|
Bugzilla – Full Text Bug Listing |
| Summary: | AUDIT-0: Flatpak / polkit permissions need to be reviewed | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Dominique Leuenberger <dimstar> |
| Component: | Audits | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | adrien.plazas, astieger, dimstar, fcrozat, krahmer, meissner, sreeves, zaitor |
| Version: | unspecified | ||
| Target Milestone: | unspecified | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Dominique Leuenberger
2016-12-01 09:03:45 UTC
Is this a dup of bnc#984817 ? Or are there any new permissions being asked for? (In reply to Sebastian Krahmer from comment #1) > Is this a dup of bnc#984817 ? Or are there any new permissions being asked > for? Oh - I was under the impression that bug had been solved already (as the permission set was added to polkit default privs) This request is basically to 'losen up' some of the restrictions in the current config set; as boo#984817 is not yet closed, that can of course be merged. What is the status here ? Due to this not being fixed, you get random root prompt if you have one flatpak application, since GNOME Software periodically try to check for updates. (In reply to Frederic Crozat from comment #3) > What is the status here ? > > Due to this not being fixed, you get random root prompt if you have one > flatpak application, since GNOME Software periodically try to check for > updates. By "root prompt" you talk about polkit is asking you to authenticate yourself as root? Not like a root prompt from bash# (In reply to Sebastian Krahmer from comment #4) > (In reply to Frederic Crozat from comment #3) > > What is the status here ? > > > > Due to this not being fixed, you get random root prompt if you have one > > flatpak application, since GNOME Software periodically try to check for > > updates. > > By "root prompt" you talk about polkit is asking you to authenticate > yourself as root? Not like a root prompt from bash# Yes, sorry, the gnome-shell polkit prompt, which is system modal. Current version of flatpak in GN have a new polkit issue flatpak.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.freedesktop.Flatpak.update-remote (auth_admin:auth_admin:yes) There is also flatpak.x86_64: I: polkit-untracked-privilege org.freedesktop.Flatpak.install-bundle (auth_admin:auth_admin:auth_admin_keep) The privilege is not listed in /etc/polkit-default-privs.* that would be nice to get resolved I think we currently can't approve flatpak. There are too many weird things they do, such as: https://github.com/flatpak/flatpak/issues/845 (CVE-2017-9780) Which was to be expected and its likely that other similar issues will appear. IMHO, the state of current Linux sandboxíng for containerized apps from 3rd party repos is insufficient. (In reply to Sebastian Krahmer from comment #7) > I think we currently can't approve flatpak. Do you mean we shouldn't have Flatpak at all or we could have it but without the polkit rules and despite the poor user experience? I'd like to see both additional polkit rules to be cleared by security team, as we have plans to ship flatpak in SLED15. flatpak.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.freedesktop.Flatpak.update-remote (auth_admin:auth_admin:yes) This one is to allow refreshing a repository which was added previously with admin privilege. This is similar to org.freedesktop.packagekit.system-sources-refresh . I would suggest similar defaults flatpak.x86_64: I: polkit-untracked-privilege org.freedesktop.Flatpak.install-bundle (auth_admin:auth_admin:auth_admin_keep) The privilege is not listed in /etc/polkit-default-privs.* This one is similar to Yast 1click install. I would suggest similar defaults as org.freedesktop.packagekit.package-install Thanks This is an autogenerated message for OBS integration: This bug (1012961) was mentioned in https://build.opensuse.org/request/show/518380 Factory / polkit-default-privs closed as resolved |