Gerald Pfeifer wrote:
Linus vocally complained about this today at https://plus.google.com/u/0/102150693225130002912/posts/1vyfmNCYpi5
I wonder when our beloved benevolent dictator finally grows up.
and I verified that running GNOME on openSUSE 12.1, all updates applied, I do need to provide the root password to change the timezone
There are separate privileges for changing the time zone and adjusting the clock where the former was allowed by default. The GNOME applet nowadays doesn't distinguish between both actions though. Even allowing to change the system's timezone is a workaround though. No privilege transition or modification of system properties (ie /etc/localtime) would be needed if glibc offer a sane per-user setting.
or add a printer.
Whether or not adding a printer requires the root password depends on your printer. If your printer is a known USB printer it's automatically set up when you connect it. No input needed at all then. Same for cups network printers. However, if you have a device that is not auto detected the user may have to enter things that could easily be used for privilege escalation to root or damage the system (like entering /dev/sda as device or specifying a ppd file that executes arbitrary code).
[...] Any chance we can get these two resolved quickly?
Short answer: No. Please hire someone to fix the underlying architectural problems if you want a fix rather than adding more mindless hacks. I'm convinced there are ways to make the system both secure and usable but not with the current tools. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org