How to create files with root privileges using C++/Qt and PolKit-Qt-1

Question

I apologize for the somewhat lengthy discussion. Also, this is my first submission to StackOverflow, so please forgive my unfamiliarity.

I usually use C++/Qt Widget or C++/QML with Linux. This time, I need to create or write files with root privileges, and I am using the following URL (PolKit-Qt-1) to create and test my own C++/Qt Widget software.

https://api.kde.org/polkit-qt-1/html/

I am using polkit-qt-gui-1 to create software (C++/Qt) to create and write files with root privileges when a button is pressed.

However, a permission error occurs because the file cannot be created or written as root, but has been created or written as the executing user.

Perhaps there is a mistake in some configuration file, or there is a missing or incorrect part of the source code.

I want to create or write a file with root privileges when a button is pressed. How do I create or write files with root privileges using C++/Qt and PolKit-Qt-1?

Thank you for your cooperation.

My own source code is shown below. The action file for polkit-1 is also shown below.

main.cpp:

#include "mainwindow.h"
#include <QApplication>
    
int main(int argc, char *argv[])
{
   QApplication a(argc, argv);
   MainWindow w;
   w.show();
   return a.exec();
}

mainwindow.cpp:

#include "mainwindow.h"
#include "ui_mainwindow.h"

MainWindow::MainWindow(QWidget *parent) : QMainWindow(parent), ui(new Ui::MainWindow)
{
   ui->setupUi(this);

   PolkitQt1::Gui::ActionButton *bt = new PolkitQt1::Gui::ActionButton(ui->pushButton, "org.qt.policykit.examples.write", this);
   bt->setText("Run with administrative privileges");
   bt->setVisible(true, PolkitQt1::Gui::Action::No | PolkitQt1::Gui::Action::Auth | PolkitQt1::Gui::Action::Yes);
   bt->setEnabled(true, PolkitQt1::Gui::Action::No | PolkitQt1::Gui::Action::Auth | PolkitQt1::Gui::Action::Yes);
   connect(bt, SIGNAL(triggered(bool)), this, SLOT(activateAction()));
   connect(bt, SIGNAL(clicked(QAbstractButton*,bool)), bt, SLOT(activate()));
   connect(bt, SIGNAL(authorized()), this, SLOT(onBtnClicked()));
}

MainWindow::~MainWindow()
{
   delete ui;
}

void MainWindow::activateAction()
{
   PolkitQt1::Gui::Action *action = qobject_cast<PolkitQt1::Gui::Action *>(sender());
   action->activate();
}

void MainWindow::onBtnClicked()
{
   PolkitQt1::Gui::Action *action = qobject_cast<PolkitQt1::Gui::Action *>(sender());

   qDebug() << "pretending to be the mechanism for action:" << action->actionId();

   PolkitQt1::UnixProcessSubject subject(static_cast<uint>(QCoreApplication::applicationPid()));
   PolkitQt1::Authority::Result result = PolkitQt1::Authority::instance()->checkAuthorizationSync(action->actionId(), subject,  PolkitQt1::Authority::AllowUserInteraction);
   if (result == PolkitQt1::Authority::Yes)
   {
      // Write /opt/sample.txt file with root privilege.
      writeTextFile("/opt/sample.txt", "foo bar");
   }
   else
   {
      return;
   }

   return;
}

void MainWindow::writeTextFile(QString FileName, QString strOutputData)
{
   QFileInfo FileInfo(FileName);

   QFile File(FileName);
   if(!File.open(QIODevice::WriteOnly))
   {
      QString strErrMsg = "File(" + FileInfo.fileName() + ") Open Error: " + File.errorString();
      qDebug() << strErrMsg;
      return;
   }

   QTextStream OutStream(&File);
   OutStream << strOutputData;

   File.close();

   return;
}

mainwindow.h:

#define MAINWINDOW_H

#include <QMainWindow>
#include <QtWidgets>
#include <QDBusContext>
#include <QDBusMessage>
#include <QDBusConnection>
#include <polkit-qt5-1/polkitqt1-gui-action.h>
#include <polkit-qt5-1/polkitqt1-gui-actionbutton.h>
#include <polkit-qt5-1/polkitqt1-gui-actionbuttons.h>
#include <polkit-qt5-1/polkitqt1-authority.h>
#include <dbus/dbus.h>
#include <QDebug>

QT_BEGIN_NAMESPACE
namespace Ui { class MainWindow; }
QT_END_NAMESPACE

class MainWindow : public QMainWindow, protected QDBusContext
{
   Q_OBJECT

   private:
      void writeTextFile(QString FileName, QString strOutputData);

   public:
      MainWindow(QWidget *parent = nullptr);
      ~MainWindow();

   private:
      Ui::MainWindow *ui;

   private Q_SLOTS:
      void activateAction();
      void onBtnClicked();
};
#endif // MAINWINDOW_H

/usr/share/polkit-1/actions/org.qt.policykit.examples.policy:

<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE policyconfig PUBLIC '-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN' 'http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd'>
<policyconfig>
  <vendor>KDE</vendor>
  <vendor_url>http://www.kde.org</vendor_url>

  <action id="org.qt.policykit.examples.write">
    <description>Write</description>
    <message>Prevents PolKit-Qt-1 example from writing</message>
    <defaults>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

</policyconfig>

Answer 1

Sorry for the long wait.
After much trial and error, the following source code allows the program to run with administrative privilege (root) only when a specific button is pressed.

Please forgive the somewhat lengthy post.

Main executable

Main executable is GUI software that sends D-Bus messages by pressing a button.

main.cpp:

main.cpp has the same source code as above.

mainwindow.cpp:

#include "mainwindow.h"
#include "ui_mainwindow.h"


MainWindow::MainWindow(QWidget *parent) : QMainWindow(parent), ui(new Ui::MainWindow)
{
    ui->setupUi(this);
}

MainWindow::~MainWindow()
{
    delete ui;
}


void MainWindow::onAuthBtnClicked()
{
    QDBusConnection bus = QDBusConnection::systemBus();
    if (!bus.isConnected())
    {
        QMessageBox(QMessageBox::Critical, tr("D-Bus error"), tr("Cannot connect to the D-Bus session bus."), QMessageBox::Close, this).exec();
    }

    // this is our Special Action that after allowed will call the helper
    QDBusMessage message;
    message = QDBusMessage::createMethodCall("org.qt.policykit.examples", "/", "org.qt.policykit.examples", QLatin1String("write"));

    // If a method in a helper file has arguments, enter the arguments.
    //QList<QVariant> ArgsToHelper;
    //ArgsToHelper << QVariant::fromValue("foo") << QVariant::fromValue("bar");
    //message.setArguments(ArgsToHelper);

    // Send a message to DBus. (Execute the helper file.)
    QDBusMessage reply = QDBusConnection::systemBus().call(message);

    // Receive the return value (including arguments) from the helper file.
    // The methods in the helper file have two arguments, so check them.
    if (reply.type() == QDBusMessage::ReplyMessage && reply.arguments().size() == 2)
    {
        // the reply can be anything, here we receive a bool
        if (reply.arguments().at(0).toInt() == 0)
        {   // If the helper file method completes successfully after successful authentication
            QMessageBox(QMessageBox::NoIcon, tr("Successed"), tr("The file was written successfully."), QMessageBox::Close, this).exec();
        }
        else if (reply.arguments().at(0).toInt() == -1)
        {   // If the helper file method fails after successful authentication
            QString strErrMsg = reply.arguments().at(1).toString();
            QMessageBox(QMessageBox::Critical, tr("Failed"), tr("Failed to write file.\n") + strErrMsg, QMessageBox::Close, this).exec();
        }
        else
        {   // If the authentication is canceled
            QMessageBox(QMessageBox::NoIcon, tr("Cancelled"), tr("Writing of the file was canceled."), QMessageBox::Close, this).exec();
        }
    }
    else if (reply.type() == QDBusMessage::MethodCallMessage)
    {
        QMessageBox(QMessageBox::Warning, tr("Time out"), tr("Message did not receive a reply (timeout by message bus)."), QMessageBox::Close, this).exec();
    }
    else if (reply.type() == QDBusMessage::ErrorMessage)
    {
        QMessageBox(QMessageBox::Critical, tr("D-Bus error"), tr("Could not send message to D-Bus."), QMessageBox::Close, this).exec();
    }

    return;
}

mainwindow.h:

#ifndef MAINWINDOW_H
#define MAINWINDOW_H

#include <QMainWindow>
#include <QtWidgets>
#include <QtGui>
#include <QDBusContext>
#include <QDBusMessage>
#include <QDBusConnection>

QT_BEGIN_NAMESPACE
namespace Ui { class MainWindow; }
QT_END_NAMESPACE

class MainWindow : public QMainWindow
{
    Q_OBJECT

public:     // Public Functions
    MainWindow(QWidget *parent = nullptr);
    ~MainWindow();

private:    // Private Variables
    Ui::MainWindow *ui;

private Q_SLOTS:
    void onAuthBtnClicked();
};
#endif // MAINWINDOW_H

Helper executable

Helper executable is software that receives messages from D-Bus and creates files with root privileges.

main.cpp:

#include <QCoreApplication>
#include "SampleHelper.h"

int main(int argc, char *argv[])
{
    QCoreApplication a(argc, argv);
    SampleHelper sample(argc, argv);

    return a.exec();
}

SampleHelper.cpp:

#include <QTimer>
#include <QFile>
#include <QTextStream>
#include <QDateTime>
#include "SampleHelper.h"
#include "SampleAdaptor.h"

#define MINUTE 30000

SampleHelper::SampleHelper(int &argc, char **argv) : QCoreApplication(argc, argv)
{
    (void) new SampleAdaptor(this);

    // Register the DBus service
    if (!QDBusConnection::systemBus().registerService("org.qt.policykit.examples"))
    {
        QTextStream ErrStream(stderr);
        ErrStream << QDBusConnection::systemBus().lastError().message();

        QTimer::singleShot(0, this, SLOT(quit()));
        return;
    }

    if (!QDBusConnection::systemBus().registerObject("/", this))
    {
        QTextStream ErrStream(stderr);
        ErrStream << "unable to register service interface to dbus";

        QTimer::singleShot(0, this, SLOT(quit()));
        return;
    }
    // Normally you will set a timeout so your application can
    // free some resources of the poor client machine ;)
    QTimer::singleShot(MINUTE, this, SLOT(quit()));
}

SampleHelper::~SampleHelper()
{
}

int SampleHelper::write(QString &strErrMsg)
{
    // message().service() is the service name of the caller
    // We can check if the caller is authorized to the following action
    PolkitQt1::Authority::Result result;
    PolkitQt1::SystemBusNameSubject subject(message().service());

    result = PolkitQt1::Authority::instance()->checkAuthorizationSync("org.qt.policykit.examples.write", subject , PolkitQt1::Authority::AllowUserInteraction);
    if (result == PolkitQt1::Authority::Yes)
    {   // Caller is authorized so we can perform the action
        return writeValue(strErrMsg);
    }
    else
    {   // Caller is not authorized so the action can't be performed
        return 1;
    }
}

int SampleHelper::writeValue(QString &strErrMsg)
{
    // This action must be authorized first. It will set the implicit
    // authorization for the Shout action by editing the .policy file
    try
    {
        QFileInfo FileInfo("/opt/sample.txt");

        QFile File("/opt/sample.txt");
        if(!File.open(QIODevice::WriteOnly))
        {
           strErrMsg = "File(" + FileInfo.fileName() + ") Open Error: " + File.errorString();
           return -1;
        }

        QDateTime current_date_time =QDateTime::currentDateTime();
        QString current_date = current_date_time.toString("yyyy.MM.dd hh:mm:ss.zzz ddd");
        QTextStream OutStream(&File);
        OutStream << current_date;

        File.close();
    }
    catch (QException &err)
    {
        strErrMsg = err.what();
    }

    return 0;
}

SampleHelper.h:

#ifndef SAMPLE_HELPER_H
#define SAMPLE_HELPER_H

#include <QDBusConnection>
#include <QDBusContext>
#include <QDBusMessage>
#include <QCoreApplication>
#include <polkit-qt5-1/polkitqt1-authority.h>

class SampleHelper : public QCoreApplication, protected QDBusContext
{
    Q_OBJECT
    Q_CLASSINFO("D-Bus Interface", "org.qt.policykit.examples")

private:
    int writeValue(QString &strErrMsg);

public:
    SampleHelper(int &argc, char **argv);
    ~SampleHelper() override;

public Q_SLOTS:
    int write(QString &strErrMsg);
};

#endif

Execute the qdbusxml2cpp command (using the D-Bus interface file at this time) to generate the adapter source code file and header files for the helper.

qdbusxml2cpp -a SampleAdaptor -c SampleAdaptor -i SampleHelper.h -l SampleHelper org.qt.policykit.examples.xml

In this example, SampleAdaptor.cpp and SampleAdaptor.h are generated.
Add this file to the helper executable's project.

If this is done automatically :
Qt .pro file, the following commands were written.

system(qdbusxml2cpp -a SampleAdaptor -c SampleAdaptor -i SampleHelper.h -l SampleHelper org.qt.policykit.examples.xml)

CMake file, the following commands were written.

qt_add_dbus_adaptor(
    SampleAdaptor_SRC
    org.qt.policykit.examples.xml
    SampleHelper.h
    SampleHelper
    SampleAdaptor
    SampleAdaptor
)

Create Polkit policy file

/usr/share/polkit-1/actions/org.qt.policykit.examples.policy:

<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE policyconfig PUBLIC '-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN' 'http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd'>
<policyconfig>
  <vendor>presire</vendor>
  <vendor_url></vendor_url>

  <action id="org.qt.policykit.examples.write">
    <description>Write</description>
    <message>Prevents PolKit-Qt-1 example from writing</message>
    <defaults>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
  </action>
</policyconfig>

Create D-Bus configuration files

/usr/share/dbus-1/interfaces/org.qt.policykit.examples.xml:

<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN" "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
<node>
   <interface name="org.qt.policykit.examples">
       <method name="write" >
           <!-- OUT: whether the user gained the authorization -->
           <arg direction="out" type="i" name="code" />
           <arg direction="out" type="s" name="msg" />
       </method>
   </interface>
</node>

/usr/share/dbus-1/system-services/org.qt.policykit.examples.service:

[D-BUS Service]
Name=org.qt.policykit.examples
Exec=/<Path>/<to>/<Helper executable file>
User=root

/etc/dbus-1/system-local.conf:
or
/etc/dbus-1/system.d/org.qt.policykit.examples.conf:
or
/usr/share/dbus-1/system.d/org.qt.policykit.examples.conf:

<!DOCTYPE busconfig PUBLIC
 "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
<busconfig>

  <!-- This configuration file specifies the required security policies
       for the PolicyKit examples to work. -->

  <!-- Only user root can own the PackageKit service -->
  <policy user="root">
    <allow own="org.qt.policykit.examples"/>
  </policy>

  <!-- Allow anyone to call into the service - we'll reject callers using PolicyKit -->
  <policy context="default">
    <allow send_destination="org.qt.policykit.examples"/>
  </policy>

</busconfig>