<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">2014-04-20 23:20 GMT+02:00 Lars Seipel <span dir="ltr"><<a href="mailto:lars.seipel@gmail.com" target="_blank">lars.seipel@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Thu, Apr 17, 2014 at 11:44:58PM +0200, Miloslav Trmač wrote:<br>
> We don't, actually. *Only* applications running in a session of a member<br>
> of the wheel group would have that right, and those applications are pretty<br>
> much root-equivalent anyway. (Many GNOME users probably use such a setup,<br>
> but it's not at all the only one possible.)<br>
<br>
Ugh. This is implemented in PolicyKit? Where was this change<br>
discussed/announced and when did it happen? Reinterpreting wheel group<br>
membership to give user accounts mighty powers without requiring<br>
re-authentication is a pretty major change and probably unexpected for<br>
most users.<br>
</blockquote></div><br></div><div class="gmail_extra">I'm sorry, I was imprecise; it typically does require re-authentication with users' own password, but in X11 that password is available to any malicious program running in the session (e.g. by painting a fake screen lock), so I tend to discount it.<br>
</div><div class="gmail_extra"> Mirek<br></div></div>