Linked by Thom Holwerda on Tue 28th Feb 2012 23:11 UTC

Thread beginning with comment 508889
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
I have a problem understanding you. Can you write what's your point again?
Reading through your answer it looks as if you're disagreeing with me but then you confirm all the issues I've risen.
Is it just that you prefer PolicyKit over sudo? That's fine with me - I have no problem with PolicyKit (but then I have no problem with sudo either).
How is this better than "this user is allowed to do A and B but not C"?
From a sysadmin's point of view on security? Not at all. Mind you, that's a very narrow view. Especially when you consider typical dekstop installations, where "the system" can be reinstalled in an hour and all valuable data are in home directories.
From user data security point of view - a lot. There is a big difference between user actions in e.g. synaptic and firefox. I'd like to have access to the printer setup when I explicitly ask for it (e.g. in an appropriate config dialog box) but now when I compile a program or browse Internet.
Member since:
2009-05-30
You are not thinking this through.
Virus and Malware you don't want messing with those settings.
Policykit is design for the particular problem. Because it approve applications to do things.
sudo becomes unworkable as so as you try filtering to applications.
"I own the world" type of permission. Is what the problem is. Policykit provides another set of permissions. This application is trusted todo the following. And only this app. Even if the app is trusted it then asks the user the first time they use that app if they do wish to use its privileged options.
This is creating true secuirty by obscurity. Because attacker has to know what application you use for task not to be noticed.