PolicyKit Model

Mechanims vs. Policy
Concepts
Theory of Operation

Mechanims vs. Policy

PolicyKit assumes a model where a program is split into two parts. One part, the Mechanism, runs privileged (with no user interface elements) and the other part, the policy agent, runs unprivileged. The two parts of the program are in different processes and communicate through some IPC mechanism such as pipes or the system message bus (D-Bus). In some instances the Mechanism can be considered part of the core OS and the policy agent part of the desktop stack.

A Mechanism should never trust any application that tries to use; it needs to carefully verify all data and requests passed to it from the application. This is the model employed by HAL and NetworkManager:

(TODO: diagram showing g-p-m, g-v-m, nm-applet, HAL and NM)

This model also applies to other security sensitive applications:

(TODO: diagram showing 1) gnome-screensaver / PAM-stack + /sbin/unix_chkpwd; and 2) gdm + gdm-greeter; 3) mount(8); 4) other setuid examples)

In general, such an architecture is thought of as secure as long as the Mechanism (and it's dependent libraries) have been verified to be secure.