fix(linglong): reuse the cached polkit authorization across package manager calls

[Metastarx]

Summary

Each ll-cli install, ll-cli update or ll-cli uninstall starts a brand new process, and the daemon authorized it with a polkit system-bus-name subject, which polkit resolves to that very process. The install/update/uninstall policies use auth_admin_keep, but the retained authorization is keyed on the subject, so the freshly started process never matched it and the authentication dialog appeared for every single command. The daemon now asks the bus daemon for the caller's uid and resolves its login session, remembers a successful check for that user and session for the same five minutes polkit would have kept it, and skips the polkit round trip inside that window.

#1904

Changes

docs/pages/en/guide/tips-and-faq/faq.md            |   4 +
 docs/pages/guide/tips-and-faq/faq.md               |   4 +
 libs/linglong/CMakeLists.txt                       |   2 +
 .../linglong/package_manager/polkit_authority.cpp  | 113 ++++++++++++++++++++-
 .../linglong/package_manager/polkit_authority.h    |  19 ++++
 libs/linglong/tests/ll-tests/CMakeLists.txt        |  11 ++
 6 files changed, 151 insertions(+), 2 deletions(-)
libs/linglong/src/linglong/package_manager/polkit_authorization_cache.cpp | 127 +++++++++
libs/linglong/src/linglong/package_manager/polkit_authorization_cache.h | 106 +++++++++
libs/linglong/tests/ll-tests/src/linglong/package_manager/polkit_authorization_cache_test.cpp | 264 +++++++++

Verification

ctest --test-dir build-release --output-on-failure — passed (100% tests passed, 0 tests failed out of 744)

Checklist

• I ran the verification described above
• The change is minimal and includes no unrelated files
• The repository contribution guidelines were followed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[deepin-ci-robot]

Hi @Metastarx. Thanks for your PR.

I'm waiting for a OpenAtom-Linyaps member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.