[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: matthias.gerstner@suse.com QA Contact: qa-bugs@suse.de CC: popov895@ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 Christophe Marin <christophe@krop.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |opensuse-kde-bugs@opensuse. | |org -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 https://bugzilla.suse.com/show_bug.cgi?id=1229913#c1 --- Comment #1 from Eugene Popov <popov895@ukr.net> --- BTW I know that Nautilus in GNOME has a similar feature and it works great in openSUSE Tumbleweed. Is it implemented differently than in KDE? Have you checked it for safety as well? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 https://bugzilla.suse.com/show_bug.cgi?id=1229913#c3 --- Comment #3 from Matthias Gerstner <matthias.gerstner@suse.com> --- (In reply to cleanerspam@aol.com from comment #2)
Can we get on openSUSE admin actions via Open as Administrator feature that is natively supported by KDE in dolphin It is availble on Fedora , Ubuntu and Arch Linux even Rocky Linux has it , If it had so many flaws why would other distros ship it . It feels more integrated in system than the dolphin-su file that is added in /usr/share/applications which open KDE in unthemed white screen which flashbangs you on your whole dark themed distro ! Before someone say it is availble on kde-extra repo ,that package is over 2 years old and installing it does not gives Admin access in dolphin . here is an ouput of trying to run it via konsole
$ dolphin admin:/// Dolphin requires kio-admin to manage system-controlled files, but it is not installed. Press Enter to install kio-admin or Ctrl+C to cancel. Installing kio-admin failed: The packages are already all installed (ErrorAllPackagesAlreadyInstalled) Please try installing kio-admin manually instead.
Its usefullness overweighs the negligible chance that it may be misused. Please think about it :pray:
Thanks for your input. To be fair, openSUSE is the only Linux distribution I know of that has mandatory code reviews of D-Bus service like these - so other distributions shipping it is not really a sign of it being good or bad. I can understand your frustration on the end-user side. Yes, we do have a similar mechanism whitelisted for Gnome. The review history of this KDE component (as well as for the ktexteditor D-Bus interface) was somewhat unfortunate, going years back. Anyway, we will revisit this component, but please bear with us, there are currently other tasks with higher priority. Thanks! -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 https://bugzilla.suse.com/show_bug.cgi?id=1229913#c4 --- Comment #4 from cleanerspam@aol.com --- OK , thanks for detailed answer, @Matthias_Gerstner -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 Matthias Gerstner <matthias.gerstner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-1: kio-admin: revisit |AUDIT-0: kio-admin: revisit |kio-admin privileged file |kio-admin privileged file |operations via D-Bus |operations via D-Bus -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1229913 https://bugzilla.suse.com/show_bug.cgi?id=1229913#c5 Matthias Gerstner <matthias.gerstner@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |matthias.gerstner@suse.com --- Comment #5 from Matthias Gerstner <matthias.gerstner@suse.com> --- Sorry for the long delay. I will now look into the current situation of kio-admin. Since holiday season is ahead I don't expect major results before early January, though. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@suse.com