Bugzilla – Bug 849739
AUDIT-0: kwalletmanager: Security Review requested due to suse-dbus-unauthorized-service, polkit-untracked-privilege and polkit-cant-acquire-privilege
Last modified: 2015-01-29 16:54:00 UTC
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36 SUSE/31.0.1650.48 Due to changes in kwalletmanager for KDE's 4.12 release, we're requesting whitelisting the following: kwalletmanager.i586: E: suse-dbus-unauthorized-service (Badness: 100) /usr/share/dbus-1/system-services/org.kde.kcontrol.kcmkwallet.service kwalletmanager.i586: E: suse-dbus-unauthorized-service (Badness: 100) /etc/dbus-1/system.d/org.kde.kcontrol.kcmkwallet.conf The package installs a DBUS system service file. If the package is intended for inclusion in any SUSE product please open a bug report to request review of the service by the security team. kwalletmanager.i586: E: polkit-unauthorized-privilege (Badness: 100) org.kde.kcontrol.kcmkwallet.save (??:no:auth_self_keep) The package allows unprivileged users to carry out privileged operations without authentication. This could cause security problems if not done carefully. If the package is intended for inclusion in any SUSE product please open a bug report to request review of the package by the security team kwalletmanager.i586: I: polkit-cant-acquire-privilege org.kde.kcontrol.kcmkwallet.save (??:no:auth_self_keep) Usability can be improved by allowing users to acquire privileges via authentication. Use e.g. 'auth_admin' instead of 'no' and make sure to define 'allow_any'. This is an issue only if the privilege is not listed in /etc /polkit-default-privs.* Changes are introduced with this commit: http://quickgit.kde.org/?p=kwallet.git&a=commit&h=717f925b77f13c54e92ecd81ea92487f933a1915 Reproducible: Always
Is it really necessary to run the kwallet as a DBUS _system_ service? Also, the function that requires the polkit action is just a dummy: ActionReply SaveHelper::save(QVariantMap args) { __uid_t uid = getuid(); kDebug() << "executing uid=" << uid; return ActionReply::SuccessReply; } Its from their git. Do we really need that?? From my understanding a wallet is something that should run in the user session, therefore a DBUS session bus?!
Contacted upstream, maybe they can shine some light.
Can you paste the org.kde.kcontrol.kcmkwallet.conf that you want to use? It seems not to be part of the kwallet git.
Sorry for a late reply, (In reply to comment #3) > Can you paste the org.kde.kcontrol.kcmkwallet.conf that you > want to use? It seems not to be part of the kwallet git. /etc/dbus-1/system.d/org.kde.kcontrol.kcmkwallet.conf <!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN" "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd"> <busconfig> <!-- Only user root can own the foo helper --> <policy user="root"> <allow own="org.kde.kcontrol.kcmkwallet"/> </policy> </busconfig> /usr/share/dbus-1/system-services/org.kde.kcontrol.kcmkwallet.service [D-BUS Service] Name=org.kde.kcontrol.kcmkwallet Exec=/usr/lib64/kde4/libexec/kcm_kwallet_helper User=root
This is an autogenerated message for OBS integration: This bug (849739) was mentioned in https://build.opensuse.org/request/show/207761 Factory / polkit-default-privs
done
(In reply to comment #6) > done Hm, we still have: [ 43s] kwalletmanager.x86_64: E: suse-dbus-unauthorized-service (Badness: 10000) /usr/share/dbus-1/system-services/org.kde.kcontrol.kcmkwallet.service [ 43s] kwalletmanager.x86_64: E: suse-dbus-unauthorized-service (Badness: 10000) /etc/dbus-1/system.d/org.kde.kcontrol.kcmkwallet.conf Rpmlint not yet submitted?
Hrvoje, Keep in mind that KDF is building against snapshot and NOT against standard. As long as snapshot is not being updated from standard, then we will be keep facing the indicated issue. Until that time we also cannot submit kwalletmanager as that ti either doesn't build or it contains a rpmlint which is not allowed.
This is an autogenerated message for OBS integration: This bug (849739) was mentioned in https://build.opensuse.org/request/show/208293 Factory / rpmlint
This is an autogenerated message for OBS integration: This bug (849739) was mentioned in https://build.opensuse.org/request/show/225713 Factory / polkit-default-privs