On 08/28/2013 03:44 AM, Jehan Procaccia wrote:
Le 27/08/2013 20:17, Stephen Gallagher a écrit :
On 08/27/2013 01:14 PM, Jehan Procaccia wrote:
>>> I am using Fedora19 on hundred of stations for students, to my
>>> surprise I noticed that anyone connected locally can update all
>>> packages of the station ! the thing is that when the user connect
>>> to the station, there's a notifcation that pops-up saying that
>>> there are updates available accepting to proceed leeds to an update
>>> of all the station packages ;-( apparently cliking on the
>>> notification start gpk-update-viewer (seen that with ps auwx) if
>>> the student tries to issue a yum update on the cli, then he is
>>> refused "You need to be root to perform this command."
>>>
>>> we need to maintain an homogenous state of update on all station,
>>> how can I prevent users from update stations themself ? Thanks.
>>>
The policy should be that only members of the "wheel" group should be
able to do that. Please file a bug in Bugzilla if you see otherwise
(file it against PackageKit).
I noticed that /etc/polkit-1/rules.d/50-default.rules
contains :
polkit.addAdminRule(function(action, subject) {
return ["*unix-group:wheel*"];
perhaps that's why it is authorized to any logged in users !?
I've been told on irc #fedora to set this
[root@b02-02 rules.d]# cat 60-require-packagekit-update-adminpassword.rules
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.packagekit.system-update") {
return polkit.Result.AUTH_ADMIN;
}
});
it works, I mean after gpk-update-viewer is started, resolved
dependencies, when about to install it show a Error pop-up " Failed to
obtain authentication."
at least that does what I expected in the first place, unprivileged
users cannot update the system !
perhaps there's a better way to handle this, if you have an idea, let me
know
but I think I can push that file to my hundred fedora19 stations,
hopefully I use cfengine to automate this .
thanks
Did you file a Bug for the issue, or get any reference to an existing
Bug number ?
Please do file a Bug if one does not exist currently for the reported issue.
--
Regards,
Rejy M Cyriac (rmc)