git.lucas.co / cce-display-manager
login greeter
git clone https://git.lucas.co/cce-display-manager.git

commitbb9aed1f60bdafaa601e18d9b6837aaf875770be
parenta8a4d00cf1
authorLucas Galante <[email protected]>
date2026-08-20 14:42
Stop force-restoring SUID on polkit-agent-helper-1

The daemon re-added the SUID bit to polkit-agent-helper-1 at every boot.
The helper ships SUID from the polkit package (pacman -Qkk reports no
deviation), so the block was a fix for some long-gone broken state — and
as written it silently overrode any deliberate permission change to a
setuid-root binary, from a root daemon, on every start.

Co-Authored-By: Claude Fable 5 <[email protected]>

 src/main.rs | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index f2a9ae9..47eb509 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1414,28 +1414,6 @@ fn run_daemon() {
         std::fs::set_permissions(&runtime_dir, std::fs::Permissions::from_mode(0o700))
             .expect("failed to set runtime dir permissions");
     }
-    // Ensure polkit-agent-helper-1 has SUID root permissions so cce-authenticator can authenticate sessions
-    let helper_paths = [
-        "/usr/lib/polkit-1/polkit-agent-helper-1",
-        "/usr/lib/policykit-1/polkit-agent-helper-1",
-    ];
-    for path in &helper_paths {
-        if std::path::Path::new(path).exists() {
-            use std::os::unix::fs::PermissionsExt;
-            if let Ok(metadata) = std::fs::metadata(path) {
-                let mut perms = metadata.permissions();
-                let mode = perms.mode();
-                if (mode & 0o4000) == 0 {
-                    log::info!("Restoring SUID root permissions to {} (current mode: {:o})", path, mode);
-                    perms.set_mode(mode | 0o4000 | 0o0111);
-                    if let Err(e) = std::fs::set_permissions(path, perms) {
-                        log::error!("Failed to set permissions on {}: {}", path, e);
-                    }
-                }
-            }
-        }
-    }
-
     // Set when the compositor requested a restart (`ccectl restart-compositor`
     // wrote the flag file and exited): the next loop iteration relaunches the
     // same session directly — no greeter, autologin PAM service.