2009/11/19 Chris Adams <cmadams(a)hiwaay.net>:
Once upon a time, Ricky Zhou <ricky(a)fedoraproject.org> said:
> I might be wrong on this, but wouldn't the attacker need to trick
> yum/packagekit into using the malicious repo first? I didn't think that
> was allowed for non-root users.
1.5 words: NetworkManager. Think about it.
2 words: Package signing.
If the key is different to the one that was preciously imported, you
need the root password.
Richard.