polkit and package kit and changing settings

November 18, 2009

In f12 the default policy for polkit for package kit is to allow users at the
desktop to install signed pkgs from repositories enabled on the system.

Some folks are unhappy about this so I investigated a bit. Ray Strode looked
through the polkit code to figure out the answers.

The short answer is to run (as root)

pklalockdown –lockdown org.freedesktop.packagekit.package-install

to remove this lockdown run (as root):

pklalockdown –remove-lockdown org.freedesktop.packagekit.package-install

 

Update: According davidz in the comments below the above command is going away. So if you want to keep users from installing pkgs you need to follow the longer instructions below.


the long answer explains a bit about polkit.

To get a list of all actions that policykit knows about you run:

pkaction

to get information about the system defaults for any action you run:

pkaction –action-id actionname –verbose

this only tells you what the system defaults are. It doesn’t tell you what
the current runtime policy is going to do.

examples:
pkaction –action-id org.freedesktop.packagekit.package-install –verbose

org.freedesktop.packagekit.package-install:
description:       Install signed package
message:           Authentication is required to install a signed package
vendor:            The PackageKit Project
vendor_url:        http://www.packagekit.org/
icon:              package-x-generic
implicit any:      no
implicit inactive: no
implicit active:   yes

Now, if I want to change the value of this to something more specific you need
to edit a file:
/var/lib/polkit-1/localauthority/50-local.d/10-my-pkgkit-policy.pkla

in this file you would put:

[Only Let Admins Install Packages]
Identity=unix-user:*
Action=org.freedesktop.packagekit.package-install
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_admin

save it and that’s it.

The line Identity let’s you specify users or groups that the policy impacts.
The items are ; separated and each one must start with unix-user or unix-group
and have a user, group or wildcard following it.

Now, if you want to test to make sure this works you can, of course, run the
program in question. OR you can use pkcheck.

you use pkcheck like this:
pkcheck –action-id org.freedesktop.packagekit.package-install \
–process $process_id_of_the_process_making_the_request \
-u $the_username_you_are_testing

the process id I used was of a shell of the user or was the gnome-session process.

it should pop up an auth dialog if you did everything correctly.

For more complete docs look at:
man pklocalauthority

and

man polkit

hope this helps.

About these ads

16 Responses to “polkit and package kit and changing settings”

  1. davidz Says:

    Hi. Please avoid referring to a command that won’t be available in the next polkit update, see

    https://bugzilla.redhat.com/show_bug.cgi?id=534047#c27

    for details. Thanks.

  2. skvidal Says:

    okay, I’ll edit it out – I had no idea the command was going away.


  3. Never mind the any console user installing packages, what about the 100s of other cans of worms in PolicyKit. Are these properly documented somewhere?

    What does
    org.freedesktop.devicekit.disks.filesystem-mount
    do? Does this mean a console user can mount any file system, even non-removable media?

    Does org.fedoraproject.abrt.install-debuginfos mean that any console user can fill up the root partition with debuginfo rpms?

    Does org.freedesktop.RealtimeKit1.acquire-high-priority mean that any console user can stop the rest of the system working by opening up lots of realtime processes?

    Who knows what org.freedesktop.devicekit.disks.change, “Modify a device” does. Sounds nasty.

    Can the user detach a system disk? org.freedesktop.devicekit.disks.drive-detach

    or start a fsck?
    org.freedesktop.devicekit.disks.filesystem-check


  4. […] eliminar esta política, alguien se tomo la molestia de documentarla debido a que fue omitida de las notas de lanzamiento de Fedora 12. Para eliminar la […]

  5. bill Says:

    I find the better solution is to uninstall Fedora.


  6. […] polkit and package kit and changing settings « journal/notes a few seconds ago from web […]


  7. […] Per ulteriori informazioni consiglio di seguire la discussione sul sito ufficiale e anche un post di skvidal. […]


  8. […] polkit and package kit and changing settings In f12 the default policy for polkit for package kit is to allow users at the desktop to install signed pkgs from […] […]

  9. Haran S. Says:

    I know in Fedora 11/PolicyKit 0.9 there’s a GUI interface for changing policies. In GNOME it’s located in:

    Main Menu » System » Preferences » Authorizations

    Find the “freedesktop” branch, under which is a “packagekit” branch containing (among others) an “Install signed package” item. From there you can change the “ResultAny”, “ResultInacative” and “ResultActive” settings outlined above in the post. FYI, on my system, “ResultAny” and “ResultInactive” are set to “No” instead of “Admin Auth.”.

    Not sure if this GUI is still around in Fedora 12/PolicyKit 1.0. Can someone else verify this?


  10. […] información respecto a esto, puedes encontrarla aquí. […]


  11. # pklalockdown –remove-lockdown org.freedesktop.packagekit.package-install
    Command not found.

    How to remove lockdown on Fedora 14?

    I would like to enable users to install packages and updates without typing in root password.

    • Kevin Brubeck Unhammer Says:

      I don’t think there’s a GUI for PolKit user administration yet. The simplest way to make some group of users, e.g. “wheel”, have the same PolKit access as the root user, is to create a file

      /etc/polkit-1/localauthority.conf.d/60-localauthority.conf

      containing:

      [Configuration]
      AdminIdentities=unix-user:0;unix-group:wheel

      However, to only allow PackageKit actions to wheel, leaving other PolKit actions intact, you’d have to make a rule like

      [Let Wheel Use PackageKit]
      Identity=unix-group:wheel
      Action=org.freedesktop.packagekit.*
      ResultAny=no
      ResultInactive=no
      ResultActive=yes

      in e.g. /etc/polkit-1/localauthority/50-local.d/10-my-pkgkit-policy.pkla

      I haven’t tested this; see man pklocalauthority (the man page should work even though the command does not exist)

      • Kevin Brubeck Unhammer Says:

        ok, now I have tested it :-) it works, but change ResultActive to auth_self_keep instead of yes if you want users to at least enter their own password…


  12. […] I was supposed to do. After having search the web for information about PolicyKit I have found one interesting article that helped me getting done with my issue and learning more about this authorization framework. […]


  13. […] Per ulteriori informazioni consiglio di seguire la discussione sul sito ufficiale e anche un post di skvidal. […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: