Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1335458 - system upgrade can be triggered without admin password
Summary: system upgrade can be triggered without admin password
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: PackageKit
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Richard Hughes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1308538
TreeView+ depends on / blocked
 
Reported: 2016-05-12 09:14 UTC by Kamil Páral
Modified: 2016-07-20 23:49 UTC (History)
8 users (show)

Fixed In Version: PackageKit-1.1.1-2.fc24 PackageKit-1.1.3-1.fc23
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-07-20 23:49:58 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Kamil Páral 2016-05-12 09:14:17 UTC
Description of problem:
I have followed https://fedoraproject.org/wiki/QA:Testcase_Workstation_Graphical_Upgrade and downloaded and started system upgrade without providing my password anywhere (my user is in wheel group, but I was not asked for password, so I assume it would work the same even for users not being in wheel).

I don't think this is a good idea. Installing programs, ok. Updating system, maybe. But a full system upgrade from one release to another, performed by an ordinary user with no admin privileges? That doesn't sound as a good idea.

Version-Release number of selected component (if applicable):
gnome-software-3.20.3-0.191.20160425git.fc23.x86_64
libhif-0.2.3-0.145.20160427git.fc23.x86_64
libappstream-glib-0.5.14-1.fc23.x86_64
json-glib-1.2.0-1.fc23.x86_64
PackageKit-1.1.1-1.fc23.x86_64

How reproducible:
always I guess

Steps to Reproduce:
1. as a standard user with no admin privileges, follow the test case

Comment 1 Richard Hughes 2016-05-12 09:39:10 UTC
Downloading the packages, or actually triggering the upgrade? The former doesn't need auth, the latter should.

Comment 2 Kamil Páral 2016-05-12 14:01:01 UTC
Yes, a standard user can trigger the upgrade. No auth needed.

Comment 3 Geoffrey Marr 2016-05-17 06:52:51 UTC
I am seeing this too on F23 Workstation to F24 upgrade.

Comment 4 Richard Hughes 2016-05-25 09:42:32 UTC
commit d72382dc1e50ce58adf5d0c344c91c6ecc257740
Author: Richard Hughes <richard>
Date:   Wed May 25 10:41:48 2016 +0100

    Require admin authorisation to trigger a distro upgrade
    
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1335458

:100644 100644 aac0fd1... 221010d... M  policy/org.freedesktop.packagekit.policy.in
:100644 100644 6b145b6... 603de08... M  src/pk-engine.c

Comment 5 Fedora Update System 2016-05-28 09:37:21 UTC
PackageKit-1.1.1-2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5b9402e965

Comment 6 Fedora Update System 2016-05-29 00:55:36 UTC
PackageKit-1.1.1-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-5b9402e965

Comment 7 Fedora Update System 2016-05-29 17:46:46 UTC
PackageKit-1.1.1-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2016-06-03 09:36:26 UTC
PackageKit-1.1.1-2.fc23 appstream-data-23-11.fc23 fwupd-0.7.1-1.fc23 gnome-software-3.20.3-1.fc23.1 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.14-1.fc23 libgusb-0.2.9-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 10 Fedora Update System 2016-06-05 03:59:00 UTC
PackageKit-1.1.1-2.fc23, appstream-data-23-11.fc23, fwupd-0.7.1-1.fc23, gnome-software-3.20.3-1.fc23.1, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.14-1.fc23, libgusb-0.2.9-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 11 Kamil Páral 2016-06-06 15:23:02 UTC
(In reply to Fedora Update System from comment #10)
> PackageKit-1.1.1-2.fc23, appstream-data-23-11.fc23, fwupd-0.7.1-1.fc23,
> gnome-software-3.20.3-1.fc23.1, json-glib-1.2.0-1.fc23,
> libappstream-glib-0.5.14-1.fc23, libgusb-0.2.9-1.fc23 has been pushed to the
> Fedora 23 testing repository. If problems still persist, please make note of
> it in this bug report.

Verified fixed with this update.

Comment 12 Fedora Update System 2016-07-12 19:14:15 UTC
PackageKit-1.1.2-1.fc23 appstream-data-23-11.fc23 fwupd-0.7.2-1.fc23 gnome-shell-3.18.5-2.fc23 gnome-software-3.20.4-1.fc23 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.16-2.fc23 libgusb-0.2.9-1.fc23 libhif-0.2.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 13 Fedora Update System 2016-07-14 01:25:00 UTC
PackageKit-1.1.2-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-1.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 14 Fedora Update System 2016-07-14 13:27:49 UTC
PackageKit-1.1.3-1.fc23 appstream-data-23-11.fc23 fwupd-0.7.2-2.fc23 gnome-shell-3.18.5-2.fc23 gnome-software-3.20.4-1.fc23 json-glib-1.2.0-1.fc23 libappstream-glib-0.5.16-2.fc23 libgusb-0.2.9-1.fc23 libhif-0.2.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 15 Fedora Update System 2016-07-15 17:52:29 UTC
PackageKit-1.1.3-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-2.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fad11727bf

Comment 16 Fedora Update System 2016-07-20 23:49:30 UTC
PackageKit-1.1.3-1.fc23, appstream-data-23-11.fc23, fwupd-0.7.2-2.fc23, gnome-shell-3.18.5-2.fc23, gnome-software-3.20.4-1.fc23, json-glib-1.2.0-1.fc23, libappstream-glib-0.5.16-2.fc23, libgusb-0.2.9-1.fc23, libhif-0.2.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.