Controlling Authentication Mechanisms

By default, a GDBusServer or server-side GDBusConnection will allow any authentication mechanism to be used. If you only want to allow D-Bus connections with the EXTERNAL mechanism, which makes use of credentials passing and is the recommended mechanism for modern Unix platforms such as Linux and the BSD family, you would use a signal handler like this:

1
2
3
4
5
6
7
8
9
10
11
12

static gboolean
on_allow_mechanism (GDBusAuthObserver *observer,
                    const gchar       *mechanism,
                    gpointer           user_data)
{
  if (g_strcmp0 (mechanism, "EXTERNAL") == 0)
    {
      return TRUE;
    }

  return FALSE;
}

Controlling Authorization

By default, a GDBusServer or server-side GDBusConnection will accept connections from any successfully authenticated user (but not from anonymous connections using the ANONYMOUS mechanism). If you only want to allow D-Bus connections from processes owned by the same uid as the server, since GLib 2.68, you should use the G_DBUS_SERVER_FLAGS_AUTHENTICATION_REQUIRE_SAME_USER flag. It’s equivalent to the following signal handler:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

static gboolean
on_authorize_authenticated_peer (GDBusAuthObserver *observer,
                                 GIOStream         *stream,
                                 GCredentials      *credentials,
                                 gpointer           user_data)
{
  gboolean authorized;

  authorized = FALSE;
  if (credentials != NULL)
    {
      GCredentials *own_credentials;
      own_credentials = g_credentials_new ();
      if (g_credentials_is_same_user (credentials, own_credentials, NULL))
        authorized = TRUE;
      g_object_unref (own_credentials);
    }

  return authorized;
}

g_dbus_auth_observer_new ()

GDBusAuthObserver *
g_dbus_auth_observer_new (void);

Creates a new GDBusAuthObserver object.

Since: 2.26

g_dbus_auth_observer_authorize_authenticated_peer ()

gboolean
g_dbus_auth_observer_authorize_authenticated_peer
                               (GDBusAuthObserver *observer,
                                GIOStream *stream,
                                GCredentials *credentials);

Emits the “authorize-authenticated-peer” signal on observer .

Since: 2.26

g_dbus_auth_observer_allow_mechanism ()

gboolean
g_dbus_auth_observer_allow_mechanism (GDBusAuthObserver *observer,
                                      const gchar *mechanism);

Emits the “allow-mechanism” signal on observer .

Since: 2.34

GDBusAuthObserver

typedef struct _GDBusAuthObserver GDBusAuthObserver;

The GDBusAuthObserver structure contains only private data and should only be accessed using the provided API.

Since: 2.26

The “allow-mechanism” signal

gboolean
user_function (GDBusAuthObserver *observer,
               char              *mechanism,
               gpointer           user_data)

Emitted to check if mechanism is allowed to be used.

Flags: Run Last

Since: 2.34

The “authorize-authenticated-peer” signal

gboolean
user_function (GDBusAuthObserver *observer,
               GIOStream         *stream,
               GCredentials      *credentials,
               gpointer           user_data)

Emitted to check if a peer that is successfully authenticated is authorized.

Flags: Run Last

Since: 2.26