| |||||||||||||
Instructions from Fedora on fixing the dbus problemInstructions from Fedora on fixing the dbus problemPosted Dec 13, 2008 8:52 UTC (Sat) by muwlgr (guest, #35359)Parent article: Instructions from Fedora on fixing the dbus problem
Fedora still uses root account with password. I think I like Ubuntu approach better (disabled password for root, and sudo rights for the first non-root user created on the system).
(Log in to post comments)
Instructions from Fedora on fixing the dbus problem Posted Dec 13, 2008 10:10 UTC (Sat) by luya (subscriber, #50741) [Link]
Root name is deceiving because Fedora restricts its privilege with SELinux and its policies. Consolekit and Policykit are other tools replacing sudo.
Instructions from Fedora on fixing the dbus problem Posted Dec 18, 2008 8:30 UTC (Thu) by pcampe (guest, #28223) [Link]
I think that Ubuntu approach is rather disturbing. It hides the existence of root for normal users (who in a vast majority probably think that "sudo" is the linux equivalent of "ehm" or "well") and allows every user to do everything as "well"... "sudo" is a prefix everyone could type in.
sudo = 1st account can subvert whole system Posted Dec 18, 2008 16:17 UTC (Thu) by dwheeler (guest, #1216) [Link]
A big problem with the "sudo" approach is that any program you run - including, say, an attacker script sent via a browser - can use 'sudo' and overwrite ANYTHING, such as /bin/sh or the kernel.
With the "log in as root" approach, attacking programs don't get automatic access to the whole system.
sudo = 1st account can subvert whole system Posted Dec 18, 2008 18:32 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
hmm,
when linspire has the user login as root everyone screamed about how stupid it was, that they should have setup sudo instead
now ubuntu (among other distros) setup sudo instead and people scream about it not being safe.
what exactly should a distro do? force every user to logout and login as root? we know that that's not a good idea, windows tried the equivalent and the result was that everyone ran as 'administrator' (root equivalent) all the time.
sudo = 1st account can subvert whole system Posted Dec 18, 2008 19:41 UTC (Thu) by jspaleta (subscriber, #50639) [Link]
I believe PolicyKit is meant to be the 'right' answer for this space:
http://hal.freedesktop.org/docs/PolicyKit/introduction.html
There are a set of cmdline tools which let you set authorizations manually:
There is a gui for gnome called polkit-gnome-authorization which lets you administer defined actions from the gnome desktop.
Discussion reference:
I dont use KDE, so I don't know the state of the kde equivalent for an authorization gui.
-jef
sudo = 1st account can subvert whole system Posted Dec 18, 2008 21:02 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
reading the policy kit link, it doesn't look like that comes close to solving the problem.
it is a toolkit to allow GUI programs to be segmented into privilaged and unprivilaged parts and standardize the communication between them.
this approach only works if someone re-writes everything that needs to be done as a privilaged user into a client-server GUI tool.
when you need to fix the GUI stuff, or do things not covered by it, you still need to go back and use sudo (or equivalent) to run the commands.
besides which, even if you have PolicyKit fully implmented, if the user is allowed to do everything then you have the same problem as sudo, if they aren't you still need some other way to do the stuff, so what do you do?
|
|||||||||||||