Bug 1221094 - AUDIT-WHITELIST: libvirt: Review new polkit permissions for node device save
Summary: AUDIT-WHITELIST: libvirt: Review new polkit permissions for node device save
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-06 22:35 UTC by James Fehlig
Modified: 2024-03-15 11:50 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description James Fehlig 2024-03-06 22:35:21 UTC 
libvifrt commit 6e36f266514 introduced a new polkit rule for node-device.save operation that has been flagged by rpmlint

[  264s] libvirt-daemon-common.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.node-device.save (no:no:no)

I suppose it needs reviewed and whitelisted, similar to past occurrences such as bug#1186270.
Comment 1 Matthias Gerstner 2024-03-07 10:45:49 UTC 
This libvirt authentication layer is strange, a lot of these no:no:no actions.
I wonder if anybody uses this stuff. We will have a look though and adjust
our polkit-default-privs.
Comment 2 Matthias Gerstner 2024-03-07 14:32:36 UTC 
The change was introduced in version 10.1.0 via upstream commit
69f9e7dbc24657e85761f03574779540d0f18315.

It is just an incremental addition, a save method for node device objects that
hasn't been implemented before. Nothing in the underlying authentication
framework changes due to this.

The no:no:no setting is as safe as it can get so I'll whitelist it.
Comment 3 Matthias Gerstner 2024-03-07 16:10:05 UTC 
The whitelisting process started.
Comment 4 OBSbugzilla Bot 2024-03-07 17:35:10 UTC 
This is an autogenerated message for OBS integration:
This bug (1221094) was mentioned in
https://build.opensuse.org/request/show/1156045 Factory / polkit-default-privs
Comment 5 James Fehlig 2024-03-07 18:08:59 UTC 
(In reply to Matthias Gerstner from comment #3)
> The whitelisting process started.

Thanks a lot!

As for your question about anybody using this stuff: I'm not aware of anyone using polkit to restrict access to individual objects or their operations. Maybe it's better said that I haven't seen any related bug reports :-). I suspect polkit is primarily used to authenticate the initial connection.
Comment 7 Matthias Gerstner 2024-03-15 11:50:06 UTC 
the whitelisting is in Factory now