Bug 1226424 - AUDIT-WHITELIST: powerdevil6: New polkit actions for battery conservation mode (charge limit)
Summary: AUDIT-WHITELIST: powerdevil6: New polkit actions for battery conservation mod...
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-17 09:38 UTC by Fabian Vogt
Modified: 2024-07-05 12:42 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Fabian Vogt 2024-06-17 09:38:02 UTC
Package: https://build.opensuse.org/package/show/KDE:Frameworks/powerdevil6 (but to allow TW inclusion it'll be disabled there temporarily)

rpmlint complaint:

[   94s] powerdevil6.x86_64: E: polkit-user-privilege (Badness: 10000) org.kde.powerdevil.chargethresholdhelper.getconservationmode (no:yes:yes)
[   94s] The package allows unprivileged users to carry out privileged operations
[   94s] without root authentication. This could cause security problems if not done
[   94s] carefully. If the package is intended for inclusion in any SUSE product please
[   94s] open a bug report to request review of the package by the security team.
[   94s] Please refer to
[   94s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   94s] more information.
[   94s] 
[   94s] powerdevil6.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.kde.powerdevil.chargethresholdhelper.setconservationmode (no:no:auth_admin_keep)
[   94s] The polkit action is not listed in the polkit-default-privs profiles which
[   94s] makes it harder for admins to find. Furthermore improper polkit authorization
[   94s] checks can easily introduce security issues. If the package is intended for
[   94s] inclusion in any SUSE product please open a bug report to request review of
[   94s] the package by the security team. Please refer to
[   94s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   94s] more information.

Code: https://invent.kde.org/plasma/powerdevil/-/blob/master/daemon/chargethresholdhelper.cpp
Comment 1 Matthias Gerstner 2024-06-17 10:16:12 UTC
This should not take long to review. There's a bit of backlog in the team
currently though, so it may still take a bit before we can take care of it.
Comment 2 Matthias Gerstner 2024-06-19 12:03:07 UTC
I've reviewed powerdevil the last couple of times so I'll have a look.
Shouldn't take too long.
Comment 3 Matthias Gerstner 2024-06-19 12:20:07 UTC
These new D-Bus methods are more or less trivial. I'll start the polkit
whitelisting.
Comment 4 Matthias Gerstner 2024-07-05 12:42:10 UTC
the whitelisting in now in Factory, closing this bug as fixed