Bug 1215652 - AUDIT-0: polkit: please whitelist polkit rule change
Summary: AUDIT-0: polkit: please whitelist polkit rule change
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Wolfgang Frisch
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-25 07:31 UTC by Ludwig Nussel
Modified: 2023-12-08 12:11 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2023-09-25 07:31:20 UTC
https://build.opensuse.org/request/show/1112333

see jsc#PED-260


[   52s] polkit.x86_64: E: polkit-file-digest-mismatch (Badness: 10000) /usr/share/polkit-1/rules.d/50-default.rules expected sha256:aea3041de2c15db8683620de8533206e50241c309eb27893605d5ead17e5e75f, has:3b5781af8a450c5184c7a2d5408f4af7d3c65f23548ee0962ad0eabb70072c32
[   52s] A polkit rule file changed in content. Packaging polkit rules requires a
[   52s] review and whitelisting by the SUSE security team. If the package is intended
[   52s] for inclusion in any SUSE product please open a bug report to request review
[   52s] of the package by the security team. Please refer to
[   52s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   52s] more information.
Comment 1 Wolfgang Frisch 2023-09-25 07:38:42 UTC
Thank you for the report. We will schedule this task within our team shortly.
Comment 2 Wolfgang Frisch 2023-09-25 10:37:49 UTC
This looks sensible in general.

The only remaining question is whether or where `polkit._suse_admin_groups = []` will be set to a different value.
Comment 3 Ludwig Nussel 2023-09-25 11:36:06 UTC
Planned to be used by sudo. Probably makes sense to add the checksums for those files already too:

https://build.opensuse.org/package/rdiff/home:ohollmann:branches:Remove-targetpw/sudo?opackage=sudo&oproject=Base%3ASystem&rev=14

It's 51-sudo.rules and 51-wheel.rules with checksum
6fa951c8cb81606a10bd82e6ef8e260e98cc84e68e9a49310a8a670889e31b4d
Comment 4 Ludwig Nussel 2023-09-25 11:39:24 UTC
pardon
f771f054dff80233218bb658419bed786dfc30ca35ea0d3cd1ed4855be8ae4fd  ./usr/share/polkit-1/rules.d/51-sudo.rules
6fa951c8cb81606a10bd82e6ef8e260e98cc84e68e9a49310a8a670889e31b4d  ./usr/share/polkit-1/rules.d/51-wheel.rules
Comment 5 Matthias Gerstner 2023-10-09 10:48:41 UTC
I'm not quite sure about this line in the for loop:

> rules.push("unix-group:"+g);

So if the caller is in one of the groups then only its own account is
eligible as admin. But if this is not the case then any members of that group
are eligible as admin.

So what is this supposed to do? When there are accounts A and B which are
members of an admin group and an account C which is not a member of an admin
group, then C may authenticate as either A or B or root to gain admin?

I tried to reproduce this behaviour but somehow it doesn't work, Polkit always
wants to authenticate as root, there is no user selection or anything.
Comment 6 Ludwig Nussel 2023-10-09 11:45:43 UTC
yes, I saw it behave as you describe. polkit shows a dialog that allows to select admin accounts to authenticate as. You could try launching polkitd manually in a shell to see it's debug output. maybe it gives some clues
Comment 7 Matthias Gerstner 2023-10-10 10:55:49 UTC
(In reply to lnussel@suse.com from comment #6)
> yes, I saw it behave as you describe. polkit shows a dialog that allows to select admin accounts to authenticate as. You could try launching polkitd manually in a shell to see it's debug output. maybe it gives some clues

If you've seen it work then this is good enough for me. Good to go for the
whitelisting @wfrisch.
Comment 8 Filippo Bonazzi 2023-11-13 15:04:33 UTC
https://build.opensuse.org/request/show/1125677
Comment 10 OBSbugzilla Bot 2023-11-15 10:25:04 UTC
This is an autogenerated message for OBS integration:
This bug (1215652) was mentioned in
https://build.opensuse.org/request/show/1126560 Factory / rpmlint
Comment 11 Matthias Gerstner 2023-12-08 12:11:43 UTC
The whitelisting has been in Factory for a while now. Closing as FIXED.