Sometimes, Linux doesn’t even get basic security right — I hope these details get ironed out https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
bonifartius 𒂼𒄄
@xerz yeah.. please don't blame "linux" if it isn't linux fault. the whole freedesktop-systemd complex is to blame.
@xerz
> welp, Polkit exists because the kernel's policy system (accounts, filesystem permissions and cgroups) ain't enough
what can't you do with that?
my vague feeling is that in 99% of the cases you can solve these things like this (modify as needed):
add a group, add an entry to sudo/doas to allow this group running a command as root without password. add respective users to group. have your stuff call the command via sudo/doas.
> but anyway, I meant "Linux" as in "community-developed Linux-based distributions"
blame polkit if polkit is to blame, please. the kernel folks have their hands full keeping that shit out of their code (e.g. "kdbus").
@xerz@fedi.xerz.one
@xerz this sounds like a sales pitch, but is still missing examples of what i can't do with the kernel api. i can authenticate remote accounts with ssh. sudo policies and users can be created during package installation.
it is no surprise that if one builds windows like things one gets the same set of problems.
