Re: [Ayatana] Possible security risk with update-manager

[mac_v <drkvi-a@xxxxxxxxx>]

On Tue, 2009-12-15 at 10:03 +0000, Alan Pope wrote:
> 2009/12/15 mac_v <drkvi-a@xxxxxxxxx>:
> > If someone other than the user is having access to a user account ,
> > there are bigger concerns than the guest updating the system.
> >
> 
> Sure, but the topic of conversation is update manager, not "local
> access is bad, all bets are off".
> 
> > The guest[in this case the child] could delete important work files and
> > do more damage.
> 
> Sure they could, but again the topic is Update Manager and whether
> operation of it should require an authentication token.

Why i mentioned those was , they are bigger concerns and greater odds
than a weekly update manager popping up and breaking the system. 
The odds of the update manager in those scenarios are pretty less
compared to the behavior of the default setting.

As mpt , mentioned earlier , since Update manager authentication is
migrating to policykit, which is more configurable. 
We set the default to not prompt passwords [similar to the mounting
internal]  the power users who want to change this , can remove the
rule.

We need to ensure the default settings are easy for the most common user
scenarios than for corner cases.



-- 
Cheers,
mac_v