Bug 1240734 - Installing suggested applications from command line doesn't require password
Summary: Installing suggested applications from command line doesn't require password
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: PackageKit
Version: 22
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Richard Hughes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1247176 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-07 15:27 UTC by Otso Rajala
Modified: 2016-03-25 12:57 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2016-03-25 12:57:40 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1227751 0 unspecified CLOSED PackageKit-command-not-found: inform user what is installing the package 2021-02-22 00:41:40 UTC

Internal Links: 1227751

Description Otso Rajala 2015-07-07 15:27:03 UTC 
Description of problem:
When I tried to start guile and it was not installed, shell prompted if I wanted to install the package. I said "yes", and guile was downloaded and installed. However, when trying to install guile with dnf normally, it does require password. User in both cases is of type administrator with sudo abilities. Seems like security and inconsistency problem.

Version-Release number of selected component (if applicable):
dnf-0:1.0.0-1.fc22.noarch


How reproducible:
Always

Steps to Reproduce:
1. Be administrator with sudo abilities
2. try to run program that is not installed
3. answer yes to prompt asking if you want to install package foo providing command bar

Actual results:
foo gets installed without requesting password

Expected results:
ask password of sudoing user

Additional info:
Comment 1 Radek Holy 2015-07-08 07:27:16 UTC 
It's PackageKit-command-not-found which installs the missing program. And I also believe that this is a feature, not a bug. But I'll leave the decision to its maintainers since I am not completely sure what's happening there.
Comment 2 Eduard Lucena 2016-02-25 22:45:36 UTC 
I test this, and happens when the user is part of the group wheel. Maybe is a design decision. When you tried with a user that is not in the wheel group it show a password input dialog.
Comment 3 Till Maas 2016-03-25 12:56:47 UTC 
*** Bug 1247176 has been marked as a duplicate of this bug. ***
Comment 4 Till Maas 2016-03-25 12:57:40 UTC 
This is the intended behaviour. It should not be possible to install unsigned packages this way.
Note You need to log in before you can comment on or make changes to this bug.