2 ms·
Interesting. Ironically the reason pkexec exists on Ubuntu server installs seems to be that they want to have a package management service (PackageKit) hanging
by fulafel 5y ago
Interesting.
Ironically the reason pkexec exists on Ubuntu server installs seems to be that they want to have a package management service (PackageKit) hanging off dbus even in headless setups, for reasons that aren't obvious. There have been earlier local root bugs caused by PackageKit as well[1].
(The irony being, the LWN documented discussion where a dev defends ipc-accessible privileged daemons as more secure and justifies pkexec as facilitating access to these).
[1] https://ubuntu.com/security/notices/USN-4538-1 https://ubuntu.com/security/notices/USN-4538-1
- simcop2387 5y agoI believe it gets used for the unattended-upgrades system to manage security updates. Not sure if that's the best way to do it but I believe it's using packagekit to do the actual work.
- fulafel 5y agoThat was my guess also at first but seems this is not the case, it just runs as root and calls apt directly. There's no dependency to packagekit, and it only uses dbus in the unattended-upgrade-shutdown script for some shutdown event monitoring business from systemd.