The evolution of control groups

Posted Nov 1, 2013 17:07 UTC (Fri) by mathstuf (subscriber, #69389)
In reply to: The evolution of control groups by Cyberax
Parent article: The evolution of control groups

Probably polkit. It's used to deny access to things like the Suspend and Hibernate methods for powerkit (which is now provided by logind; not sure what access controls it uses).

The evolution of control groups

Posted Nov 1, 2013 22:05 UTC (Fri) by nix (subscriber, #2304) [Link] (10 responses)

polkit? You mean the program which has just thrown away all user policy customization and required everyone to rewrite all their local security policies in Javascript?

*That* horror?

The evolution of control groups

Posted Nov 1, 2013 22:15 UTC (Fri) by luto (guest, #39314) [Link] (1 responses)

To be fair, in my opinion it's a considerable improvement over writing the policies in pkla language.

(Also, there wasn't really an intelligent solution to the problem that polkit is solving before. The disaster that is /etc/security isn't really better. Neither are groups, especially if you want to tie actions to physical presence.)

The evolution of control groups

Posted Nov 1, 2013 22:18 UTC (Fri) by Cyberax (✭ supporter ✭, #52523) [Link]

Right now cgroups are pretty much close to my perfect solution - I just can set the regular file permissions and inspect them using the usual tools.

The evolution of control groups

Posted Nov 1, 2013 22:21 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link] (7 responses)

https://fedorahosted.org/polkit-pkla-compat/

The evolution of control groups

Posted Nov 1, 2013 22:24 UTC (Fri) by luto (guest, #39314) [Link] (1 responses)

At least you don't have to use this thing :)

The evolution of control groups

Posted Nov 1, 2013 22:28 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link]

Compatibility plugs are usually a transitional mechanism. So no, you don't have to use it.

The evolution of control groups

Posted Nov 1, 2013 23:07 UTC (Fri) by nix (subscriber, #2304) [Link] (4 responses)

Nice! This should have been highlighted in huge flashing letters by the policy-kit people when they pushed this incompatible change on us. (Not that it *is* entirely compatible: I was *using* ReturnValue, dammit.)

The evolution of control groups

Posted Nov 1, 2013 23:31 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link] (3 responses)

That wouldn't have been possible. This was developed independent of the polkit developers sometime later.

The evolution of control groups

Posted Nov 3, 2013 19:54 UTC (Sun) by nix (subscriber, #2304) [Link] (2 responses)

That's... a bit of an indictment of the polkit developers. Should we trust them not to break all our configuration again without caring about the people they leave out in the cold? They did it once before, after all...

The evolution of control groups

Posted Nov 3, 2013 20:18 UTC (Sun) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

The older version is afaik parallel installable (Older version: PolicyKit, new version: polkit), so if you want to continue using the older format, you can as long as the distros include it. However the compatibility layer made the older version unnecessary. If you want to be relatively sure, you can ask them directly.

The evolution of control groups

Posted Nov 6, 2013 17:55 UTC (Wed) by nix (subscriber, #2304) [Link]

Unfortunately that's not true, as the naming change happened at a different time to (a lot earlier than) the config change. Anyone in the middle is stuck. Ah well, the compat thing should do the trick, with a bit of effort...