update-manager not asking for authentication in Oneiric Beta

NoOp glgxg at sbcglobal.net
Thu Sep 15 21:44:10 UTC 2011

On 09/15/2011 01:47 AM, Colin Law wrote:
> I would be interested on comments on this bug ([Oneiric]
> update-manager installs packages without authentication)
> https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/814331
> To summarise, in Oneiric Beta when an administrator user install
> upgrades he/she is not asked to authenticate.  The bug is marked as
> won't fix even though it is (as far as I can see) a change from
> previous operation.
> I am interested in this from two points of view
> 1. Should update manager ask for authentication?
> 2. I thought that one of the principles of Linux that makes it much
> less open to attack is that one cannot write to system areas of disk
> without authentication.  How is it then that update manager is able to
> do this (whether by accident or design) without authentication?
> Colin

I prefer UM asking for the password each time. That said, this seems to
be more like when someone has enabled UM to automatically install secure
updates (another 'feature' I don't necessarily agree with for various

More information about the ubuntu-users mailing list