Permissions required to install/uninstall software

[Michael Catanzaro]

Hi,

I guess there must be a reason for this, but it's odd that Fedora 20
requires authentication to uninstall software, but not to install
(signed) software. It's great that I don't need a password to install
stuff, but why do I need a password to get rid of it? I might be stuck
with software I later decided I don't want after all. If removing
applications is considered a security hazard, then I think
authentication should be required to install as well. (And if the user
is an administrator, maybe the password prompt is not needed at all.)

Alternatively, I should just be able to uninstall something I installed
myself.

Thoughts?

Michael

[Matthew Miller]

On Mon, Jun 02, 2014 at 05:00:27PM -0500, Michael Catanzaro wrote:
> I guess there must be a reason for this, but it's odd that Fedora 20
> requires authentication to uninstall software, but not to install
> (signed) software. It's great that I don't need a password to install
> stuff, but why do I need a password to get rid of it? I might be stuck

It's a lot easier to break your system by removing things than it is by
adding them. That doesn't mean it's a bad idea to allow removal of
applications -- it just takes a little more logic.

[Michael Catanzaro]

On Tue, 2014-06-03 at 08:18 -0400, Matthew Miller wrote:
> It's a lot easier to break your system by removing things than it is
> by
> adding them. That doesn't mean it's a bad idea to allow removal of
> applications -- it just takes a little more logic.

How about something really simple:

* No authentication required to remove an application or add-on
(anything that's displayed in GNOME Software)
* Authentication required to remove system packages (you must be using
gpk-application to be doing this)

If removing an application ever breaks anything, there is a very serious
packaging bug, since core applications are unremovable and nothing
besides plugins should depend on an application.

There's probably something wrong with this. Thoughts?

[Richard Hughes]

On 3 June 2014 14:57, Michael Catanzaro  wrote:
> No authentication required to remove an application or add-on
>
> (anything that's displayed in GNOME Software)

There are a lot of things that are "applications" that we might not
want a random user to remove, e.g. all the time we have per-system
applications rather than per-user sandboxed applications removing
things is a huge pain.

Richard.