Bug 1153005 - fedora 21 lets me install packages without root
Summary: fedora 21 lets me install packages without root
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: distribution
Version: 21
Hardware: Unspecified
OS: Unspecified
unspecified
urgent
Target Milestone: ---
Assignee: Václav Pavlín
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-10-15 11:17 UTC by James Patterson
Modified: 2014-12-31 13:38 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
: 1177935 (view as bug list)
Environment:
Last Closed: 2014-10-20 15:01:17 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description James Patterson 2014-10-15 11:17:58 UTC
Description of problem:
$ nmap --script ssl-enum-ciphers -p 443 blah.example.com
bash: nmap: command not found...
Install package 'nmap' to provide command 'nmap'? [N/y] y


 * Waiting in queue... 
 * Waiting in queue... 
 * Waiting for authentication... 
 * Waiting in queue... 
 * Downloading packages... 
 * Requesting data... 
 * Testing changes... 
 * Installing packages... 

Starting Nmap 6.47 ( http://nmap.org ) at 2014-10-15 12:34 CEST

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:
nmap is installed without:
i) me being root
ii) asking for authentication

Expected results:


Additional info:

Comment 1 Lori 2014-10-15 20:06:56 UTC
James, does this happen if you start up Fedora and immediately try the commands? (Just checking, since Yum remembers if you've entered the root password during the current Terminal session, and won't ask until the session is closed.)

Are there other packages that can seemingly trick the installer? If so, could you create a user with no Admin privileges and see whether that account is capable? Lastly, is there anything notable in your recent update/install history (besides nmap)? Thanks.

Comment 2 James Patterson 2014-10-16 07:07:08 UTC
It happens if I open a new gnome-terminal and run any command that does not exist yet. Try it with anything: nethogs, for example.

non-wheel: haven't tried yet (this still needs to be fixed for wheel though)

recent packages: tons! it's an alpha release, there are tons of updates!

Comment 3 James Patterson 2014-10-16 07:19:00 UTC
As non-wheel I am prompted for authentication.
As wheel I am not prompted for authentication, even on a fresh boot (!)

Comment 4 James Patterson 2014-10-17 08:30:20 UTC
How can I propose this as a Blocker?

Comment 5 Tim Lauridsen 2014-10-20 06:46:24 UTC
This is a PackageKit thing

http://fedoraproject.org/wiki/Features/PackageKitCommandNotFound

I think this is supposed to work this way, if you are a administrator (= member of wheel group) you dont get asked for password

Comment 6 James Patterson 2014-10-20 07:54:31 UTC
But then we should be consistent with sudo and not require a password there either.

Comment 7 Tim Lauridsen 2014-10-20 08:28:00 UTC
(In reply to James Patterson from comment #6)
> But then we should be consistent with sudo and not require a password there
> either.

There is a difference from installing packages without password if you are in the wheel group and sudo without password there can perform all root related actions

Added Richard to CC, He can tell if that is supposed to work this way as I expect.

Comment 8 James Patterson 2014-10-20 08:43:47 UTC
Whereas yum install XYZ requires authentication...

Comment 9 Richard Hughes 2014-10-20 15:01:17 UTC
This is by design. If you're in the wheel group, you can do much more malicious things than install signed packages from signed repos. "sudo" provides unrestricted access to any action, and yum is a low-level packaging tool that allows you to do much more than just install packages.

Comment 10 James Patterson 2014-12-31 13:25:06 UTC
Then it's a poor design: it's inconsistent. I will open a new bug for the inconsistency.

Comment 11 James Patterson 2014-12-31 13:28:31 UTC
Bug 1177935 opened.


Note You need to log in before you can comment on or make changes to this bug.