Stop using pkexec for grub2-set-bootflag

Stop using pkexec for grub2-set-bootflag, it does not work under gdm instead
make it suid root (it was written with this in mind)

Signed-off-by: Peter Jones <pjones@redhat.com>

0247-docs-Stop-using-polkit-pkexec-for-grub-boot-success..patch

@@ -0,0 +1,69 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 14 Sep 2018 16:39:40 +0200
+Subject: [PATCH] docs: Stop using polkit / pkexec for grub-boot-success.timer
+ / service
+
+We also want to call grub2-set-bootflag under gdm and pkexec does not
+work under gdm because the gdm user has /sbin/nologin as shell.
+
+So instead we are going to install grub2-set-bootflag as suid root,
+grub2-set-bootflag was written with this usage in mind, so is safe
+to be made suid root.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ docs/grub-boot-success.service |  2 +-
+ docs/grub-boot-success.timer   |  1 -
+ docs/org.gnu.grub.policy       | 20 --------------------
+ 3 files changed, 1 insertion(+), 22 deletions(-)
+ delete mode 100644 docs/org.gnu.grub.policy
+
+diff --git a/docs/grub-boot-success.service b/docs/grub-boot-success.service
+index c8c91c34d49..80e79584c91 100644
+--- a/docs/grub-boot-success.service
++++ b/docs/grub-boot-success.service
+@@ -3,4 +3,4 @@ Description=Mark boot as successful
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/bin/pkexec /usr/sbin/grub2-set-bootflag boot_success
++ExecStart=/usr/sbin/grub2-set-bootflag boot_success
+diff --git a/docs/grub-boot-success.timer b/docs/grub-boot-success.timer
+index 67bd829b795..5d8fcba21aa 100644
+--- a/docs/grub-boot-success.timer
++++ b/docs/grub-boot-success.timer
+@@ -1,7 +1,6 @@
+ [Unit]
+ Description=Mark boot as successful after the user session has run 2 minutes
+ ConditionUser=!@system
+-ConditionPathExists=/usr/bin/pkexec
+ 
+ [Timer]
+ OnActiveSec=2min
+diff --git a/docs/org.gnu.grub.policy b/docs/org.gnu.grub.policy
+deleted file mode 100644
+index 18391efc8e7..00000000000
+--- a/docs/org.gnu.grub.policy
++++ /dev/null
+@@ -1,20 +0,0 @@
+-<?xml version="1.0" encoding="UTF-8"?>
+-<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
+-<policyconfig>
+-  <vendor>GNU GRUB</vendor>
+-  <vendor_url>https://www.gnu.org/software/grub/</vendor_url>
+-  <action id="org.gnu.grub.set-bootflag">
+-    <!-- SECURITY:
+-          - A normal active user on the local machine does not need permission
+-            to set bootflags to show the menu / mark current boot successful.
+-     -->
+-    <description>Set GRUB bootflags</description>
+-    <message>Authentication is required to modify the bootloaders bootflags</message>
+-    <defaults>
+-      <allow_any>no</allow_any>
+-      <allow_inactive>no</allow_inactive>
+-      <allow_active>yes</allow_active>
+-    </defaults>
+-    <annotate key="org.freedesktop.policykit.exec.path">/usr/sbin/grub2-set-bootflag</annotate>
+-  </action>
+-</policyconfig>

grub.patches

@@ -244,3 +244,4 @@ Patch0243: 0243-x86-efi-Use-bounce-buffers-for-reading-to-addresses-.patch
 Patch0244: 0244-x86-efi-Re-arrange-grub_cmd_linux-a-little-bit.patch
 Patch0245: 0245-x86-efi-Make-our-own-allocator-for-kernel-stuff.patch
 Patch0246: 0246-x86-efi-Allow-initrd-params-cmdline-allocations-abov.patch
+Patch0247: 0247-docs-Stop-using-polkit-pkexec-for-grub-boot-success..patch

grub2.spec

@@ -7,7 +7,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.02
-Release:	58%{?dist}
+Release:	59%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 Group:		System Environment/Base
 License:	GPLv3+
@@ -223,9 +223,6 @@ install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE9}
 install -d -m 0755 %{buildroot}%{_sysconfdir}/kernel/install.d/
 install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/20-grubby.install
 install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/90-loaderentry.install
-# Install grub2-set-bootflag polkit policy
-install -D -m 0755 -t %{buildroot}%{_datadir}/polkit-1/actions \
-	docs/org.gnu.grub.policy
 # Install systemd user service to set the boot_success flag
 install -D -m 0755 -t %{buildroot}%{_userunitdir} \
 	docs/grub-boot-success.{timer,service}
@@ -366,7 +363,7 @@ fi
 %files tools-minimal
 %{_sysconfdir}/prelink.conf.d/grub2.conf
 %{_sbindir}/%{name}-get-kernel-settings
-%{_sbindir}/%{name}-set-bootflag
+%attr(4755, root, root) %{_sbindir}/%{name}-set-bootflag
 %{_sbindir}/%{name}-set-default
 %{_sbindir}/%{name}-set*password
 %{_bindir}/%{name}-editenv
@@ -390,7 +387,6 @@ fi
 %attr(0644,root,root) %ghost %config(noreplace) %{_sysconfdir}/default/grub
 %config %{_sysconfdir}/grub.d/??_*
 %{_sysconfdir}/grub.d/README
-%{_datadir}/polkit-1/actions/org.gnu.grub.policy
 %{_userunitdir}/grub-boot-success.timer
 %{_userunitdir}/grub-boot-success.service
 %{_userunitdir}/timers.target.wants
@@ -498,6 +494,10 @@ fi
 %endif
 
 %changelog
+* Tue Sep 25 2018 Hans de Goede <hdegoede@redhat.com> - 2.02-59
+- Stop using pkexec for grub2-set-bootflag, it does not work under gdm
+  instead make it suid root (it was written with this in mind)
+
 * Tue Sep 25 2018 Peter Jones <pjones@redhat.com>
 - Use bounce buffers for addresses above 4GB
 - Allow initramfs, cmdline, and params >4GB, but not kernel