1PKCHECK(1) pkcheck PKCHECK(1)
2
6 pkcheck - Check whether a process is authorized
7
9 pkcheck [--version] [--help]
10 pkcheck --action-id action {--process { pid | pid,pid-start-time } |
12 --system-bus-name busname} [--allow-user-interaction]
13 [--enable-internal-agent] [--detail key value...]
14
16 pkcheck is used to check whether a process, specified by either
17 --process or --system-bus-name, is authorized for action. The --detail
18 option can be used zero or more times to pass details about action. If
19 --allow-user-interaction is passed, pkcheck blocks while waiting for
20 authentication.
21 This command is a simple wrapper around the PolicyKit D-Bus interface;
23 see the D-Bus interface documentation for details.
24
26 If the specified process is authorized, pkcheck exits with a return
27 value of 0. If the authorization result contains any details, these are
28 printed on standard output as key/value pairs using environment style
29 reporting, e.g. first the key followed by a an equal sign, then the
30 value followed by a newline.
31 KEY1=VALUE1
33 KEY2=VALUE2
34 KEY3=VALUE3
35 ...
36 Octects that are not in [a-zA-Z0-9_] are escaped using octal codes
38 prefixed with \. For example, the UTF-8 string føl,你好 will be printed
39 as f\303\270l\54\344\275\240\345\245\275.
40 If the specificied process is not authorized, pkcheck exits with a
42 return value of 1 and a diagnostic message is printed on standard
43 error. Details are printed on standard output.
44 If the specificied process is not authorized because no suitable
46 authentication agent is available or if the --allow-user-interaction
47 wasn't passed, pkcheck exits with a return value of 2 and a diagnostic
48 message is printed on standard error. Details are printed on standard
49 output.
50 If an error occured while checking for authorization, pkcheck exits
52 with a return value of 127 with a diagnostic message printed on
53 standard error.
54 If one or more of the options passed are malformed, pkcheck exits with
56 a return value of 126. If stdin is a tty, then this manual page is also
57 shown.
58
60 Since process identifiers can be recycled, the caller should always use
61 pid,pid-start-time to specify the process to check for authorization
62 when using the --process option. The value of pid-start-time can be
63 determined by consulting e.g. the proc(5) file system depending on the
64 operating system. If only pid is passed to the --process option, then
65 pkcheck will look up the start time itself but note that this may be
66 racy.
67
69 pkcheck, like any other PolicyKit application, will use the
70 authentication agent registered for the process in question. However,
71 if no authentication agent is available, then pkcheck can register its
72 own textual authentication agent if the option --enable-internal-agent
73 is passed.
74
76 Written by David Zeuthen davidz@redhat.com with a lot of help from many
77 others.
78
80 Please send bug reports to either the distribution or the polkit-devel
81 mailing list, see the link
82 http://lists.freedesktop.org/mailman/listinfo/polkit-devel on how to
83 subscribe.
84
86 polkit(8), pkaction(1), pkexec(1)
87polkit May 2009 PKCHECK(1)