3 ms·

Packagekit allows LOCAL users (who already have been given an account, by definition) to install software. More to the point, LOCAL users are likely to consist

Packagekit allows LOCAL users (who already have been given an account, by definition) to install software. More to the point, LOCAL users are likely to consist only of a single user, ie: the owner of the machine, in a the vast majority of installs. If you want a server, don't use Fedora. Fedora is bleeding edge redhat style desktop, end of story. If you want to use fedora as a server, go ahead, just disable this feature. Is it so weird that the Fedora engineers wanted to make life a little less painful for the kind of user that has no idea what sudo is, never mind the wheel group, or how to configure PAM? I think we all fall into this trap (myself included), where things we had to learn seem easy now. They aren't. Not by a long shot. Besides, Centos 5.4 is right over there. Right tool for the job folks.

there 17y ago
i think the outrage stems from the fact that this is being introduced into a distribution that many users are already using (or will be after a release/upgrade) and is drastically changing the way it has always worked. if a new desktop linux distribution were to come out touting this feature, i doubt anyone would really care.
- sgk284 17y ago
  Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine locally. These are the same people that could reboot the machine into single user mode and do whatever they want. One analogy involved the fact that we already allow users to automount devices and this is no different. I congratualte Fedora on questioning the status quo.
  - tshtf 17y ago
    1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.
    - jerf 17y ago
      Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
    - ubernostrum 17y ago
      Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.
      - dhimes 17y ago
        No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!
        ubernostrum 17y ago
        So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
  - sandGorgon 17y ago
    Protect a user from himself. I manage IT for an accounting firm and I got a few ubuntu machines - they know how to use Synaptic (and know I need to give the password). However, it is highly unlikely any of them know how to drop to single-user mode and do "stuff". One of the things that companies like about Linux - is that it can be reasonably locked down against people who typically click attachments in mails, etc. ... not against hackers. I think this is the beginning of a new era of Linux viruses.

there 17y ago

i think the outrage stems from the fact that this is being introduced into a distribution that many users are already using (or will be after a release/upgrade) and is drastically changing the way it has always worked. if a new desktop linux distribution were to come out touting this feature, i doubt anyone would really care.

sgk284 17y ago
Most of the fiasco, as most fiascos are, is caused by ignorance and not understanding that PolicyKit gives this privilege only to people that are on the machine locally. These are the same people that could reboot the machine into single user mode and do whatever they want. One analogy involved the fact that we already allow users to automount devices and this is no different. I congratualte Fedora on questioning the status quo.
- tshtf 17y ago
  1) Right now I'm running Firefox locally in X11. If there is a code execution vulnerability in JPEG parsing, for example, the shellcode could just install a signed repo package with a root vulnerability. This potentially means the next Firefox vulnerability is remote root on FC12. 2) You don't have to be at the console to inject code to install arbitrary packages, but you do for mounting a drive. 3) There are good ideas behind policykit and packagekit, but the introduction was mishandled. No mention was made in the initial release notes of this new feature, and one could argue that the default policy isn't the best idea. However, having the ability to define more finely-grained policies should get two thumbs up.
  - jerf 17y ago
    Yeah, I had to ponder your #1 there for a moment, but I think you're right. It is true that the local user is virtually by definition in possession of root capabilities (whether they know it or not), but that doesn't mean their user account is; the user account !=== the user from a security point of view. I think you've nailed why this is a bad idea. I manage my machines the same way; sure, I'm "root" and I tend to "su" around a lot, but I'm careful about what I do as root vs. what I do as my "main" user vs. what I may do as a throwaway user with virtually no privs (some Wine stuff gets run this way, for instance). Just because I-the-human am root all the time doesn't mean I want all my accounts to be root.
  - ubernostrum 17y ago
    Except this is what bugs me about that huge fedora-dev thread: all the proposed attacks seem to begin by assuming the attacker is already in a position where they don't need this to own you. And it's really hard to read that thread without getting the impression that a lot of people are trying to take the security model and use cases of their companies' production servers and apply them to personal desktop systems.
    - dhimes 17y ago
      No, the real concern is that someone who doesn't understand the issue as well as "root" now can install software that has an exploit. Ex: I have a server in my office. My kids use it for this and that. One of them decides it's be cool to install the new TI->Ipod widget. Three days later I'm unknowingly hosting pirated movies. Edit: I made up the TI->ipod thing. Don't want to waste anybody's day!
      - ubernostrum 17y ago
        So, this raises the question of why you're running a desktop-oriented OS on a server. And as I said originally I think that's a big part of the problem: the server security use case and the desktop security use case are not the same, and far too much of the discussion has been based around the assumption that they are. On a server, the idea that a non-root user can install packages is terrifying, but on a desktop? Both the threat model and the use case are so wildly different that I don't think it's possible to make any meaningful comparison.
- sandGorgon 17y ago
  Protect a user from himself. I manage IT for an accounting firm and I got a few ubuntu machines - they know how to use Synaptic (and know I need to give the password). However, it is highly unlikely any of them know how to drop to single-user mode and do "stuff". One of the things that companies like about Linux - is that it can be reasonably locked down against people who typically click attachments in mails, etc. ... not against hackers. I think this is the beginning of a new era of Linux viruses.