Bug 591079

Summary: KPPP gives an error at launch from menus in F13 RC2 live
Product: [Fedora] Fedora Reporter: Adam Williamson <awilliam>
Component: kdenetworkAssignee: Than Ngo <than>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 13CC: fedora, jreznik, kevin, lorenzo, ltinkl, rdieter, smparrish, than
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kdenetwork-4.4.3-3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-05-26 21:41:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Adam Williamson 2010-05-11 11:49:21 UTC
Trying to launch 'Internet Dial-Up Tool' (kppp) from the Internet menu in F13 RC2 KDE live spin gives an error:

"You do not have sufficient permission to run: /usr/sbin/pppd . Please make sure that kppp is owned by root and has the SUID bit set.'

This is a failure of the 'desktop menus' validation test:
https://fedoraproject.org/wiki/QA:Testcase_desktop_menus . As we don't consider
the desktop validation tests to be release blocking for anything but the
default desktop in F13, not nominating this as a release blocker, but obviously
can be fixed with updates, and for future releases we'd hope to be able to
consider this kind of thing release blocking. I suppose we may want to revisit this if we end up delaying final release, if there are internet connection cases not covered by knetworkmanager and there's no obvious workaround?

Comment 1 Adam Williamson 2010-05-11 11:51:45 UTC
just noticed, after you close the error dialog, kppp does proceed to run. I can't test if it actually works, though.

Comment 2 Kevin Kofler 2010-05-11 12:00:51 UTC
Workaround is Alt+F2 kdesu kppp ENTER.

The proper fix is to change the menu entry to run kppp under kdesu.

Comment 3 Adam Williamson 2010-05-12 09:29:11 UTC
since we've slipped F13 final you may be able to sneak a fix for this into final if you like...have to ask oxf13 if he'd take it.



-- 
Fedora Bugzappers volunteer triage team
https://fedoraproject.org/wiki/BugZappers

Comment 4 Kevin Kofler 2010-05-12 11:43:31 UTC
I'm looking into it.

Comment 5 Kevin Kofler 2010-05-12 13:09:33 UTC
Actually, Than is going to set this up using consolehelper.

Comment 6 Adam Williamson 2010-05-12 17:03:21 UTC
Aren't we suppposed to be moving to PolicyKit instead of consolehelper?

Comment 7 Kevin Kofler 2010-05-12 17:15:06 UTC
Uhm yeah, KPPP is supposed to use KAuth/PolicyKit in the long run. But we need a quick fix now. The way upstream handles this is that they make the kppp binary SUID, fork a child process, drop privileges in the GUI part by setting the UID back to the invoking UID and keep the privileges in the child process. The nice thing about that approach is that it doesn't require running the GUI as root (as is the case when we use consolehelper or kdesu), but the big problem is that it allows dialing out with no root password. The RH security team didn't like that, nor the unaudited custom privilege dropping handling, so they asked us not to make kppp SUID. We had this set up using consolehelper in KDE 3, but it got dropped at some point, I think with the migration to KDE 4.

Of course, the proper solution is to use KAuth (which uses PolicyKit, but it's also portable to other operating systems or distributions which use different mechanisms). That way we get the GUI process not running as root, authorization required by default and the possibility for the admin to give out permanent authorization to a user all at the same time. But that takes more than a quick fix.

Comment 8 Fedora Update System 2010-05-25 21:48:07 UTC
kde-l10n-4.4.3-1.fc13,kdeaccessibility-4.4.3-1.fc13.1,kdeadmin-4.4.3-1.fc13.1,kdeartwork-4.4.3-1.fc13.1,kdebase-4.4.3-2.fc13.1,kdebase-runtime-4.4.3-1.fc13.1,kdebase-workspace-4.4.3-1.fc13.1,kdebindings-4.4.3-1.fc13.1,kdeedu-4.4.3-1.fc13.1,kdegames-4.4.3-1.fc13.1,kdegraphics-4.4.3-1.fc13.1,kdelibs-4.4.3-2.fc13,kdemultimedia-4.4.3-1.fc13.1,kdenetwork-4.4.3-3.fc13,kdepim-4.4.3-1.fc13.1,kdepim-runtime-4.4.3-1.fc13.1,kdepimlibs-4.4.3-1.fc13.1,kdeplasma-addons-4.4.3-1.fc13.1,kdesdk-4.4.3-1.fc13.1,kdetoys-4.4.3-1.fc13.1,kdeutils-4.4.3-1.fc13.1,oxygen-icon-theme-4.4.3-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/kde-l10n-4.4.3-1.fc13,kdeaccessibility-4.4.3-1.fc13.1,kdeadmin-4.4.3-1.fc13.1,kdeartwork-4.4.3-1.fc13.1,kdebase-4.4.3-2.fc13.1,kdebase-runtime-4.4.3-1.fc13.1,kdebase-workspace-4.4.3-1.fc13.1,kdebindings-4.4.3-1.fc13.1,kdeedu-4.4.3-1.fc13.1,kdegames-4.4.3-1.fc13.1,kdegraphics-4.4.3-1.fc13.1,kdelibs-4.4.3-2.fc13,kdemultimedia-4.4.3-1.fc13.1,kdenetwork-4.4.3-3.fc13,kdepim-4.4.3-1.fc13.1,kdepim-runtime-4.4.3-1.fc13.1,kdepimlibs-4.4.3-1.fc13.1,kdeplasma-addons-4.4.3-1.fc13.1,kdesdk-4.4.3-1.fc13.1,kdetoys-4.4.3-1.fc13.1,kdeutils-4.4.3-1.fc13.1,oxygen-icon-theme-4.4.3-1.fc13

Comment 9 Fedora Update System 2010-05-25 21:49:10 UTC
kde-l10n-4.4.3-1.fc12,kdeaccessibility-4.4.3-1.fc12.1,kdeadmin-4.4.3-1.fc12.1,kdeartwork-4.4.3-1.fc12.1,kdebase-4.4.3-2.fc12.1,kdebase-runtime-4.4.3-1.fc12.1,kdebase-workspace-4.4.3-1.fc12.1,kdebindings-4.4.3-1.fc12.1,kdeedu-4.4.3-1.fc12.1,kdegames-4.4.3-1.fc12.1,kdegraphics-4.4.3-1.fc12.1,kdelibs-4.4.3-2.fc12,kdemultimedia-4.4.3-1.fc12.1,kdenetwork-4.4.3-3.fc12,kdepim-4.4.3-1.fc12.1,kdepim-runtime-4.4.3-1.fc12.1,kdepimlibs-4.4.3-1.fc12.1,kdeplasma-addons-4.4.3-1.fc12.1,kdesdk-4.4.3-1.fc12.1,kdetoys-4.4.3-1.fc12.1,kdeutils-4.4.3-1.fc12.1,oxygen-icon-theme-4.4.3-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/kde-l10n-4.4.3-1.fc12,kdeaccessibility-4.4.3-1.fc12.1,kdeadmin-4.4.3-1.fc12.1,kdeartwork-4.4.3-1.fc12.1,kdebase-4.4.3-2.fc12.1,kdebase-runtime-4.4.3-1.fc12.1,kdebase-workspace-4.4.3-1.fc12.1,kdebindings-4.4.3-1.fc12.1,kdeedu-4.4.3-1.fc12.1,kdegames-4.4.3-1.fc12.1,kdegraphics-4.4.3-1.fc12.1,kdelibs-4.4.3-2.fc12,kdemultimedia-4.4.3-1.fc12.1,kdenetwork-4.4.3-3.fc12,kdepim-4.4.3-1.fc12.1,kdepim-runtime-4.4.3-1.fc12.1,kdepimlibs-4.4.3-1.fc12.1,kdeplasma-addons-4.4.3-1.fc12.1,kdesdk-4.4.3-1.fc12.1,kdetoys-4.4.3-1.fc12.1,kdeutils-4.4.3-1.fc12.1,oxygen-icon-theme-4.4.3-1.fc12

Comment 10 Fedora Update System 2010-05-25 21:52:53 UTC
kde-l10n-4.4.3-1.fc11,kdeaccessibility-4.4.3-1.fc11.1,kdeadmin-4.4.3-1.fc11.1,kdeartwork-4.4.3-1.fc11.1,kdebase-4.4.3-2.fc11.1,kdebase-runtime-4.4.3-1.fc11.1,kdebase-workspace-4.4.3-1.fc11.1,kdebindings-4.4.3-1.fc11.1,kdeedu-4.4.3-1.fc11.1,kdegames-4.4.3-1.fc11.1,kdegraphics-4.4.3-1.fc11.1,kdelibs-4.4.3-2.fc11,kdemultimedia-4.4.3-1.fc11.1,kdenetwork-4.4.3-3.fc11,kdepim-4.4.3-1.fc11.1,kdepim-runtime-4.4.3-1.fc11.1,kdepimlibs-4.4.3-1.fc11.1,kdeplasma-addons-4.4.3-1.fc11.1,kdesdk-4.4.3-1.fc11.1,kdetoys-4.4.3-1.fc11.1,kdeutils-4.4.3-1.fc11.1,oxygen-icon-theme-4.4.3-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/kde-l10n-4.4.3-1.fc11,kdeaccessibility-4.4.3-1.fc11.1,kdeadmin-4.4.3-1.fc11.1,kdeartwork-4.4.3-1.fc11.1,kdebase-4.4.3-2.fc11.1,kdebase-runtime-4.4.3-1.fc11.1,kdebase-workspace-4.4.3-1.fc11.1,kdebindings-4.4.3-1.fc11.1,kdeedu-4.4.3-1.fc11.1,kdegames-4.4.3-1.fc11.1,kdegraphics-4.4.3-1.fc11.1,kdelibs-4.4.3-2.fc11,kdemultimedia-4.4.3-1.fc11.1,kdenetwork-4.4.3-3.fc11,kdepim-4.4.3-1.fc11.1,kdepim-runtime-4.4.3-1.fc11.1,kdepimlibs-4.4.3-1.fc11.1,kdeplasma-addons-4.4.3-1.fc11.1,kdesdk-4.4.3-1.fc11.1,kdetoys-4.4.3-1.fc11.1,kdeutils-4.4.3-1.fc11.1,oxygen-icon-theme-4.4.3-1.fc11

Comment 11 Fedora Update System 2010-05-26 21:40:17 UTC
kde-l10n-4.4.3-1.fc12, kdeaccessibility-4.4.3-1.fc12.1, kdeadmin-4.4.3-1.fc12.1, kdeartwork-4.4.3-1.fc12.1, kdebase-4.4.3-2.fc12.1, kdebase-runtime-4.4.3-1.fc12.1, kdebase-workspace-4.4.3-1.fc12.1, kdebindings-4.4.3-1.fc12.1, kdeedu-4.4.3-1.fc12.1, kdegames-4.4.3-1.fc12.1, kdegraphics-4.4.3-1.fc12.1, kdelibs-4.4.3-2.fc12, kdemultimedia-4.4.3-1.fc12.1, kdenetwork-4.4.3-3.fc12, kdepim-4.4.3-1.fc12.1, kdepim-runtime-4.4.3-1.fc12.1, kdepimlibs-4.4.3-1.fc12.1, kdeplasma-addons-4.4.3-1.fc12.1, kdesdk-4.4.3-1.fc12.1, kdetoys-4.4.3-1.fc12.1, kdeutils-4.4.3-1.fc12.1, oxygen-icon-theme-4.4.3-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2010-05-26 21:41:28 UTC
kde-l10n-4.4.3-1.fc13, kdeaccessibility-4.4.3-1.fc13.1, kdeadmin-4.4.3-1.fc13.1, kdeartwork-4.4.3-1.fc13.1, kdebase-4.4.3-2.fc13.1, kdebase-runtime-4.4.3-1.fc13.1, kdebase-workspace-4.4.3-1.fc13.1, kdebindings-4.4.3-1.fc13.1, kdeedu-4.4.3-1.fc13.1, kdegames-4.4.3-1.fc13.1, kdegraphics-4.4.3-1.fc13.1, kdelibs-4.4.3-2.fc13, kdemultimedia-4.4.3-1.fc13.1, kdenetwork-4.4.3-3.fc13, kdepim-4.4.3-1.fc13.1, kdepim-runtime-4.4.3-1.fc13.1, kdepimlibs-4.4.3-1.fc13.1, kdeplasma-addons-4.4.3-1.fc13.1, kdesdk-4.4.3-1.fc13.1, kdetoys-4.4.3-1.fc13.1, kdeutils-4.4.3-1.fc13.1, oxygen-icon-theme-4.4.3-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2010-05-26 21:44:25 UTC
kde-l10n-4.4.3-1.fc11, kdeaccessibility-4.4.3-1.fc11.1, kdeadmin-4.4.3-1.fc11.1, kdeartwork-4.4.3-1.fc11.1, kdebase-4.4.3-2.fc11.1, kdebase-runtime-4.4.3-1.fc11.1, kdebase-workspace-4.4.3-1.fc11.1, kdebindings-4.4.3-1.fc11.1, kdeedu-4.4.3-1.fc11.1, kdegames-4.4.3-1.fc11.1, kdegraphics-4.4.3-1.fc11.1, kdelibs-4.4.3-2.fc11, kdemultimedia-4.4.3-1.fc11.1, kdenetwork-4.4.3-3.fc11, kdepim-4.4.3-1.fc11.1, kdepim-runtime-4.4.3-1.fc11.1, kdepimlibs-4.4.3-1.fc11.1, kdeplasma-addons-4.4.3-1.fc11.1, kdesdk-4.4.3-1.fc11.1, kdetoys-4.4.3-1.fc11.1, kdeutils-4.4.3-1.fc11.1, oxygen-icon-theme-4.4.3-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.