ConsoleKit (0.2.10) / PolicyKit / Security hole
biebl at debian.org
Sat Jul 19 04:47:22 UTC 2008
first of all, I hope that ubuntu-devel-discuss is the correct email
address for contacting the Ubuntu maintainers of consolekit and
policykit (taken from debian/control). I've also CCed Martin just in case.
On to my actual issue:
Today I started updating consolekit to 0.2.10-1 in Debian. The work is
available from the pkg-utopia svn , as always.
I deliberately did not enable the PolicyKit support in ConsoleKit.
Enabling PolicyKit support means, that ConsoleKit will link against
libpolkit. libpolkit on the other hand, requires that the complete
policykit package is installed. The init functions in libpolkit place
inotify watches on certain files and directories (which are only shipped
in the policykit package, like /etc/PolicyKit/PolicyKit.conf and
If those files are not present, libpolkit will not work correctly.
I.e. enabling PolicyKit support in ConsoleKit would mean the package
would have to declare a dependency on the policykit package. On the
other hand, the policykit package requires the consolekit package to
work properly. For the gory details see .
The simple reason, why PolicyKit support was added to ConsoleKit is,
that ConsoleKit has new functionality like System restart/stop, which
has to be protected, so not everyone can call this functions.
It's debatable, if such functionality belongs into ConsoleKit (I think
it doesn't but upstream disagrees).
Problem now is, if you disable the PolicyKit support, the restart/stop
functions are unprotected, and everyone (even through ssh logins) can
shutdown/reboot the system. For fun try  from an unpriviledged user
account. See src/ck-manager.c and grep for HAVE_POLKIT
Imo this is a major security hole in intrepid.
Now there are different options how to address this:
1. in /etc/dbus-1/system.d/ConsoleKit.conf
2.) Enable PolicyKit support in ConsoleKit
Currently, there is no user of the CK Restart/Stop methods (new gdm will
use it, which is neither in Debian nor Ubuntu, though).
So imo the safest option would be 1.a)
 dbus-send --system --dest=org.freedesktop.ConsoleKit \
--type=method_call --print-reply --reply-timeout=2000 \
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 260 bytes
Desc: OpenPGP digital signature
More information about the Ubuntu-devel-discuss