Allow for easy escalation to root in AppVM

[marmarek]

Reported by joanna on 6 Apr 2011 13:30 UTC
Should work for:

• sudo bash
• system-config-date

Add explanation why this is a good idea and not a security breach.

Migrated-From: https://wiki.qubes-os.org/ticket/202

[marmarek]

Modified by marmarek on 6 Apr 2011 14:06 UTC

[marmarek]

Modified by marmarek on 6 Apr 2011 14:06 UTC

[marmarek]

Comment by marmarek on 6 Apr 2011 21:06 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=8047ec780a44c6b538b412e0173152045ab82191

[marmarek]

Comment by marmarek on 6 Apr 2011 21:06 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=8047ec780a44c6b538b412e0173152045ab82191

[marmarek]

Comment by joanna on 6 Apr 2011 21:48 UTC
This doesn't work for gpk-application, one of the most important app on a templateVM...

When I open gpk-aplication and then choose "Refresh package list" from the menu, it throws an authorization failure message.

Interestingly e.g. system-config-date works just fine.

[marmarek]

Comment by joanna on 6 Apr 2011 21:48 UTC
This doesn't work for gpk-application, one of the most important app on a templateVM...

When I open gpk-aplication and then choose "Refresh package list" from the menu, it throws an authorization failure message.

Interestingly e.g. system-config-date works just fine.

[marmarek]

Comment by marmarek on 7 Apr 2011 22:50 UTC
This requires forcing ConsoleKit to think that our X session is local.
Perhaps implement own ck-xinit-session?

[marmarek]

Comment by marmarek on 7 Apr 2011 22:50 UTC
This requires forcing ConsoleKit to think that our X session is local.
Perhaps implement own ck-xinit-session?

[marmarek]

Comment by marmarek on 7 Apr 2011 22:53 UTC
When done - remove workaround for nm-applet (/etc/dbus-1/system.d/qubes-nm-applet.conf and sed on /usr/share/polkit-1/actions/...)

[marmarek]

Comment by marmarek on 7 Apr 2011 22:53 UTC
When done - remove workaround for nm-applet (/etc/dbus-1/system.d/qubes-nm-applet.conf and sed on /usr/share/polkit-1/actions/...)

[marmarek]

Modified by joanna on 7 Apr 2011 23:03 UTC

[marmarek]

Modified by joanna on 7 Apr 2011 23:03 UTC

[marmarek]

Modified by joanna on 17 Apr 2011 16:07 UTC

[marmarek]

Modified by joanna on 17 Apr 2011 16:07 UTC

[marmarek]

Comment by marmarek on 29 Apr 2011 10:33 UTC
ck-xinit-session-qubes does the work - ConsoleKit session is set up properly as "local" and "active". I've removed workaround for nm-applet. For other applications which asks for root password, we should remove root password.

Unfortunately polkit-gnome-authentication-agent is still needed, just to (automatically) respond with empty password... When user tries to do some privileged task (i.e. install package), password prompt shows for a (almost unnoticeable) moment.

[marmarek]

Comment by marmarek on 29 Apr 2011 10:33 UTC
ck-xinit-session-qubes does the work - ConsoleKit session is set up properly as "local" and "active". I've removed workaround for nm-applet. For other applications which asks for root password, we should remove root password.

Unfortunately polkit-gnome-authentication-agent is still needed, just to (automatically) respond with empty password... When user tries to do some privileged task (i.e. install package), password prompt shows for a (almost unnoticeable) moment.

[marmarek]

Comment by marmarek on 12 May 2011 17:24 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=bb073c3cdb91775eef966d8bc4f9d4299da7f9ca

[marmarek]

Comment by marmarek on 12 May 2011 17:24 UTC
http://git.qubes-os.org/gitweb/?p=marmarek/core.git;a=commit;h=bb073c3cdb91775eef966d8bc4f9d4299da7f9ca