Bug 1215948

Summary:	AUDIT-WHITELIST: fudo: polkit rules drop-in files for sudo-like machinectl container frontend
Product:	[openSUSE] openSUSE Tumbleweed	Reporter:	Ludwig Nussel <lnussel>
Component:	Security	Assignee:	Matthias Gerstner <matthias.gerstner>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None
Version:	Current
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Ludwig Nussel 2023-10-04 14:24:54 UTC

Sudo like alias that works with machined:
https://build.opensuse.org/request/show/1113798

https://build.opensuse.org/package/view_file/security/fudo/30-fudo-machinectl-shell.rules

Comment 1 Matthias Gerstner 2023-10-05 12:18:06 UTC

So this is just a small shell wrapper around `machinectl` and some Polkit rule
files that allow members of a configurable group to pass polkit authentication
for the 'org.freedesktop.machine1.host-shell' Polkit action.

The sub packages fudo-policy-noauth-wheel and fudo-policy-selfauth-wheel allow
members of wheel to pass this check without password or with the calling
user's password.

I'm not sure about the choice of group, as we have discussed in another bug
recently wheel is currently only used as an exception in Flatpak and then in
the new openSUSE Aeon where they aim for a "single desktop user -equals-
Admin" approach.

Do we want to start overloading `wheel` for different things or would it make
more sense to have a dedicated group for `fudo`?

Comment 2 Ludwig Nussel 2023-10-05 12:32:04 UTC

wheel is not meant to be used at all by the OS vendor *by default*. This must be up to the admin to decide. Doesn't mean we can't offer a an optional(!) package instead of requiring edits in /etc. I'd add a subpackage requiring system-group-sudo once once the new sudo setup is in Factory.

Flatpak and Aeon need to be fixed to not use the wheel group *by default*.

Comment 3 Matthias Gerstner 2023-10-05 13:13:08 UTC

Agreed. I will submit whitelistings for your package.

Comment 4 Matthias Gerstner 2023-10-06 08:16:43 UTC

The changes will likely be submitted to Factory's rpmlint today.

Comment 6 Matthias Gerstner 2023-10-16 13:03:11 UTC

The whitelisting should be effective, closing as fixed.