Bug 154351

Summary: /sbin/yast2 online_update starts firefox as root
Product: [openSUSE] SUSE Linux 10.1 Reporter: Thomas Schmidt <tschmidt>
Component: YaST2Assignee: Jiří Suchomel <jsuchome>
Status: RESOLVED WONTFIX QA Contact: Klaus Kämpf <kkaempf>
Severity: Blocker    
Priority: P5 - None CC: hmuelle, meissner, security-team, suse-beta
Version: Beta 6   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Thomas Schmidt 2006-03-01 13:20:02 UTC 
Firefox is running as root when using the "online update" link from within 
the YaST control center. 
I think that's bad because most users will just leave the window open 
and use it for browsing the web. Is it neccessary to have the browser 
frontend running as root?
Comment 1 Marcus Meissner 2006-03-01 13:33:35 UTC 
This must not happen.

(This is unrelated to the register issue which uses FF too.)

What is so difficult in writing a YAST Module which speaks SOAP to zmd server?
Comment 3 Klaus Kämpf 2006-03-01 14:18:58 UTC 
This is known and it was agreed that the browser should run with least privileges.
Comment 4 J. Daniel Schmidt 2006-03-01 15:20:28 UTC 
As I understand this, it is about the online_update module not about the suse_register one.
suse_register is not part of the current beta, so he couldn't have encountered a bug in it :)
Comment 5 Jiří Suchomel 2006-03-01 15:26:58 UTC 
You understand it correctly, that's why it is for me :-)
Comment 6 Jiří Suchomel 2006-03-01 15:29:35 UTC 
I'm not sure how to handle this:
1. the process is started by root (as yast is running under root)
2. that it changes it's UID to UID of webupdater user - this works fine for webrick, but firefox than hasn't rights to X server. How should I give it such rights only for this session?
Comment 8 Jiří Suchomel 2006-03-06 10:28:10 UTC 
"If /usr/sbin/web-updater-starter is running as a
root (and if USERNAME env.variable relly points to the user actually ownning
the X server rights) it could start firefox via 'sux
#{ENV['USERNAME']} -c firefox' "

Marcus, is this solution correct?
(comment taken from bug #154948)
Comment 9 Jiří Suchomel 2006-03-09 14:19:23 UTC 
Please check also this one, I don't know if the solution with USERNAME is correct.
Comment 10 Jiří Suchomel 2006-03-14 08:52:54 UTC 
later
Comment 11 Jiří Suchomel 2006-11-01 09:51:13 UTC 
reopening web-updater related bugs
Comment 12 Jiří Suchomel 2006-11-01 09:52:02 UTC 
We have no web-updater, closing as irrelevant.