4 ms·

Fedora 12 - unpriviliged users can install packages?

13 points by timf 17y ago

dhimes 17y ago
My impression is that fedora isn't really for production boxes anyhow. We have centos for that.
- benbeltran 17y ago
  If the thing is allow more simplicity for regular users, I think this is OK, unless someone finds a way to trick the system so it lets someone install something that isn't signed, and someone will. Probably. For boxes that need more security, this could be an opt-out feature. I personally don't like it that much, but I think it's good for people who don't want to think too much about it. But then again, people not thinking too much about stuff is why spam is thriving.
Rantenki 17y ago
Packagekit allows LOCAL users (who already have been given an account, by definition) to install software. More to the point, LOCAL users are likely to consist only of a single user, ie: the owner of the machine, in a the vast majority of installs. If you want a server, don't use Fedora. Fedora is bleeding edge redhat style desktop, end of story. If you want to use fedora as a server, go ahead, just disable this feature. Is it so weird that the Fedora engineers wanted to make life a little less painful for the kind of user that has no idea what sudo is, never mind the wheel group, or how to configure PAM? I think we all fall into this trap (myself included), where things we had to learn seem easy now. They aren't. Not by a long shot. Besides, Centos 5.4 is right over there. Right tool for the job folks.
- there 17y ago
  i think the outrage stems from the fact that this is being introduced into a distribution that many users are already using (or will be after a release/upgrade) and is drastically changing the way it has always worked. if a new desktop linux distribution were to come out touting this feature, i doubt anyone would really care.
  - sgk284 17y ago
    Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine locally. These are the same people that could reboot the machine into single user mode and do whatever they want. One analogy involved the fact that we already allow users to automount devices and this is no different. I congratualte Fedora on questioning the status quo.
    - tshtf 17y ago
      1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.
      - jerf 17y ago
        Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
      - ubernostrum 17y ago
        Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.
jrockway 17y ago
I think this is a good feature. I am often on a client Linux box without root and need something trivial like mg... but end up having to "install" from source because I don't have permission to install the package. If I could do that anyway, that would be good. I also think packages should install into ~ like this, rather than into the global system.

13 points by timf 17y ago

dhimes 17y ago

My impression is that fedora isn't really for production boxes anyhow. We have centos for that.

benbeltran 17y ago
If the thing is allow more simplicity for regular users, I think this is OK, unless someone finds a way to trick the system so it lets someone install something that isn't signed, and someone will. Probably. For boxes that need more security, this could be an opt-out feature. I personally don't like it that much, but I think it's good for people who don't want to think too much about it. But then again, people not thinking too much about stuff is why spam is thriving.

Rantenki 17y ago

Packagekit allows LOCAL users (who already have been given an account, by definition) to install software. More to the point, LOCAL users are likely to consist only of a single user, ie: the owner of the machine, in a the vast majority of installs. If you want a server, don't use Fedora. Fedora is bleeding edge redhat style desktop, end of story. If you want to use fedora as a server, go ahead, just disable this feature. Is it so weird that the Fedora engineers wanted to make life a little less painful for the kind of user that has no idea what sudo is, never mind the wheel group, or how to configure PAM? I think we all fall into this trap (myself included), where things we had to learn seem easy now. They aren't. Not by a long shot. Besides, Centos 5.4 is right over there. Right tool for the job folks.

there 17y ago
i think the outrage stems from the fact that this is being introduced into a distribution that many users are already using (or will be after a release/upgrade) and is drastically changing the way it has always worked. if a new desktop linux distribution were to come out touting this feature, i doubt anyone would really care.
- sgk284 17y ago
  Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine locally. These are the same people that could reboot the machine into single user mode and do whatever they want. One analogy involved the fact that we already allow users to automount devices and this is no different. I congratualte Fedora on questioning the status quo.
  - tshtf 17y ago
    1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.
    - jerf 17y ago
      Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
    - ubernostrum 17y ago
      Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.

jrockway 17y ago

I think this is a good feature. I am often on a client Linux box without root and need something trivial like mg... but end up having to "install" from source because I don't have permission to install the package. If I could do that anyway, that would be good. I also think packages should install into ~ like this, rather than into the global system.