Bugzilla – Bug 1226424
AUDIT-WHITELIST: powerdevil6: New polkit actions for battery conservation mode (charge limit)
Last modified: 2024-07-05 12:42:10 UTC
Package: https://build.opensuse.org/package/show/KDE:Frameworks/powerdevil6 (but to allow TW inclusion it'll be disabled there temporarily) rpmlint complaint: [ 94s] powerdevil6.x86_64: E: polkit-user-privilege (Badness: 10000) org.kde.powerdevil.chargethresholdhelper.getconservationmode (no:yes:yes) [ 94s] The package allows unprivileged users to carry out privileged operations [ 94s] without root authentication. This could cause security problems if not done [ 94s] carefully. If the package is intended for inclusion in any SUSE product please [ 94s] open a bug report to request review of the package by the security team. [ 94s] Please refer to [ 94s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 94s] more information. [ 94s] [ 94s] powerdevil6.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.kde.powerdevil.chargethresholdhelper.setconservationmode (no:no:auth_admin_keep) [ 94s] The polkit action is not listed in the polkit-default-privs profiles which [ 94s] makes it harder for admins to find. Furthermore improper polkit authorization [ 94s] checks can easily introduce security issues. If the package is intended for [ 94s] inclusion in any SUSE product please open a bug report to request review of [ 94s] the package by the security team. Please refer to [ 94s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 94s] more information. Code: https://invent.kde.org/plasma/powerdevil/-/blob/master/daemon/chargethresholdhelper.cpp
This should not take long to review. There's a bit of backlog in the team currently though, so it may still take a bit before we can take care of it.
I've reviewed powerdevil the last couple of times so I'll have a look. Shouldn't take too long.
These new D-Bus methods are more or less trivial. I'll start the polkit whitelisting.
the whitelisting in now in Factory, closing this bug as fixed