Solved plasma5-discover upgraded packages without needing root password

D

drr

I have switched from 'quarterly' to the 'latest' package repository recently and plasma5-discover (5.27.11_2) notified me today about package updates available through it's system stray icon. Clicking on this icon opened Discover and I could update the listed packages with it. However, Discover did not prompt me for the root password before installing the updates. I have not used Discover in FreeBSD before and used to upgrade packages with pkg upgrade run as the root user.

Discover used to be installed as dependency of plasma5-plasma before but never notified me about updates when I used to use the quarterly repository, so I am assuming that this may be a feature update; or maybe I was always on up to date packages back then. However, is Discover not requiring root password to upgrade packages the expected behavior? My user is member of the 'wheel' group, but I do not have sudo, doas, etc. on my system.
 
Thanks monwarez , I start plasma-x11 with 'ck-launch-session' in .xinitrc as described in the Handbook. Starting the desktop without 'ck-launch-session' results in Discover failing to check for updates, with the error message 'Failed to obtain authentication.'.

I am wondering if starting the desktop with 'ck-launch-session' would allow any application to have root privileges without we authenticating it explicitly? Could this be a security issue?; just curious to know.
 
This all configured with polkit under the directory /usr/local/share/polkit-1. Basically, if an application is able to register in dbus a specific names, that match a policy/rule configured with polkit to allow root access, then yes the application will get root privilege without any actions.
The idea is that some gui application will give root privilege to the user that is currently using the graphical session, in some case it will still ask to choose an admin account to continue, and ask its password alongside.
See pkexec echo test for instance.
 
  • Thanks
Reactions: drr
monwarez, thanks for explaining it. I have previously come across Discover in linux distributions and it typically used to prompt for the user's password as most of them used 'sudo' or similar. Hence, I was confused when the upgrade happened without prompting for a password.
 
drr said:
Discover used to be installed as dependency of plasma5-plasma before but never notified me about updates when I used to use the quarterly repository, so I am assuming that this may be a feature update
Click to expand...
It did not work out of the box before because of a missing dependency, which I reported recently (see PR 280746) - now fixed, so you got the dependency ports-mgmt/packagekit added by an update and it now does what it is supposed to (previously, the Discover updates notifier would just run in background without doing anything useful).
 
  • Thanks
Reactions: drr
Thanks bsduck. While Discover now updates packages without any problem, I have noticed that it still does not search or install packages. I am guessing that this needs some other framework. I am not looking to use Discover anyway; I prefer pkg. Unfortunately KDE plasma installs Discover as a dependency.
 
Indeed, searching or installing new packages doesn't work yet.

If you don't want Discover to search for updates, you can disable it in the KDE System Settings.
 
  • Thanks
Reactions: drr
You must log in or register to reply here.
Back
Top