Bug 1215948 - AUDIT-WHITELIST: fudo: polkit rules drop-in files for sudo-like machinectl container frontend
Summary: AUDIT-WHITELIST: fudo: polkit rules drop-in files for sudo-like machinectl co...
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-04 14:24 UTC by Ludwig Nussel
Modified: 2023-10-16 13:03 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Matthias Gerstner 2023-10-05 12:18:06 UTC
So this is just a small shell wrapper around `machinectl` and some Polkit rule
files that allow members of a configurable group to pass polkit authentication
for the 'org.freedesktop.machine1.host-shell' Polkit action.

The sub packages fudo-policy-noauth-wheel and fudo-policy-selfauth-wheel allow
members of wheel to pass this check without password or with the calling
user's password.

I'm not sure about the choice of group, as we have discussed in another bug
recently wheel is currently only used as an exception in Flatpak and then in
the new openSUSE Aeon where they aim for a "single desktop user -equals-
Admin" approach.

Do we want to start overloading `wheel` for different things or would it make
more sense to have a dedicated group for `fudo`?
Comment 2 Ludwig Nussel 2023-10-05 12:32:04 UTC
wheel is not meant to be used at all by the OS vendor *by default*. This must be up to the admin to decide. Doesn't mean we can't offer a an optional(!) package instead of requiring edits in /etc. I'd add a subpackage requiring system-group-sudo once once the new sudo setup is in Factory.

Flatpak and Aeon need to be fixed to not use the wheel group *by default*.
Comment 3 Matthias Gerstner 2023-10-05 13:13:08 UTC
Agreed. I will submit whitelistings for your package.
Comment 4 Matthias Gerstner 2023-10-06 08:16:43 UTC
The changes will likely be submitted to Factory's rpmlint today.
Comment 6 Matthias Gerstner 2023-10-16 13:03:11 UTC
The whitelisting should be effective, closing as fixed.