Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1335458

Summary:	system upgrade can be triggered without admin password
Product:	[Fedora] Fedora	Reporter:	Kamil Páral <kparal>
Component:	PackageKit	Assignee:	Richard Hughes <rhughes>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	23	CC:	gmarr, jonathan, klember, kparal, mcatanzaro+wrong-account-do-not-cc, rdieter, rhughes, smparrish
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	PackageKit-1.1.1-2.fc24 PackageKit-1.1.3-1.fc23	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-20 23:49:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1308538

Description Kamil Páral 2016-05-12 09:14:17 UTC

Description of problem:
I have followed https://fedoraproject.org/wiki/QA:Testcase_Workstation_Graphical_Upgrade and downloaded and started system upgrade without providing my password anywhere (my user is in wheel group, but I was not asked for password, so I assume it would work the same even for users not being in wheel).

I don't think this is a good idea. Installing programs, ok. Updating system, maybe. But a full system upgrade from one release to another, performed by an ordinary user with no admin privileges? That doesn't sound as a good idea.

Version-Release number of selected component (if applicable):
gnome-software-3.20.3-0.191.20160425git.fc23.x86_64
libhif-0.2.3-0.145.20160427git.fc23.x86_64
libappstream-glib-0.5.14-1.fc23.x86_64
json-glib-1.2.0-1.fc23.x86_64
PackageKit-1.1.1-1.fc23.x86_64

How reproducible:
always I guess

Steps to Reproduce:
1. as a standard user with no admin privileges, follow the test case

Comment 1 Richard Hughes 2016-05-12 09:39:10 UTC

Downloading the packages, or actually triggering the upgrade? The former doesn't need auth, the latter should.

Comment 2 Kamil Páral 2016-05-12 14:01:01 UTC

Yes, a standard user can trigger the upgrade. No auth needed.

Comment 3 Geoffrey Marr 2016-05-17 06:52:51 UTC

I am seeing this too on F23 Workstation to F24 upgrade.

Comment 4 Richard Hughes 2016-05-25 09:42:32 UTC

commit d72382dc1e50ce58adf5d0c344c91c6ecc257740
Author: Richard Hughes <richard>
Date:   Wed May 25 10:41:48 2016 +0100

    Require admin authorisation to trigger a distro upgrade
    
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1335458

:100644 100644 aac0fd1... 221010d... M  policy/org.freedesktop.packagekit.policy.in
:100644 100644 6b145b6... 603de08... M  src/pk-engine.c

Comment 5 Fedora Update System 2016-05-28 09:37:21 UTC

PackageKit-1.1.1-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5b9402e965

Comment 6 Fedora Update System 2016-05-29 00:55:36 UTC

PackageKit-1.1.1-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-5b9402e965

Comment 7 Fedora Update System 2016-05-29 17:46:46 UTC

PackageKit-1.1.1-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Kamil Páral 2016-05-31 11:15:25 UTC

I tested this with the following builds:
http://koji.fedoraproject.org/koji/buildinfo?buildID=768991
http://koji.fedoraproject.org/koji/buildinfo?buildID=762450
http://koji.fedoraproject.org/koji/buildinfo?buildID=768995
http://koji.fedoraproject.org/koji/buildinfo?buildID=769263
http://koji.fedoraproject.org/koji/buildinfo?buildID=762454
http://koji.fedoraproject.org/koji/buildinfo?buildID=762449

The problem seems fixed. We will want to fix it in F23 as well, though.

Comment 9 Fedora Update System 2016-06-03 09:36:26 UTC

PackageKit-1.1.1-2.fc23 appstream-data-23-11.fc23 fwupd-0.7.1-1.fc23 gnome-software-3.20.3-1.fc23.1 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.14-1.fc23 libgusb-0.2.9-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 10 Fedora Update System 2016-06-05 03:59:00 UTC

PackageKit-1.1.1-2.fc23, appstream-data-23-11.fc23, fwupd-0.7.1-1.fc23, gnome-software-3.20.3-1.fc23.1, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.14-1.fc23, libgusb-0.2.9-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 11 Kamil Páral 2016-06-06 15:23:02 UTC

(In reply to Fedora Update System from comment #10)
> PackageKit-1.1.1-2.fc23, appstream-data-23-11.fc23, fwupd-0.7.1-1.fc23,
> gnome-software-3.20.3-1.fc23.1, json-glib-1.2.0-1.fc23,
> libappstream-glib-0.5.14-1.fc23, libgusb-0.2.9-1.fc23 has been pushed to the
> Fedora 23 testing repository. If problems still persist, please make note of
> it in this bug report.

Verified fixed with this update.

Comment 12 Fedora Update System 2016-07-12 19:14:15 UTC

PackageKit-1.1.2-1.fc23 appstream-data-23-11.fc23 fwupd-0.7.2-1.fc23 gnome-shell-3.18.5-2.fc23 gnome-software-3.20.4-1.fc23 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.16-2.fc23 libgusb-0.2.9-1.fc23 libhif-0.2.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 13 Fedora Update System 2016-07-14 01:25:00 UTC

PackageKit-1.1.2-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-1.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 14 Fedora Update System 2016-07-14 13:27:49 UTC

PackageKit-1.1.3-1.fc23 appstream-data-23-11.fc23 fwupd-0.7.2-2.fc23 gnome-shell-3.18.5-2.fc23 gnome-software-3.20.4-1.fc23 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.16-2.fc23 libgusb-0.2.9-1.fc23 libhif-0.2.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 15 Fedora Update System 2016-07-15 17:52:29 UTC

PackageKit-1.1.3-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-2.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 16 Fedora Update System 2016-07-20 23:49:30 UTC

PackageKit-1.1.3-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-2.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.