Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> - pkexec should not exist, even without the vulnerability it's really easy to mess up using it

We already have sudo and su (and doas) for such things. But those programs need to reinvent the wheel.



sudo/suo/doas do not allow for flexible policy evaluation. They're also useless for GUI applications.

For instance, GNOME Settings uses PolKit to ensure that remote control can only be turned on by an admin who makes the request from an active session on a local console.

Or here's a more interesting example. gvfs uses PolKit to allow processes that are part of an active session on a local console to be able to elevate permissions for editing files (e.g., 'gedit admin:///etc/motd').




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: