(For some background on PolicyKit, http://people.freedesktop.org/~david/polkit-spec.html is a good read). Basically.. here's an idea for openSUSE 11+. Make YaST use PolicyKit to determine if it does certain actions or not. This would grant the following: 1. YaST (at least Qt and GTK+) itself will run as the user. This would allow for many benefits, i.e., GUI code isn't run privileged, etc.. 2. The system administrator could allow certain modules to be run without a root password. 3. The actual programs doing the actions would be forced to be separated from the UI code (a good design anyway), with something like the system message bus (D-Bus) as the middle man. AppArmor can even be utilized by making the privileged helper programs that do the actual work only able to do what they are intended to be done. The split between the privileged helpers and the unprivileged UI can probably be made easier by some easy APIs integrated into YCP, etc.. I plan on learning on how to make YaST modules by writing a "System Policy Editor" which will manage PolicyKit policies. It seems to be a self-documenting XML format, that the policy editor can then parse and use to provide a nice easy to use policy editor. What do people think about this -- To unsubscribe, e-mail: yast-devel+unsubscribe@opensuse.org For additional commands, e-mail: yast-devel+help@opensuse.org