4 ms·
Probably, It is used in things like NetworkManager. Which is used by almost all desktop environment. In these desktop environments. Polkit is used to gating an
by mmis1000 5y ago
Probably, It is used in things like NetworkManager. Which is used by almost all desktop environment.
In these desktop environments. Polkit is used to gating any remote process from accessing network state related functions (or anything that are not supposed to do remotely).
For example, you can use `nmcli` on the desktop or system termional(Alt+f1~f7) to disconnect the network or change to use other pppoe even you are not currently root(not using sudo to elevate the permission).
But if you try to call `nmcli` through ssh? No, No , No, Polkit will gate you from doing so.
- trasz 5y agoSo why do it like this instead of simply having PAM add a group (or not) depending on ash service one is logging into, and making authorization decision based on that group?
- mmis1000 5y agoI don't think you can have different group per session?
- trasz 5y agoSure you can, see pam_group.
- yrro 5y agoGroups are not granular enough. `pkaction` lists 315 different actions on the system where I just ran it. You'd need 315 groups to begin to reflect that level of granularity... Groups are also not dynamic enough. When evaluating these rules, one of the inputs is whether the client requesting the action is a member of no session at all, or an inactive console session, or an active console session. You can't represent these with groups because you can't grant/revoke group membership to a process while it's running. (A process with a group membership can also stash away a setgid executable that can be used by the user to regain access to a group that they've been removed from later on, so it's not even possible to cast-iron-guarantee that access to a group has been revoked without inspecting the filesystem...)
- hulitu 5y agoHow many of these groups are really needed ? Seems like overengineering.