Fedora Account System
Red Hat Associate
Red Hat Customer
+++ This bug was initially created as a clone of Bug #1153005 +++ Description of problem: The distribtion is inconsistent. If I use one tool to install a pacakge (yum) I need to authenticate. If I use another (packagekit), it doesn't. Inconsistency is confusing and hurts users.
I disagree, sorry. Yum isn't asking to "authenticate", you *have* to already be the root user to install software with it. The only thing that does require authentication is PackageKit, which can run without explicit user-authentication in a few specific cases IF the current logged on and active user is in the wheel group. This has been debated to death already by FESCO and the majority are in favour of keeping the current logic.
So if I run "yum install" as a normal user it doesn't authenticate and doesn't install the software, but if I do the same with packagekit it does install the software because it knows how to authenticate? So the user should know which binaries support authentication? That's crap.
This is an old, closed bug, but I agree it's a bit strange that we allow this type of modification to the system, unauthenticated. There are many ways this can be used to elevate privileges, and with the overall focus on security on the project (firewalld enabled by default, selinux active by default etc), this seems like a bit of a backdoor? It's already been proved that it can be abused. https://sysdream.com/news/lab/2020-05-25-abusing-packagekit-on-fedora-centos-for-fun-profit-from-wheel-to-root/ In any case, this is still the way things are in F36 beta.