Bug 888083 - Guest normal account can click and initiate a Fedora 18/19 software update without submitting to password security check.
Guest normal account can click and initiate a Fedora 18/19 software update wi...
Status: CLOSED CANTFIX
Product: Fedora
Classification: Fedora
Component: up2date (Show other bugs)
rawhide
All Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Adrian Likins
Beth Nackashi
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-12-17 19:15 EST by Leslie Satenstein
Modified: 2015-02-13 16:54 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: System maintainer is responsible for all software versions and patch levels on his system. Consequence: Fix: Result:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-02-13 16:54:29 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Leslie Satenstein 2012-12-17 19:15:29 EST
Description of problem:

Normal user triggers and installs software updates with no password request.

Fedora 18 TC2 Release Candidate.

One account is with Administrator privileges
One account is with normal user privileges (title is guest)

The guest account user clicked on add/remove software, and then selected software update, which in the menu for the former.

It resulted in the automatic search for and installation of updates.

Should any regular normal user be allowed to install updates without providing the administrator password, and without being a member of the wheel group?

This means that a normal user of Fedora 18 can trigger and install updates without root or administrator's concent.


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Leslie Satenstein 2013-02-07 19:18:23 EST
Fedora 18 DVD Jan 15th version

From a guest account I am able to start a software update.  

Only via an account with root privileges (root, or via sudo) should updates be permitted.

Here is the result of my test result.

The guest account is a normal (no administrator) privileges). There is no request for authorisation.  

Start Add/remove software, 

From Software Menu icon, click on it and select Check for Updates

The result is that the linux system is updated.

Why this should not be.  

We may have some application, database, network, or business application that needs execution with the linux system as it is.

By the non-authorized user, the updates were selected and applied, and with a kernel update, a reboot was required.  This reboot caused previous program(s) to fail.

Only via root privileges should an update be permitted.
Comment 2 Leslie Satenstein 2013-03-27 21:31:17 EDT
Is my guest account (non administrator) going to initiate updates without providing a password?
Comment 3 Leslie Satenstein 2013-04-08 20:37:47 EDT
Suppose I am running an application that requires a very specific version of installed software, and the normal user selects software update. My specific version of software may be overwritten, which means that other applications that will call the reserved version could fail.

We don't stand behind the user, watching what he does. He may trigger an update.

One option-- Require software updates to always require root privileges
2nd option-- Provide a blocking option as within yum such as exclude=
3rd option-- Do not show software selection for a normal user account.


Implement or indicate if it is a do-not-fix or will be fixed, and fix it.
Comment 4 Leslie Satenstein 2013-04-08 21:07:24 EDT
This bug is a request to fix an insecurity problem.
Comment 5 Leslie Satenstein 2013-05-06 16:28:30 EDT
A standard user should not be allowed to trigger software updates. Refer to comment 3 above
Comment 6 Leslie Satenstein 2015-02-13 16:54:29 EST
if guest user issues sudo, and is not in wheel group, user is blocked.

Note You need to log in before you can comment on or make changes to this bug.