[Bug 1882098] Re: Packagekit lets user install untrusted local packages in Bionic and Focal
Sami Niemimäki
1882098 at bugs.launchpad.net
Sat Jun 13 07:03:13 UTC 2020
Hello Seth,
the packagekit-deny rule should not be necessary, it's there to
underline what is specifically not allowed.
AFAIK, there are no other rules which could have granted this
permission. This happens on a fresh install of Ubuntu where the above is
the only modification to polkit rules.
I'm on vacation since yesterday evening, so I cannot currently check if
the groups have some kind of unexpected effect.
See this for reference:
https://github.com/hughsie/PackageKit/blob/master/policy/org.freedesktop.packagekit.policy.in
The issue is that the command 'pkcon install-local evil-package-i-just-
created.deb' triggers the action 'org.freedesktop.packagekit.package-
install' instead of 'org.freedesktop.packagekit.package-install-
untrusted' which it should.
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to packagekit in Ubuntu.
https://bugs.launchpad.net/bugs/1882098
Title:
Packagekit lets user install untrusted local packages in Bionic and
Focal
Status in packagekit package in Ubuntu:
New
Bug description:
We have packagekit configured to allow users to install trusted
packages from preconfigured repositories, but disallowed them to
install any untrusted packages.
The policykit configuration we use is following:
[tld.univ.packagekit]
Identity=unix-group:adm;
Action=org.freedesktop.packagekit.package-install;org.freedesktop.packagekit.package-reinstall;org.freedesktop.packagekit.package-remove;org.freedesktop.packagekit.system-sources-refresh;org.freedesktop.packagekit.system-update;org.freedesktop.packagekit.repair-system;
ResultAny=auth_self
ResultActive=auth_self
ResultInactive=auth_self
[tld.univ.packagekit-deny]
Identity=unix-user:*;
Action=org.freedesktop.packagekit.package-install-untrusted;
ResultAny=no
We would expect this to prevent users from installing local packages
downloaded from random repositories, however this does not seem to be
the case.
pkcon install-local random_package.deb will happily prompt for the
user to authenticate and will install the package, while pkcon
--allow-untrusted install-local random_package.deb will prompt for
root password, which the user does not have.
Our initial toughts was that the issue would be in packagekitd, but
after further investigations it looks like the issue could be in aptcc
backend.
We are more than happy to provide you with further details, but the
above should be enough to reproduce the issue.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098/+subscriptions
More information about the foundations-bugs
mailing list