Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #189737
| From | Dejan Jocic <jodejka@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Embarrassing security bug in systemd |
| Date | 2017-12-10 00:40 +0100 |
| Message-ID | <uUWSS-8fe-13@gated-at.bofh.it> (permalink) |
| References | (5 earlier) <uUImR-7D2-5@gated-at.bofh.it> <uUKoF-mw-15@gated-at.bofh.it> <uUScx-5ew-1@gated-at.bofh.it> <uUSYW-5Q5-5@gated-at.bofh.it> <uUUo1-6zq-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 09-12-17, Brian wrote:
> On Sat 09 Dec 2017 at 20:07:17 +0100, Dejan Jocic wrote:
>
> > On 09-12-17, Jonathan Dowland wrote:
> > > On Sat, 2017-12-09 at 10:00 +0000, Brian wrote:
> > > > Consistencey can be achieved by not installing policykit. The OP
> > > > appears to have chosen the wrong target.Consistencey can be achieved > by not installing policykit.
> > >
> > > As Michael pointed out in [1], that's not the case; prior to polkit,
> > > there was no consistency.
> > >
> > >
> > > [1] <8430b277-3757-8261-0e1e-23e274a0b49a@debian.org>
> > >
> >
> > Is it anywhere in Debian documentation described how to achieve
> > consistency in a way different than current defaults? Or, even better,
> > is there way that we could get some kind of configuration option to
> > achieve it? Polkit does not really have user friendly configuration and
> > is not really something that system administrators configure on a
> > everyday bases. At least not in my experience. Only thing that I did
> > find about configuring polkit was from some other distros. Debian wiki
> > page about PolicyKit is not really helpful.
>
> Apart from not installing policykit, setting allow_active to "no" in
> /usr/share/polkit-1/actions/org.freedesktop.login1.policy would do it.
>
> Much better is to use /etc/polkit-1/localauthority. See the manual for
> pklocalauthority.
>
> --
> Brian.
>
Man page for pklocalauthority is bit more helpful, but far from self
explanatory. In its examples section, it provides some insight about
writing .pkla files, but it does not show all possible options, or at
least I can't be sure that it does. For example:
[Exclude Some Problematic Users]
Identity=unix-user:homer;unix-user:grimes
Action=com.example.awesomeproduct.*
ResultAny=no
ResultInactive=no
ResultActive=auth_admin
According to that, and after reading man page for polkit, I can only
deduct that .pkla file will for that example in that
com.example.awesomeproduct.* files reads lines under defaults and
"answer" on allow_any and allow_inactive with no value and on
allow_active with auth_admin value. Fine, that can work. Guess that you
can use wildecards for all users, like unix-user:*, but that is only
guess, cause I can't see it documented anywhere ( might have missed it).
What I also do not see anywhere is if those are the only options
available? Or there is some man page, or additional documentation in
Debian that can explain that?
Thank you for your time,
Dejan
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Embarrassing security bug in systemd Urs Thuermann <urs@isnogud.escape.de> - 2017-12-06 23:20 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-06 23:50 +0100
Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-07 00:40 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-07 07:30 +0100
Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-06 23:50 +0100
Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-07 10:40 +0100
Re: Embarrassing security bug in systemd Tixy <tixy@yxit.co.uk> - 2017-12-07 11:30 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-07 11:50 +0100
Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-09 03:50 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 17:50 +0100
Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-10 10:00 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-07 11:40 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 16:00 +0100
Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 20:30 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 09:20 +0100
Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 12:40 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 13:40 +0100
Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 21:40 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 17:10 +0100
Re: Embarrassing security bug in systemd Curt <curty@free.fr> - 2017-12-08 19:10 +0100
Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:40 +0100
Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:50 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 20:50 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-08 21:20 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 11:20 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 19:40 +0100
Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-09 20:30 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 22:00 +0100
Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 00:40 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 10:40 +0100
Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 11:20 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 12:40 +0100
Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 16:10 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 15:10 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-09 21:10 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 21:10 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-08 22:30 +0100
Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-09 02:50 +0100
Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 06:50 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:20 +0100
Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
Re: Embarrassing security bug in systemd Christian Seiler <christian@iwakd.de> - 2017-12-15 13:30 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-15 14:10 +0100
Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-15 16:00 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 22:40 +0100
Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 00:30 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-09 10:00 +0100
Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-08 10:00 +0100
Re: Embarrassing security bug in systemd Cindy-Sue Causey <butterflybytes@gmail.com> - 2017-12-08 23:40 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 00:30 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 01:20 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 11:40 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 15:30 +0100
Re: Embarrassing security bug in systemd The Wanderer <wanderer@fastmail.fm> - 2017-12-10 01:00 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 22:20 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 17:50 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 21:20 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 12:00 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 17:10 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 21:30 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 00:10 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 00:50 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 12:30 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 13:40 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 14:40 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 21:50 +0100
Re: Embarrassing security bug in systemd Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2017-12-11 13:00 +0100
Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 13:40 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 16:30 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 01:30 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 04:40 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 06:10 +0100
Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 07:40 +0100
Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 15:40 +0100
Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) Darac Marjal <mailinglist@darac.org.uk> - 2017-12-11 16:00 +0100
Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) Joe <joe@jretrading.com> - 2017-12-11 16:30 +0100
Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-11 17:40 +0100
Re: Rust? (and a wordsmithing question) David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 20:10 +0100
Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 09:30 +0100
Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-12 17:30 +0100
Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 17:50 +0100
Re: Rust? (and a wordsmithing question) Curt <curty@free.fr> - 2017-12-12 18:20 +0100
Re: Rust? (and a wordsmithing question) Richard Hector <richard@walnut.gen.nz> - 2017-12-13 04:40 +0100
Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) David Wright <deblis@lionunicorn.co.uk> - 2017-12-12 19:10 +0100
UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in systemd) Jason <electron@emypeople.net> - 2018-01-09 05:10 +0100
Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 16:00 +0100
Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in systemd) Roberto C. Sánchez <roberto@debian.org> - 2018-01-09 16:30 +0100
Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 18:10 +0100
Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in systemd) Erik Christiansen <dvalin@internode.on.net> - 2018-01-10 04:50 +0100
Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-09 01:40 +0100
Re: Embarrassing security bug in systemd Mark Fletcher <mark27q1@gmail.com> - 2017-12-09 03:10 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 10:50 +0100
Re: Embarrassing security bug in systemd Ric Moore <wayward4now@gmail.com> - 2017-12-09 16:40 +0100
Re: Embarrassing security bug in systemd Tom Furie <tom@furie.org.uk> - 2017-12-09 17:10 +0100
Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-09 22:10 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 00:00 +0100
Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-07 09:40 +0100
Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-07 00:10 +0100
Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-07 00:10 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
Re: Embarrassing security bug in systemd Michael Lange <klappnase@freenet.de> - 2017-12-07 00:20 +0100
Re: Embarrassing security bug in systemd "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-07 00:50 +0100
Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 01:20 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 02:10 +0100
Re: Embarrassing security bug in systemd Nicholas Geovanis <nickgeovanis@gmail.com> - 2017-12-07 03:40 +0100
Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 00:50 +0100
Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-07 02:40 +0100
Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 10:40 +0100
Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-08 13:40 +0100
Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 20:10 +0100
Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 01:10 +0100
Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
Re: Embarrassing security bug in systemd David Baron <dbaron770@gmail.com> - 2017-12-07 08:50 +0100
csiph-web