Hide Forgot
Description of problem: it's possible to bypass the security around dnf, by entering known commands into bash, to let the package get installed, even if root would not allow it. This should not be possible. Version-Release number of selected component (if applicable): bash-4.3.42-5.fc23.x86_64 bash-completion-2.1-8.20150513git1950590.fc23.noarch dnf-1.1.10-1.fc23.noarch dnf-conf-1.1.10-1.fc23.noarch dnfdaemon-0.3.16-1.fc23.noarch dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch dnf-yum-1.1.10-1.fc23.noarch python2-dnf-1.1.10-1.fc23.noarch python2-dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch python3-dnf-1.1.10-1.fc23.noarch python3-dnfdaemon-0.3.16-1.fc23.noarch python3-dnf-plugin-system-upgrade-0.7.1-1.fc23.noarch yumex-dnf-4.1.6-1.fc23.noarch How reproducible: Sorry, systemoutput is in german, but you should catch the important part, that the installtion is done without a password, but the erase is denied due to lack of root privileges. [marius@eve ~]$ elinks "https://www.stadehandball.de/?action=results&tabtype=0&file=ol-16-17.l98&st=8" bash: elinks: Befehl nicht gefunden... Soll das Paket »elinks« installiert werden, welches den Befehl »elinks« bereitstellt? [N/y] y * Warten in Warteschlange... Die folgenden Pakete müssen installiert werden: elinks-0.12-0.47.pre6.fc23.x86_64 A text-mode Web browser Mit Änderungen fortfahren? [N/y] y * Warten in Warteschlange... * Warten auf Legitimation... * Warten in Warteschlange... * Pakete werden heruntergeladen... * Daten werden abgefragt... * Änderungen werden getestet... * Pakete werden installiert... (packages get installed ) [marius@eve ~]$ dnf erase elinks Abhängigkeiten sind aufgelöst. ================================================================================================================================================================================================================================================================================ Package Arch Version Paketquelle Größe ================================================================================================================================================================================================================================================================================ Entfernen: elinks x86_64 0.12-0.47.pre6.fc23 @fedora 2.9 M Transaktionsübersicht ================================================================================================================================================================================================================================================================================ Entfernen 1 Paket Installationsgröße: 2.9 M Ist dies in Ordnung? [j/N]: j Transaktionsüberprüfung wird ausgeführt Transaktionsprüfung war erfolgreich. Transaktion wird getestet Transaktionstest war erfolgreich. Transaktion wird ausgeführt Transaktionssperre kann nicht erhalten werden (angemeldet als: marius). Fehler: Transaktion konnte nicht durchgeführt werden. [marius@eve ~]$ Actual results: root password is not asked to install a package Expected results: root password is asked OR the entire request context is skipped, because the user does not have admin rights. Additional info: The user "marius" is the "default" user to open the desktop session with, which means hes autologgedin.
wasn't there "private" flag once, to set bugs as security sensitive?
I don't think this has anything to do with bash-completion, and I believe the command not found -> install bash hook is actually implemented in PackageKit, not dnf. Reassigning for comments if the described functionality is intentional (please re-reassign to something else if PK is not the correct component).
It is by design for 'admin' users (members of wheel group), see: https://fedoraproject.org/wiki/Privilege_escalation_policy In particular, "Add, remove, or downgrade any system-wide application or shared resource (packaged or otherwise), with the exception that for installing Fedora-signed packages from administrator-configured repositories, the requirement to ask for a password is waived for members of the wheel group who are local and active."