Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189791

Re: Embarrassing security bug in systemd

From Brian <ad44@cityscape.co.uk>
Newsgroups linux.debian.user
Subject Re: Embarrassing security bug in systemd
Date 2017-12-11 15:10 +0100
Message-ID <uVwWm-6eX-11@gated-at.bofh.it> (permalink)
References (5 earlier) <uUWSS-8fe-13@gated-at.bofh.it> <uV6fw-5TZ-9@gated-at.bofh.it> <uV6Se-6nS-9@gated-at.bofh.it> <uV87E-73G-3@gated-at.bofh.it> <uVboS-P9-19@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Sun 10 Dec 2017 at 15:52:30 +0100, Dejan Jocic wrote:

> On 10-12-17, Joe wrote:
> > 
> > I thought you might find more examples helpful. The man page says that
> > policies come from /etc/polkit-1 and /var/lib/polkit-1, but on my
> > system the /var/lib location is almost empty, and there's a lot
> > in /usr/share/polkit-1, almost nothing in /etc/polkit-1.
> > 
> 
> And, like I've said, thank you for your time. But those examples are all
> policy files and local settings are done under
> /etc/polkit-1/localauthority.conf.d/ for configuring which users, groups
> or netgroups will be considered as admins for authentication, and under
> /etc/polkit-1/localauthority/ directories with .pkla extension files
> should be used for overriding policies with local settings. At least it
> goes like that as far as I could deduct from man pages ( anyone thinking
> that I did not understood that well, please correct me ). Now, files

Your understanding is at least as good or better than mine (which isn't
itself magnificent).

> under /etc/polkit-1/localauthority.conf.d/ I understand, or at least
> believe so. What I'm still searching for is better understanding of
> those .pkla files. I've read those man pages some time ago, when I've
> started with attempts to wrap my head around policikit, but was rather
> busy after that and did not completely finish with it. If I understood
> it right, about any .pkla file should look something like this:

I think this is correct.

>   [ Description of what it does ]
>   Identity=unix-user:someuser;unix-user:someotheruser;unix-group:somegroup;unix-group:someothergroup;unix-netgroup:somegroup;unix-netgroup:someothergroup
>   Action=something.from.usr.share.polkit-1.actions
>   ResultAny=no/yes/auth_self/auth_admin/auth_self_keep/auth_admin_keep
>   ResultInactivee=same/options/as/above
>   ResultActive=same/options/as/above

At least one of the last three lines is needed. But three is ok.

> Now, what I believe is that for Identity and Action wildecards are
> allowed and that there are no more options aside from ResultAny,

The manual mentions globs.

> ResultInactive and ResultActive that can follow Action part. And that
> no, yes or other values will be returned to Defaults section in that
> policy file defined under Action part and change whatever was defined
> there. If someone with greater understanding of Polkit could tell me if
> I got it right, or not, that would be great. In case that I did not get
> that right, any point in right direction, or explanation would be great
> too.

The best way to understand is to ask for or give a specific example.

Suppose Urs Thuermann has got over the shock his 10 years old son's
actions gave him and he wanted never to experience such horror again.

[No user rebooting, powering off etc]
Identity=unix-user:*
Action=org.freedesktop.login1.*
ResultAny=no
ResultActive=no
ResultInactive=no

should do it.

That still leaves CTRL+ALT+DEL from a tty to be taken care of.

-- 
Brian.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Embarrassing security bug in systemd Urs Thuermann <urs@isnogud.escape.de> - 2017-12-06 23:20 +0100
  Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-06 23:50 +0100
    Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-07 00:40 +0100
      Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
        Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-07 07:30 +0100
  Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-06 23:50 +0100
    Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-07 10:40 +0100
      Re: Embarrassing security bug in systemd Tixy <tixy@yxit.co.uk> - 2017-12-07 11:30 +0100
        Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-07 11:50 +0100
          Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-09 03:50 +0100
            Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 17:50 +0100
              Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-10 10:00 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
      Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-07 11:40 +0100
      Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 16:00 +0100
        Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 20:30 +0100
          Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 09:20 +0100
          Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 12:40 +0100
            Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 13:40 +0100
              Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 21:40 +0100
            Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 17:10 +0100
              Re: Embarrassing security bug in systemd Curt <curty@free.fr> - 2017-12-08 19:10 +0100
              Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:40 +0100
              Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:50 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 20:50 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-08 21:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 11:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 19:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-09 20:30 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 22:00 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 00:40 +0100
                Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 10:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 11:20 +0100
                Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 12:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 16:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 15:10 +0100
                Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-09 21:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 21:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-08 22:30 +0100
                Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-09 02:50 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 06:50 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
                Re: Embarrassing security bug in systemd Christian Seiler <christian@iwakd.de> - 2017-12-15 13:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-15 14:10 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-15 16:00 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 22:40 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 00:30 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-09 10:00 +0100
        Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-08 10:00 +0100
      Re: Embarrassing security bug in systemd Cindy-Sue Causey <butterflybytes@gmail.com> - 2017-12-08 23:40 +0100
        Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 00:30 +0100
          Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 01:20 +0100
            Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 11:40 +0100
              Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 15:30 +0100
                Re: Embarrassing security bug in systemd The Wanderer <wanderer@fastmail.fm> - 2017-12-10 01:00 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 22:20 +0100
              Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 17:50 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 21:20 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 12:00 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 17:10 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 21:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 00:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 00:50 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 12:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 13:40 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 14:40 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 21:50 +0100
                Re: Embarrassing security bug in systemd Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2017-12-11 13:00 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 13:40 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 16:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 01:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 04:40 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 06:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 07:40 +0100
                Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 15:40 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) Darac Marjal <mailinglist@darac.org.uk> - 2017-12-11 16:00 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) Joe <joe@jretrading.com> - 2017-12-11 16:30 +0100
                Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-11 17:40 +0100
                Re: Rust? (and a wordsmithing question) David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 20:10 +0100
                Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 09:30 +0100
                Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-12 17:30 +0100
                Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 17:50 +0100
                Re: Rust? (and a wordsmithing question) Curt <curty@free.fr> - 2017-12-12 18:20 +0100
                Re: Rust? (and a wordsmithing question) Richard Hector <richard@walnut.gen.nz> - 2017-12-13 04:40 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) David Wright <deblis@lionunicorn.co.uk> - 2017-12-12 19:10 +0100
                UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Jason <electron@emypeople.net> - 2018-01-09 05:10 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 16:00 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Roberto C. Sánchez <roberto@debian.org> - 2018-01-09 16:30 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 18:10 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Erik Christiansen <dvalin@internode.on.net> - 2018-01-10 04:50 +0100
          Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-09 01:40 +0100
            Re: Embarrassing security bug in systemd Mark Fletcher <mark27q1@gmail.com> - 2017-12-09 03:10 +0100
              Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 10:50 +0100
        Re: Embarrassing security bug in systemd Ric Moore <wayward4now@gmail.com> - 2017-12-09 16:40 +0100
          Re: Embarrassing security bug in systemd Tom Furie <tom@furie.org.uk> - 2017-12-09 17:10 +0100
            Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-09 22:10 +0100
          Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
  Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 00:00 +0100
    Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-07 09:40 +0100
  Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-07 00:10 +0100
  Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-07 00:10 +0100
    Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
  Re: Embarrassing security bug in systemd Michael Lange <klappnase@freenet.de> - 2017-12-07 00:20 +0100
    Re: Embarrassing security bug in systemd "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-07 00:50 +0100
      Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 01:20 +0100
        Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
      Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 02:10 +0100
        Re: Embarrassing security bug in systemd Nicholas Geovanis <nickgeovanis@gmail.com> - 2017-12-07 03:40 +0100
          Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
    Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 00:50 +0100
      Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-07 02:40 +0100
      Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 10:40 +0100
        Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-08 13:40 +0100
          Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 20:10 +0100
  Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 01:10 +0100
  Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
  Re: Embarrassing security bug in systemd David Baron <dbaron770@gmail.com> - 2017-12-07 08:50 +0100

csiph-web