Copy pasta from https://bugzilla.suse.com/show_bug.cgi?id=1217178 - [x] this `s_watchers` hashmap is no longer used: https://invent.kde.org/frameworks/kauth/-/blob/master/src/executejob.cpp?ref_type=heads#L43 - [x] the function DBusHelperProxy::callerUid() and related functions seem unused: https://invent.kde.org/frameworks/kauth/-/blob/master/src/backends/dbus/DBusHelperProxy.cpp?ref_type=heads#L352 it's still called in HelperProxy::callerUid(), but this in turn isn't called by anybody. Except it would be called externally, but why should that happen? - [x] in DBusHelperProxy::performAction() this hack here: https://invent.kde.org/frameworks/kauth/-/blob/master/src/backends/dbus/DBusHelperProxy.cpp?ref_type=heads#L236 is really awful. The process is basically multithreaded and the hack isn't thread safe, influences the Qt framework for the complete process. Wouldn't there be a better way to prevent the sketched problem? The logic was introduced in commit fc70fb01. - [ ] This "ExtraCallerIDVerificationMethod" is really strange: https://invent.kde.org/frameworks/kauth/-/blob/master/src/backends/dbus/DBusHelperProxy.cpp?ref_type=heads#L200 The `callerID` is an untrusted value supplied by the unprivileged client, when using Polkit. I can only imagine this very strange design is due to the need to also cover the MAC backend with the same interface. It makes absolutely no sense to pass-on this callerID when using Polkit/D-Bus on Linux, it is just a confusing burden. - [x] It is not great that we pass file paths, we should be able to pass file ids so (see discussion below). Since this is a KDE6 major release it might be a good time to address some of the problematic design aspects mentioned in c) and d), even if it breaks interfaces.