Bug 1177935

Summary:	fedora is inconsistent with asking for passwords for root actions
Product:	[Fedora] Fedora	Reporter:	James Patterson <jamespatterson>
Component:	distribution	Assignee:	Václav Pavlín <vpavlin>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	21	CC:	Anasastu, asl97, dennis, extras-qa, jamespatterson, notting, rhughes, rjones, thms, tim.lauridsen, vpavlin
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1153005	Environment:
Last Closed:	2015-01-05 11:05:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description James Patterson 2014-12-31 13:27:34 UTC

+++ This bug was initially created as a clone of Bug #1153005 +++

Description of problem:

The distribtion is inconsistent. If I use one tool to install a pacakge (yum) I need to authenticate. If I use another (packagekit), it doesn't. Inconsistency is confusing and hurts users.

Comment 1 Richard Hughes 2015-01-05 11:05:03 UTC

I disagree, sorry. Yum isn't asking to "authenticate", you *have* to already be the root user to install software with it. The only thing that does require authentication is PackageKit, which can run without explicit user-authentication in a few specific cases IF the current logged on and active user is in the wheel group. This has been debated to death already by FESCO and the majority are in favour of keeping the current logic.

Comment 2 James Patterson 2015-01-05 21:23:02 UTC

So if I run "yum install" as a normal user it doesn't authenticate and doesn't install the software, but if I do the same with packagekit it does install the software because it knows how to authenticate?

So the user should know which binaries support authentication? That's crap.

Comment 3 Thomas M Steenholdt 2022-04-17 14:57:23 UTC

This is an old, closed bug, but I agree it's a bit strange that we allow this type of modification to the system, unauthenticated.

There are many ways this can be used to elevate privileges, and with the overall focus on security on the project (firewalld enabled by default, selinux active by default etc), this seems like a bit of a backdoor?

It's already been proved that it can be abused.

https://sysdream.com/news/lab/2020-05-25-abusing-packagekit-on-fedora-centos-for-fun-profit-from-wheel-to-root/

In any case, this is still the way things are in F36 beta.