyKit daemon when the authentication agent needs the user to authenticate as one of the identities in @identities for the action with the identifier @action_id.</para><para>Upon succesful authentication, the authentication agent must invoke the org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse() method on the #org.freedesktop.PolicyKit1.Authority interface of the PolicyKit daemon before returning.</para><para>If the user dismisses the authentication dialog, the authentication agent should return an error.</para>"/>
++      <annotation name="org.gtk.EggDBus.DocString" value="<para>Called
++      by the PolicyKit daemon when the authentication agent needs the
++      user to authenticate as one of the identities in @identities for
++      the action with the identifier @action_id.</para><para>This
++      authentication is normally achieved via the
++      polkit_agent_session_response() API, which invokes a private
++      setuid helper process to verify the authentication.  When
++      successful, it calls the
++      org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse2()
++      method on the #org.freedesktop.PolicyKit1.Authority interface of
++      the PolicyKit daemon before returning.  If the user dismisses the
++      authentication dialog, the authentication agent should call
++      polkit_agent_session_cancel().</para>"/>
+ 
+       <arg name="action_id" direction="in" type="s">
+         <annotation name="org.gtk.EggDBus.DocString" value="The identifier for the action that the user is authentication for."/>
+diff --git a/data/org.freedesktop.PolicyKit1.Authority.xml b/data/org.freedesktop.PolicyKit1.Authority.xml
+index fbfb9cd..f9021ee 100644
+--- a/data/org.freedesktop.PolicyKit1.Authority.xml
++++ b/data/org.freedesktop.PolicyKit1.Authority.xml
+@@ -313,7 +313,29 @@
+     </method>
+ 
+     <method name="AuthenticationAgentResponse">
+-      <annotation name="org.gtk.EggDBus.DocString" value="Method for authentication agents to invoke on successful authentication. This method will fail unless a sufficiently privileged caller invokes it."/>
++      <annotation name="org.gtk.EggDBus.DocString" value="Method for authentication agents to invoke on successful
++authentication, intended only for use by a privileged helper process
++internal to polkit."/>
++
++      <arg name="cookie" direction="in" type="s">
++        <annotation name="org.gtk.EggDBus.DocString" value="The cookie identifying the authentication request that was passed to the authentication agent."/>
++      </arg>
++
++      <arg name="identity" direction="in" type="(sa{sv})">
++        <annotation name="org.gtk.EggDBus.Type" value="Identity"/>
++        <annotation name="org.gtk.EggDBus.DocString" value="A #Identity struct describing what identity was authenticated."/>
++      </arg>
++    </method>
++
++    <method name="AuthenticationAgentResponse2">
++      <annotation name="org.gtk.EggDBus.DocString" value="Method for authentication agents to invoke on successful
++authentication, intended only for use by a privileged helper process
++internal to polkit.   Note this method was added in 0.114, and should be preferred over AuthenticationAgentResponse
++as it fixes a security issue."/>
++
++      <arg name="uid" direction="in" type="u">
++        <annotation name="org.gtk.EggDBus.DocString" value="The real uid of the agent.  Normally set by the setuid helper program."/>
++      </arg>
+ 
+       <arg name="cookie" direction="in" type="s">
+         <annotation name="org.gtk.EggDBus.DocString" value="The cookie identifying the authentication request that was passed to the authentication agent."/>
+diff --git a/docs/polkit/docbook-interface-org.freedesktop.PolicyKit1.Authority.xml b/docs/polkit/docbook-interface-org.freedesktop.PolicyKit1.Authority.xml
+index 6525e25..e66bf53 100644
+--- a/docs/polkit/docbook-interface-org.freedesktop.PolicyKit1.Authority.xml
++++ b/docs/polkit/docbook-interface-org.freedesktop.PolicyKit1.Authority.xml
+@@ -42,6 +42,8 @@ Structure    <link linkend="eggdbus-struct-TemporaryAuthorization">TemporaryAuth
+                                   IN  String                         object_path)
+ <link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse">AuthenticationAgentResponse</link>      (IN  String                         cookie,
+                                   IN  <link linkend="eggdbus-struct-Identity">Identity</link>                       identity)
++<link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse">AuthenticationAgentResponse2</link>      (IN uint32 uid, IN  String                         cookie,
++                                  IN  <link linkend="eggdbus-struct-Identity">Identity</link>                       identity)
+ <link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.EnumerateTemporaryAuthorizations">EnumerateTemporaryAuthorizations</link> (IN  <link linkend="eggdbus-struct-Subject">Subject</link>                        subject,
+                                   OUT Array&lt;<link linkend="eggdbus-struct-TemporaryAuthorization">TemporaryAuthorization</link>&gt;  temporary_authorizations)
+ <link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.RevokeTemporaryAuthorizations">RevokeTemporaryAuthorizations</link>    (IN  <link linkend="eggdbus-struct-Subject">Subject</link>                        subject)
+@@ -777,10 +779,52 @@ AuthenticationAgentResponse (IN  String    cookie,
+                              IN  <link linkend="eggdbus-struct-Identity">Identity</link>  identity)
+     </programlisting>
+     <para>
+-Method for authentication agents to invoke on successful authentication. This method will fail unless a sufficiently privileged caller invokes it.
++Method for authentication agents to invoke on successful
++authentication, intended only for use by a privileged helper process
++internal to polkit.  Deprecated in favor of AuthenticationAgentResponse2.
++    </para>
++<variablelist role="params">
++  <varlistentry>
++    <term><literal>IN  String <parameter>cookie</parameter></literal>:</term>
++    <listitem>
++      <para>
++The cookie identifying the authentication request that was passed to the authentication agent.
++      </para>
++    </listitem>
++  </varlistentry>
++  <varlistentry>
++    <term><literal>IN  <link linkend="eggdbus-struct-Identity">Identity</link> <parameter>identity</parameter></literal>:</term>
++    <listitem>
++      <para>
++A <link linkend="eggdbus-struct-Identity">Identity</link> struct describing what identity was authenticated.
++      </para>
++    </listitem>
++  </varlistentry>
++</variablelist>
++    </refsect2>
++    <refsect2 role="function" id="eggdbus-method-org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse2">
++      <title>AuthenticationAgentResponse2 ()</title>
++    <programlisting>
++AuthenticationAgentResponse2 (IN  uint32 uid,
++                              IN  String cookie,
++                              IN  <link linkend="eggdbus-struct-Identity">Identity</link>  identity)
++    </programlisting>
++    <para>
++Method for authentication agents to invoke on successful
++authentication, intended only for use by a privileged helper process
++internal to polkit.  Note this method was introduced in 0.114 to fix a security issue.
+     </para>
+ <variablelist role="params">
+   <varlistentry>
++    <term><literal>IN  uint32 <parameter>uid</parameter></literal>:</term>
++    <listitem>
++      <para>
++The user id of the agent; normally this is the owner of the parent pid
++of the process that invoked the internal setuid helper.
++      </para>
++    </listitem>
++  </varlistentry>
++  <varlistentry>
+     <term><literal>IN  String <parameter>cookie</parameter></literal>:</term>
+     <listitem>
+       <para>
+diff --git a/docs/polkit/overview.xml b/docs/polkit/overview.xml
+index 150a7bc..176d2ea 100644
+--- a/docs/polkit/overview.xml
++++ b/docs/polkit/overview.xml
+@@ -314,16 +314,18 @@
+     <para>
+       Authentication agents are provided by desktop environments. When
+       an user session starts, the agent registers with the polkit
+-      Authority using
+-      the <link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.RegisterAuthenticationAgent">RegisterAuthenticationAgent()</link>
++      Authority using the <link
++      linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.RegisterAuthenticationAgent">RegisterAuthenticationAgent()</link>
+       method. When services are needed, the authority will invoke
+-      methods on
+-      the <link linkend="eggdbus-interface-org.freedesktop.PolicyKit1.AuthenticationAgent">org.freedesktop.PolicyKit1.AuthenticationAgent</link>
++      methods on the <link
++      linkend="eggdbus-interface-org.freedesktop.PolicyKit1.AuthenticationAgent">org.freedesktop.PolicyKit1.AuthenticationAgent</link>
+       D-Bus interface. Once the user is authenticated, (a privileged
+-      part of) the agent invokes
+-      the <link linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse">AuthenticationAgentResponse()</link>
+-      method.  Note that the polkit Authority itself does not care
+-      how the agent authenticates the user.
++      part of) the agent invokes the <link
++      linkend="eggdbus-method-org.freedesktop.PolicyKit1.Authority.AuthenticationAgentResponse">AuthenticationAgentResponse()</link>
++      method.  This method should be treated as an internal
++      implementation detail, and callers should use the public shared
++      library API to invoke it, which currently uses a setuid helper
++      program.
+     </para>
+     <para>
+       The <link linkend="ref-authentication-agent-api">libpolkit-agent-1</link>
+diff --git a/src/polkit/polkitauthority.c b/src/polkit/polkitauthority.c
+index ab6d3cd..6bd684a 100644
+--- a/src/polkit/polkitauthority.c
++++ b/src/polkit/polkitauthority.c
+@@ -1492,6 +1492,14 @@ polkit_authority_authentication_agent_response (PolkitAuthority      *authority,
+                                                 gpointer              user_data)
+ {
+   GVariant *identity_value;
++  /* Note that in reality, this API is only accessible to root, and
++   * only called from the setuid helper `polkit-agent-helper-1`.
++   *
++   * However, because this is currently public API, we avoid
++   * triggering warnings from ABI diff type programs by just grabbing
++   * the real uid of the caller here.
++   */
++  uid_t uid = getuid ();
+ 
+   g_return_if_fail (POLKIT_IS_AUTHORITY (authority));
+   g_return_if_fail (cookie != NULL);
+@@ -1501,8 +1509,9 @@ polkit_authority_authentication_agent_response (PolkitAuthority      *authority,
+   identity_value = polkit_identity_to_gvariant (identity);
+   g_variant_ref_sink (identity_value);
+   g_dbus_proxy_call (authority->proxy,
+-                     "AuthenticationAgentResponse",
+-                     g_variant_new ("(s@(sa{sv}))",
++                     "AuthenticationAgentResponse2",
++                     g_variant_new ("(us@(sa{sv}))",
++                                    (guint32)uid,
+                                     cookie,
+                                     identity_value),
+                      G_DBUS_CALL_FLAGS_NONE,
+diff --git a/src/polkitbackend/polkitbackendauthority.c b/src/polkitbackend/polkitbackendauthority.c
+index 601a974..03a4e84 100644
+--- a/src/polkitbackend/polkitbackendauthority.c
++++ b/src/polkitbackend/polkitbackendauthority.c
+@@ -355,6 +355,7 @@ polkit_backend_authority_unregister_authentication_agent (PolkitBackendAuthority
+ gboolean
+ polkit_backend_authority_authentication_agent_response (PolkitBackendAuthority    *authority,
+                                                         PolkitSubject             *caller,
++                                                        uid_t                      uid,
+                                                         const gchar               *cookie,
+                                                         PolkitIdentity            *identity,
+                                                         GError                   **error)
+@@ -373,7 +374,7 @@ polkit_backend_authority_authentication_agent_response (PolkitBackendAuthority
+     }
+   else
+     {
+-      return klass->authentication_agent_response (authority, caller, cookie, identity, error);
++      return klass->authentication_agent_response (authority, caller, uid, cookie, identity, error);
+     }
+ }
+ 
+@@ -587,6 +588,11 @@ static const gchar *server_introspection_data =
+   "      <arg type='s' name='cookie' direction='in'/>"
+   "      <arg type='(sa{sv})' name='identity' direction='in'/>"
+   "    </method>"
++  "    <method name='AuthenticationAgentResponse2'>"
++  "      <arg type='u' name='uid' direction='in'/>"
++  "      <arg type='s' name='cookie' direction='in'/>"
++  "      <arg type='(sa{sv})' name='identity' direction='in'/>"
++  "    </method>"
+   "    <method name='EnumerateTemporaryAuthorizations'>"
+   "      <arg type='(sa{sv})' name='subject' direction='in'/>"
+   "      <arg type='a(ss(sa{sv})tt)' name='temporary_authorizations' direction='out'/>"
+@@ -1035,6 +1041,57 @@ server_handle_authentication_agent_response (Server                 *server,
+   error = NULL;
+   if (!polkit_backend_authority_authentication_agent_response (server->authority,
+                                                                caller,
++                                                               (uid_t)-1,
++                                                               cookie,
++                                                               identity,
++                                                               &error))
++    {
++      g_dbus_method_invocation_return_gerror (invocation, error);
++      g_error_free (error);
++      goto out;
++    }
++
++  g_dbus_method_invocation_return_value (invocation, g_variant_new ("()"));
++
++ out:
++  if (identity != NULL)
++    g_object_unref (identity);
++}
++
++static void
++server_handle_authentication_agent_response2 (Server                 *server,
++                                              GVariant               *parameters,
++                                              PolkitSubject          *caller,
++                                              GDBusMethodInvocation  *invocation)
++{
++  const gchar *cookie;
++  GVariant *identity_gvariant;
++  PolkitIdentity *identity;
++  GError *error;
++  guint32 uid;
++
++  identity = NULL;
++
++  g_variant_get (parameters,
++                 "(u&s@(sa{sv}))",
++                 &uid,
++                 &cookie,
++                 &identity_gvariant);
++
++  error = NULL;
++  identity = polkit_identity_new_for_gvariant (identity_gvariant, &error);
++  if (identity == NULL)
++    {
++      g_prefix_error (&error, "Error getting identity: ");
++      g_dbus_method_invocation_return_gerror (invocation, error);
++      g_error_free (error);
++      goto out;
++    }
++
++  error = NULL;
++  if (!polkit_backend_authority_authentication_agent_response (server->authority,
++                                                               caller,
++                                                               (uid_t)uid,
+                                                                cookie,
+                                                                identity,
+                                                                &error))
+@@ -1222,6 +1279,8 @@ server_handle_method_call (GDBusConnection        *connection,
+     server_handle_unregister_authentication_agent (server, parameters, caller, invocation);
+   else if (g_strcmp0 (method_name, "AuthenticationAgentResponse") == 0)
+     server_handle_authentication_agent_response (server, parameters, caller, invocation);
++  else if (g_strcmp0 (method_name, "AuthenticationAgentResponse2") == 0)
++    server_handle_authentication_agent_response2 (server, parameters, caller, invocation);
+   else if (g_strcmp0 (method_name, "EnumerateTemporaryAuthorizations") == 0)
+     server_handle_enumerate_temporary_authorizations (server, parameters, caller, invocation);
+   else if (g_strcmp0 (method_name, "RevokeTemporaryAuthorizations") == 0)
+diff --git a/src/polkitbackend/polkitbackendauthority.h b/src/polkitbackend/polkitbackendauthority.h
+index f9f7385..88df82e 100644
+--- a/src/polkitbackend/polkitbackendauthority.h
++++ b/src/polkitbackend/polkitbackendauthority.h
+@@ -147,6 +147,7 @@ struct _PolkitBackendAuthorityClass
+ 
+   gboolean (*authentication_agent_response) (PolkitBackendAuthority   *authority,
+                                              PolkitSubject            *caller,
++                                             uid_t                     uid,
+                                              const gchar              *cookie,
+                                              PolkitIdentity           *identity,
+                                              GError                  **error);
+@@ -249,6 +250,7 @@ gboolean polkit_backend_authority_unregister_authentication_agent (PolkitBackend
+ 
+ gboolean polkit_backend_authority_authentication_agent_response (PolkitBackendAuthority    *authority,
+                                                                  PolkitSubject             *caller,
++                                                                 uid_t                      uid,
+                                                                  const gchar               *cookie,
+                                                                  PolkitIdentity            *identity,
+                                                                  GError                   **error);
+diff --git a/src/polkitbackend/polkitbackendinteractiveauthority.c b/src/polkitbackend/polkitbackendinteractiveauthority.c
+index 15adc6a..96725f7 100644
+--- a/src/polkitbackend/polkitbackendinteractiveauthority.c
++++ b/src/polkitbackend/polkitbackendinteractiveauthority.c
+@@ -108,8 +108,9 @@ static AuthenticationAgent *get_authentication_agent_for_subject (PolkitBackendI
+                                                                   PolkitSubject *subject);
+ 
+ 
+-static AuthenticationSession *get_authentication_session_for_cookie (PolkitBackendInteractiveAuthority *authority,
+-                                                                     const gchar *cookie);
++static AuthenticationSession *get_authentication_session_for_uid_and_cookie (PolkitBackendInteractiveAuthority *authority,
++                                                                             uid_t                              uid,
++                                                                             const gchar                       *cookie);
+ 
+ static GList *get_authentication_sessions_initiated_by_system_bus_unique_name (PolkitBackendInteractiveAuthority *authority,
+                                                                                const gchar *system_bus_unique_name);
+@@ -169,6 +170,7 @@ static gboolean polkit_backend_interactive_authority_unregister_authentication_a
+ 
+ static gboolean polkit_backend_interactive_authority_authentication_agent_response (PolkitBackendAuthority   *authority,
+                                                                               PolkitSubject            *caller,
++                                                                              uid_t                     uid,
+                                                                               const gchar              *cookie,
+                                                                               PolkitIdentity           *identity,
+                                                                               GError                  **error);
+@@ -440,6 +442,7 @@ struct AuthenticationAgent
+ {
+   volatile gint ref_count;
+ 
++  uid_t creator_uid;
+   PolkitSubject *scope;
+   guint64 serial;
+ 
+@@ -1603,6 +1606,7 @@ authentication_agent_unref (AuthenticationAgent *agent)
+ static AuthenticationAgent *
+ authentication_agent_new (guint64      serial,
+                           PolkitSubject *scope,
++                          PolkitIdentity *creator,
+                           const gchar *unique_system_bus_name,
+                           const gchar *locale,
+                           const gchar *object_path,
+@@ -1611,6 +1615,10 @@ authentication_agent_new (guint64      serial,
+ {
+   AuthenticationAgent *agent;
+   GDBusProxy *proxy;
++  PolkitUnixUser *creator_user;
++
++  g_assert (POLKIT_IS_UNIX_USER (creator));
++  creator_user = POLKIT_UNIX_USER (creator);
+ 
+   if (!g_variant_is_object_path (object_path))
+     {
+@@ -1638,6 +1646,7 @@ authentication_agent_new (guint64      serial,
+   agent->ref_count = 1;
+   agent->serial = serial;
+   agent->scope = g_object_ref (scope);
++  agent->creator_uid = (uid_t)polkit_unix_user_get_uid (creator_user);
+   agent->object_path = g_strdup (object_path);
+   agent->unique_system_bus_name = g_strdup (unique_system_bus_name);
+   agent->locale = g_strdup (locale);
+@@ -1736,8 +1745,9 @@ get_authentication_agent_for_subject (PolkitBackendInteractiveAuthority *authori
+ }
+ 
+ static AuthenticationSession *
+-get_authentication_session_for_cookie (PolkitBackendInteractiveAuthority *authority,
+-                                       const gchar *cookie)
++get_authentication_session_for_uid_and_cookie (PolkitBackendInteractiveAuthority *authority,
++                                               uid_t                              uid,
++                                               const gchar                       *cookie)
+ {
+   PolkitBackendInteractiveAuthorityPrivate *priv;
+   GHashTableIter hash_iter;
+@@ -1755,6 +1765,23 @@ get_authentication_session_for_cookie (PolkitBackendInteractiveAuthority *author
+     {
+       GList *l;
+ 
++      /* We need to ensure that if somehow we have duplicate cookies
++       * due to wrapping, that the cookie used is matched to the user
++       * who called AuthenticationAgentResponse2.  See
++       * http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html
++       * 
++       * Except if the legacy AuthenticationAgentResponse is invoked,
++       * we don't know the uid and hence use -1.  Continue to support
++       * the old behavior for backwards compatibility, although everyone
++       * who is using our own setuid helper will automatically be updated
++       * to the new API.
++       */
++      if (uid != (uid_t)-1)
++        {
++          if (agent->creator_uid != uid)
++            continue;
++        }
++
+       for (l = agent->active_sessions; l != NULL; l = l->next)
+         {
+           AuthenticationSession *session = l->data;
+@@ -2544,6 +2571,7 @@ polkit_backend_interactive_authority_register_authentication_agent (PolkitBacken
+   priv->agent_serial++;
+   agent = authentication_agent_new (priv->agent_serial,
+                                     subject,
++                                    user_of_caller,
+                                     polkit_system_bus_name_get_name (POLKIT_SYSTEM_BUS_NAME (caller)),
+                                     locale,
+                                     object_path,
+@@ -2757,6 +2785,7 @@ polkit_backend_interactive_authority_unregister_authentication_agent (PolkitBack
+ static gboolean
+ polkit_backend_interactive_authority_authentication_agent_response (PolkitBackendAuthority   *authority,
+                                                               PolkitSubject            *caller,
++                                                              uid_t                     uid,
+                                                               const gchar              *cookie,
+                                                               PolkitIdentity           *identity,
+                                                               GError                  **error)
+@@ -2799,7 +2828,7 @@ polkit_backend_interactive_authority_authentication_agent_response (PolkitBacken
+     }
+ 
+   /* find the authentication session */
+-  session = get_authentication_session_for_cookie (interactive_authority, cookie);
++  session = get_authentication_session_for_uid_and_cookie (interactive_authority, uid, cookie);
+   if (session == NULL)
+     {
+       g_set_error (error,
+-- 
+cgit v0.10.2
+
+--- ./configure.ac.orig
++++ ./configure.ac
+@@ -122,7 +122,7 @@
+   changequote([,])dnl
+ fi
+ 
+-PKG_CHECK_MODULES(GLIB, [gio-2.0 >= 2.28.0])
++PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 gio-2.0 >= 2.30.0])
+ AC_SUBST(GLIB_CFLAGS)
+ AC_SUBST(GLIB_LIBS)
+