Not a new direction

Posted Nov 19, 2009 1:43 UTC (Thu) by gmaxwell (guest, #30048)
Parent article: Fedora 12 lets unprivileged users install packages

A while back it was pointed out that the same 'security' facility was permitting non-root users to arbitrarily change the system time. The same voices took that same "but it's a desktop distribution!" and "you can turn it off by running <byzantine command never heard of by any unix admin>" kinds of positions.

What I really don't get is the dichotomy of also shipping SELinux by default which prohibits many things that Unix has classically allowed and can be quite tricky to deal with, even with all the tools Fedora has added, while at the same time giving regular users non-trivial swaths of root access without authentication.

Fedora used to have share a clear and auditable default security policy with most the rest of unixdom. Today it's a fedora specific undocumented mismash which changes from version to version that you have to use windows registry like tools to interact with.

Not a new direction

Posted Nov 19, 2009 1:46 UTC (Thu) by nix (subscriber, #2304) [Link] (3 responses)

Well, it's not Fedora specific; PolicyKit is used by other distros too.

Horribly underdocumented mishmash I agree with. I have no idea how to use
PK: configuring it appears to require bashing largely-undocumented XML
into policy files.

Not a new direction

Posted Nov 19, 2009 1:51 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

For Fedora 12, the following man pages are useful

pklocalauthority(8) polkit(8) polkitd(8) pkaction(1), pkcheck(1), pkexec(1)

It could be better but it is not empty either.

Not a new direction

Posted Nov 19, 2009 1:56 UTC (Thu) by nix (subscriber, #2304) [Link] (1 responses)

Aha. I'd somehow missed pkaction(1), without which everything is very
opaque. TBH though that blog post on changing settings with polkit was
better documentation than ahything I've ever seen with polkit itself...

Not a new direction

Posted Nov 19, 2009 4:15 UTC (Thu) by halfline (guest, #31920) [Link]

As mentioned above, have a look at the polkit man page. PolicyKit is actually very well documented. The main polkit man page describes the architecture, gives summaries and links to the tools (including pkaction) and examples for configuring policy. It even has ascii screenshots. To be honest, I haven't come across many projects with better documentation.