Slashdot Mirror
Fedora 12 Package Installation Policy Tightened
AdamWill writes "After the controversy over Fedora 12's controversial package installation authentication policy, including our discussion this week, the package maintainers have agreed that the controversial policy will be tightened to require root authentication for trusted package installation. Please see the official announcement and the development mailing list post for more details."
It's about time they fixed that.
Ask Slashdot: Where bad ideas meet poor googling skills.
What really got me about this one was the attitude some developers had ... constantly trying to justify their correctness, despite the huge backlash from users. I feel the trust relationship is kinda broken ... but at least they finally came around and listened.
FAIL
...the package maintainers have agreed that the controversial policy will be tightened to require root authentication for trusted package installation.
Wow. Thank goodness those guys "discovered" that allowing non-root users to do dangerous things to the OS/application stack was a bad idea and "agreed" to lock it down. We might have had some serious problems there. (roll eyes)
WTF? How on gawds green earth did this happen in the first place?
See personally I never thought it would be in discussion whether to allow non-root users to install packages. In my opinion it's one of the great advantages of *nix systems as far as security goes. Even the distributions with the root user disabled to make it easier on a desktop user, like Ubuntu, still require use of the sudo command. It's one of the biggest reasons certain worms and drive by download techniques which crippled Microsoft OS's never worked on *nix systems.
Even those with good senses of humor, honor, and saintly intentions must occasionally require the use of a strong shield
The idea of allowing normal users to install signed software is actually not all that bad.
Frankly, the most common alternatives - either users have to ask IT to do it (which neither the users like nor does the IT department necessarily want to spend its days messing around with) or giving them local admin (or, this being Linux, local root) privileges are both awful.
Off the top of my head, I can think of a few sane solutions to the problem - none of which appear to have been given serious thought:
1. Provide a list of software which anyone can install. (Oh look, that's more or less what Fedora did, though obviously if you depend on signatures you don't need to compile and maintain a list. Might have been nice if they'd made it so the admin had to decide in advance what software could be allowed, rather than just sticking the entire repository in there, but the idea's sound)
2. Provide a sandbox of some sort that can be wiped on demand and install software into that.
....photo on www.fedora.org.
Poor little weiner dog.
I used to like to go there to see the odd pics, but haven't been in a while.
I am very small, utmostly microscopic.
Wow. Thank goodness those guys "discovered" that allowing non-root users to do dangerous things to the OS/application stack was a bad idea and "agreed" to lock it down. We might have had some serious problems there. (roll eyes) WTF? How on gawds green earth did this happen in the first place?
The use of the word "controversial" to describe the rollback to the original, more secure settings is bizarre, too. The failure here was the process and the people that must have worked to push through the weird settings that allowed everyone and their dog to install random 'signed' but unconfigured packages. That's something we'd expect from Microsoft employees, trainees, 'engineers' or 'researchers', not Red Hat staff or volunteers.
I notice that mono has shown up in the distro, too. When will managers learn about bringing posers bringing the One Microsoft Way into a project? Microsoft hasn't done much of any technology right during the time it's been around. Is it a wise choice to start letting that way of thinking spread and gut yet another fine distro?
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Allowing non-root users (by default, though I'm sure you could enforce your own policy) isn't nearly as heart-stopping as people are claiming.
This is definitely an overreacting community - what's the harmed in SIGNED packages? Oh, boohoo, my users can install vim, emacs or pico if I neglected to. The horror!
Of course, there are some packages in repo that could be questionable (jtr? kismet? ettercap?) that definitely need to be considered.
At the end of the day, Fedora is still geared toward desktop use, so seriously... how "dangerous" could this really be on privately maintained systems with few users?
Obviously a bad idea for RHEL, but I wholly think everyone is severely overreacting on it's addition to Fedora.
The whole Fedora Team's creation of and response to this issue creates very serious doubt in my mind about their ability to manage a distribution and their understanding of proper security policy. I think they've got to open up their decision making process more and learn to communicate better. An idea this bad should have been squashed 5 minutes after it was proposed instead of being allowed to actually make it into a released distribution.
At least it all shows that the community still ultimately calls the shots.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
I have a similar complaint about KPackageKit. You can optionally choose to make it store your password so that you don't have to type it in when you next install or update packages. That's fair enough, if you trust that no one is going to install anything dodgy then that's OK. What I do take issue with is that this box is checked by default.
Granted I imagine most people might simply click this anyway but am I the only one who thinks this is a bit of an oversight?
Summation 2
TROLL:
Allowing users to conveniently install signed/authorized packages/software.This is LINUX dammit if you're not jumping through hoops to get something done you are DOING IT WRONG!.
RANT:
Non-root users will destroy EVERYTHING that's why they must be frustrated for the sake of SECURITY. That white-listed signed software package must be personally allowed by the head of IT before installation can complete!
QUOTE:
If you give up freedom for security you deserve neither - Thomas Jefferson -
SENSIBLE RESPONSE:
Fedora caved in to a knee-jerk reaction. The compromise should of been allowing admin's to white-list a subset of the signed packages that they want to allow all users unrestricted access to. The year of unnecessary security is upon us.
To quote Richard Hughes, the developer responsible for the braindeadness in the first place, and repeatedly trying to brag his competency of being a dickhead in the bugzilla(https://bugzilla.redhat.com/show_bug.cgi?id=534047).:
Source: http://blogs.gnome.org/hughsie/2009/09/23/linux-is-about-choice/
It seems that he interpreted his own words as "Just because you can do something, doesn’t mean you should do it. But for me, I can fucking make whatever 'choice' and screw everybody else. Bwahahaha!"
And his recent rants:
(Source: http://blogs.gnome.org/hughsie/2009/11/20/the-fedora-12-installing-saga/)
But he was the one who was being a troll first. Quotes from the bugzilla:
Now, I'm wondering how on earth did someone got a job for being a devtroll. Red Hat pays him to develop, but trolling the bugzilla? I don't remember anyone "attacking him personally" on the bugzilla. I wasn't following the mailing lists though.
And he now seemed hurt because the users actually bothered to donate their own time correcting his mistake.
Grow up.
Do /. writers get paid by "controversy"?
...on a topic that nobody outside of the Linux "community" will care about. Please use a minimum of 1000 words to: 1) Nitpick any or all talking points discussed in TFA to the nth degree. 2) Illustrate your Linux expertise by telling us how it is better than other OS's by providing an example of how you took a task that took 2 hours to do in Windows down to just 20 minutes in Linux.
Notice that the announcement said:
> The update will require local console users to enter the root password to install new software
packages.
This is, of course, wrong. Such local installations are normally done with "sudo", which does not require root passwords.
This is the sort of linguistic sloppiness that lead to the shrieking by users. While such inconsistent behavior for the console versus logged in SSH users has no reasonable excuse and shouldn't have happened, the danger was much less than the early explanations lead reasonable people like me to believe, because many of the discussions left out the "this only works from the console" part. And given that the new Fedora release is taking a bit of time to download, we hadn't had the chance to try this ourselves.
The policy of allowing certain users to install software, within certain limits, is not crazy. It gives you:
* don't have users typing in the root password all the time
* if you need a codec or viewer plugin, the system can pop up a "Getting a viewer for you" window, rather than a "Can't view this, please install foo, put root password here"
* this is made possible because Linux distros have their own "app store" of approved software, which comes *from the distro* so you know where to get it and you know it's relatively unlikely to be malware. Windows and MacOS can't do this.
The limits included only giving these privileges to the console user, who probably has physical access and can root the machine anyhow, which is also sensible. But it also gives malware the local user might end up running (e.g. due to a Firefox compromise) the ability to install software. That's not necessarily too bad unless it's, for instance, installing vulnerable setuid-root software. So this needs to be thought about carefully before enabling on an individual machine, unless the distro has thought *even harder* about it so you don't have to. It doesn't really seem like the Fedora guys thought about it hard enough, even though it could be a good policy for the future if done right. And I don't think anybody is happy about such a major change in behaviour happening without it being announced and debated very publically.
I hope to see this feature reappearing in a future Fedora release - it's a good feature if they do it right. But they should be *even more* careful about what they permit and they shouldn't make dramatic behaviour changes occurring by default without heavy debate (and if you upgrade from an old version, rather than clean install, it should certainly say "This is a behaviour change, do you want it?" - probably defaulting to no.
Wow, actual spam on Slashdot. Don't think I've ever seen that before.
The pulse audio cramfest was even worse.
How many Fedora installations actually have "users" and "admins?" The line that you don't want your users installing software just doesn't hold any water. Honestly if you have an "admin" and "users" you'll be wanting to harden the install anyway, and more than likely you will not want to use Fedora. Instead you'd do CentOS 5 or Ubuntu LTS. Most installs of Fedora are on single-user, home systems. Even in a family situation, a parent will likely want to enable parental controls anyway, so creating a limited account for the kids and using policykit to lock down what they can run (no terminal, etc), is one would do anyway. So bringing up security in the context of "users" is really a red herring here.
Even more ironically, most of the comments seem to indicate that sudo is a recommended solution! Are you kidding? How is that any better for admins and users? If a user wants to do something that needs more privileges, you grant him carte blanche root access? Even on OS X the access controls are this coarse. If the user is "administrative" he has full root access. The Fedora default made a lot of sense for home users but could easily be changed for other environments, though Fedora just doesn't belong in most enterprises.
What Fedora probably needs to do (maybe they have) is introduce templates for use when creating users. So you can easily create admin users, restricted users, etc. Slashdot users seem to have no complaint about the fact that you absolutely do *not* need root on OS X to install software. And even worse you can install software that's not cryptographically signed!
It looks like they plan on changing it back for upcoming releases. Tehehehe! Get out your flame throwers!
The idea was that the change in PolicyKit would be accompanied by a
default set of roles, and a nice user interface for assigning users to
roles. Unfortunately, with the constraints of time, it became clear that
this all (and especially the GUI) wasn't going to be there for Fedora
12. So, PackageKit needed a fixed policy for all users. For each action
(install signed packages, install unsigned packages, remove packages,
etc.), it needed to allow, deny, or ask for the root password.
and
In upcoming Fedora releases, we expect to finish both the default set of
policy roles and the user interface components to provide the full
experience that was originally planned.
So redhat still plans on making this change. They are just waiting till they implement the GUI to easily change a user's role.
It (or similar) has been showing up on pretty much every story I've read on here for the last few days.
It's official. Most of you are morons.
It is still a good idea for certain users to install packages.
Perhap a trusted group.
If only root can do it, then everyone is using sudo, and you system is less secure.
i'd be happy if they fixed the checksum file which incorrectly states the sha256 hashes are sha1.
Yay, a troll!
They've done a great job at appealing to the morons and fucktards of the Linux community.
Aww, how cute! Ain't you the cuddly one.
You basically had to be logged into the console.
Or go to the trouble of faking that. It got spotted reasonably quickly and fixed fast enough after it was spotted. That's working more or less as it should What is broken is how did such a misfeature even get in there in the first place?
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
"You missed the "in my opinion" line in your reply." [and others]
Heh... I half expected to see Ulrich Drepper's name in the bug discussion (famous for his glibc controversy regarding support for those fishy "Carp Architectures").
None of that real trolling then, I see ;-)
It must be kdawson's side job.
If you can read this, it means that I bothered to log in.
Personally, I get annoyed when I get prompted every time I need to make a minor change to my notebook. Why can't I even mount a directory without modifying fstab? Not to mention having to set special permissions so that my limited user can use the directory once it's mounted.
Linux needs a sensible privilege system. Most of us aren't in corporate high-security and uptime environments; give us a break.
And it was worth reading through all comments on the bug report for this...
How perfectly eloquent.