| |||||||||||||
sudo = 1st account can subvert whole systemsudo = 1st account can subvert whole systemPosted Dec 18, 2008 19:41 UTC (Thu) by jspaleta (subscriber, #50639)In reply to: sudo = 1st account can subvert whole system by dlang Parent article: Instructions from Fedora on fixing the dbus problem
I believe PolicyKit is meant to be the 'right' answer for this space:
http://hal.freedesktop.org/docs/PolicyKit/introduction.html
There are a set of cmdline tools which let you set authorizations manually:
There is a gui for gnome called polkit-gnome-authorization which lets you administer defined actions from the gnome desktop.
Discussion reference:
I dont use KDE, so I don't know the state of the kde equivalent for an authorization gui.
-jef
(Log in to post comments)
sudo = 1st account can subvert whole system Posted Dec 18, 2008 21:02 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]
reading the policy kit link, it doesn't look like that comes close to solving the problem.
it is a toolkit to allow GUI programs to be segmented into privilaged and unprivilaged parts and standardize the communication between them.
this approach only works if someone re-writes everything that needs to be done as a privilaged user into a client-server GUI tool.
when you need to fix the GUI stuff, or do things not covered by it, you still need to go back and use sudo (or equivalent) to run the commands.
besides which, even if you have PolicyKit fully implmented, if the user is allowed to do everything then you have the same problem as sudo, if they aren't you still need some other way to do the stuff, so what do you do?
|
|||||||||||||