Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Polkit dialog does not show authenticating user #624

Open
silkeh opened this issue Oct 13, 2024 · 0 comments
Open

[Bug] Polkit dialog does not show authenticating user #624

silkeh opened this issue Oct 13, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@silkeh
Copy link

silkeh commented Oct 13, 2024

Description

The polkit dialog does not show which user is authenticating. This can cause user confusion, like in this review:

Finally, a security bug I mentioned in my last review remains and I was disappointed to see it lingers. Non-privileged accounts (regular user accounts) can perform administrative actions if they have the first user's password. This happens even when the regular user is not in the sudoer file and it allows guest users to install or remove software. This means if two users happen to have the same password (or similar ones and the user makes a typo) they can perform admin actions without being a privileged user. This seems like a design flaw and one that, while it probably can only be exploited in a few rare situations, makes me uncomfortable with the security settings on Solus.

Budgie version

10.9.2

Operating System

Solus 4

Steps to reproduce the issue

  1. Have a system with one admin user ('Test User' below).
  2. Create an additional user without admin privileges ('Temp' below).
  3. Do something that requires admin privileges. Eg: unlock the users page in the settings, restart a service without sudo.
  4. Get a password prompt for the admin user, without mentioning that it's for the admin user.

Actual result

afbeelding

Expected result

Show the authenticating user when authenticating. Examples of this:

Polkit on terminal:

afbeelding

GNOME:

afbeelding

Plasma:

afbeelding

Additional information

No response

@EbonJaeger EbonJaeger added the enhancement New feature or request label Oct 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants