5 ms·
You mean like Polkit (the software formerly known as Policy Kit): https://en.wikipedia.org/wiki/Polkit https://en.wikipedia.org/wiki/Polkit
by SEJeff 10y ago
You mean like Polkit (the software formerly known as Policy Kit):
https://en.wikipedia.org/wiki/Polkit https://en.wikipedia.org/wiki/Polkit
- geofft 10y agopkexec is still SUID, though. If it asked polkitd to actually execute the process, then it would work. (Something like systemd-run, which backed by polkit, is closer, except it's not set up for interactive commands. You need to proxy I/O as well as the terminal state and terminal-generated signals - and SSH already does all of that.) Polkit, incidentally, is another good reason to avoid all SUID binaries on your system; see CVE-2011-1485 and then CVE-2013-4288 and friends, which are all race conditions involving tricking polkit into thinking that you're root by execing a SUID binary right before it checks who you are. http://seclists.org/oss-sec/2013/q3/624 http://seclists.org/oss-sec/2013/q3/624 This is indisputably a security bug in polkit, but the fact that it's so non-obvious how to do the right thing (and whether the right thing is even possible) is a good reason not to tempt fate by having SUID binaries around. It's not going to be the only system that's vulnerable to this.