Bug 1240734

Summary: Installing suggested applications from command line doesn't require password
Product: [Fedora] Fedora Reporter: Otso Rajala <ojrajala>
Component: PackageKitAssignee: Richard Hughes <rhughes>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 22CC: eduardlucena, jonathan, jsilhan, jzeleny, kalevlember, mluscon, opensource, packaging-team-maint, physics.depa, pnemade, rdieter, rhughes, smparrish, tim.lauridsen, vmukhame
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-25 12:57:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Otso Rajala 2015-07-07 15:27:03 UTC
Description of problem:
When I tried to start guile and it was not installed, shell prompted if I wanted to install the package. I said "yes", and guile was downloaded and installed. However, when trying to install guile with dnf normally, it does require password. User in both cases is of type administrator with sudo abilities. Seems like security and inconsistency problem.

Version-Release number of selected component (if applicable):
dnf-0:1.0.0-1.fc22.noarch


How reproducible:
Always

Steps to Reproduce:
1. Be administrator with sudo abilities
2. try to run program that is not installed
3. answer yes to prompt asking if you want to install package foo providing command bar

Actual results:
foo gets installed without requesting password

Expected results:
ask password of sudoing user

Additional info:

Comment 1 Radek Holy 2015-07-08 07:27:16 UTC
It's PackageKit-command-not-found which installs the missing program. And I also believe that this is a feature, not a bug. But I'll leave the decision to its maintainers since I am not completely sure what's happening there.

Comment 2 Eduard Lucena 2016-02-25 22:45:36 UTC
I test this, and happens when the user is part of the group wheel. Maybe is a design decision. When you tried with a user that is not in the wheel group it show a password input dialog.

Comment 3 Till Maas 2016-03-25 12:56:47 UTC
*** Bug 1247176 has been marked as a duplicate of this bug. ***

Comment 4 Till Maas 2016-03-25 12:57:40 UTC
This is the intended behaviour. It should not be possible to install unsigned packages this way.