sudo by default?

[William Jon McCann]

Hey,

So what is our view of setting up sudo by default for standalone
systems?  Probably has some relationship with the systems on which we
prevent root logins.

It is worth noting that many of us have to set up ourselves each time
we install Fedora.  Might be nice if something like it was done by
default.

Is sudo the right answer or should we be thinking about pkexec?  Thoughts?

Thanks,
Jon

[Bill Nottingham]

William Jon McCann (william.jon.mccann(a)gmail.com) said: 
>  So what is our view of setting up sudo by default for standalone
>  systems?  Probably has some relationship with the systems on which we
>  prevent root logins.
>  
>  It is worth noting that many of us have to set up ourselves each time
>  we install Fedora.  Might be nice if something like it was done by
>  default.
>  
>  Is sudo the right answer or should we be thinking about pkexec?  Thoughts? 
I thought the idea was setting up desktop_admin_r, and that for the
standalone systems, we were trying to avoid having to rely on anything
that would need to be exposed via sudo.

As for me, I tend to just uncomment some of the more drastic lines in
pam.d/su.

Bill

[Paul W. Frields]

On Tue, May 04, 2010 at 04:59:35PM -0400, Bill Nottingham wrote:
>  William Jon McCann (william.jon.mccann(a)gmail.com) said: 
>  > So what is our view of setting up sudo by default for standalone
>  > systems?  Probably has some relationship with the systems on which we
>  > prevent root logins.
>  > 
>  > It is worth noting that many of us have to set up ourselves each time
>  > we install Fedora.  Might be nice if something like it was done by
>  > default.
>  > 
>  > Is sudo the right answer or should we be thinking about pkexec?  Thoughts?
>  
>  I thought the idea was setting up desktop_admin_r, and that for the
>  standalone systems, we were trying to avoid having to rely on anything
>  that would need to be exposed via sudo. 
Yes, I was under the impression that group role would play a part in
some next iteration of security policy.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
          Where open source multiplies: http://opensource.com

[Jesse Keating]

On Tue, 2010-05-04 at 16:56 -0400, William Jon McCann wrote:
>  Hey,
>  
>  So what is our view of setting up sudo by default for standalone
>  systems?  Probably has some relationship with the systems on which we
>  prevent root logins.
>  
>  It is worth noting that many of us have to set up ourselves each time
>  we install Fedora.  Might be nice if something like it was done by
>  default.
>  
>  Is sudo the right answer or should we be thinking about pkexec?  Thoughts?
>  
>  Thanks,
>  Jon 
I like sudo, it is a more traditional tool than pkexec.  While it does
remove the need from having to know the root password, it doesn't
obviate the need for a root user who has all the fun.  Sudo would just
get you access to some/all of it.

That said, I think it would be useful in our new user creation that if
we said that this user is the local admin (for whatever that does to
your policykit settings) we also grant them sudo access.  Probably the
best way to deal with this is not to munge the /etc/sudoers file, but
instead ship a config file that allows for a certain group or pk role to
have sudo rights, and then when we create the user(s) we either add them
to that group or role or not.  That way they can pick up sudo rights
without us having to modify the rpm shipped config file.  But now I'm
off in implementation land...

-- 
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating

[Brad B]

I hope you don't mind me chiming in...  I am a user who has used sudo and
been pleased with having the flexibility to give root commands, do system
wide searches without having to login as root...

Does having sudo privileges (not restricted, but equivalent to root) give
you the power to "take root"... change root's password?  (e.g., ' sudo
passwd root ...' )   I know that I don't appreciate the security issues
fully of logging in as root (restricted to a terminal) versus using sudo in
a terminal window ( sudo authority has a time expiration on it and requires
the sudoers password to initiate ).
.

And if sudo doesn't give a user the ability to "take root", what does one
do
if one forgets their root password?

On Tue, May 4, 2010 at 5:07 PM, Jesse Keating <jkeating(a)redhat.com&gt; wrote:

>  On Tue, 2010-05-04 at 16:56 -0400, William Jon McCann wrote:
>  > Hey,
>  >
>  > So what is our view of setting up sudo by default for standalone
>  > systems?  Probably has some relationship with the systems on which we
>  > prevent root logins.
>  >
>  > It is worth noting that many of us have to set up ourselves each time
>  > we install Fedora.  Might be nice if something like it was done by
>  > default.
>  >
>  > Is sudo the right answer or should we be thinking about pkexec?
>   Thoughts?
>  >
>  > Thanks,
>  > Jon
>
>  I like sudo, it is a more traditional tool than pkexec.  While it does
>  remove the need from having to know the root password, it doesn't
>  obviate the need for a root user who has all the fun.  Sudo would just
>  get you access to some/all of it.
>
>  That said, I think it would be useful in our new user creation that if
>  we said that this user is the local admin (for whatever that does to
>  your policykit settings) we also grant them sudo access.  Probably the
>  best way to deal with this is not to munge the /etc/sudoers file, but
>  instead ship a config file that allows for a certain group or pk role to
>  have sudo rights, and then when we create the user(s) we either add them
>  to that group or role or not.  That way they can pick up sudo rights
>  without us having to modify the rpm shipped config file.  But now I'm
>  off in implementation land...
>
>  --
>  Jesse Keating
>  Fedora -- Freedom² is a feature!
>  identi.ca: http://identi.ca/jkeating
>
>  --
>  desktop mailing list
>  desktop(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/desktop
>  


-- 
========

Plan or attend a Linux Installfest near you soon.

Ubuntu, fedora, OpenSUSE... take your pick...  Soon there will be Google
OS,,, maybe even Google Android for the desktop.

OpenOffice for your document management...

[Jesse Keating]

On Tue, 2010-05-04 at 17:19 -0400, Brad Banko wrote:
>  I hope you don't mind me chiming in...  I am a user who has used
> sudo and
>  been pleased with having the flexibility to give root commands, do system
>  wide searches without having to login as root...
>  
>  Does having sudo privileges (not restricted, but equivalent to root) give
>  you the power to "take root"... change root's password?  (e.g., ' sudo
>  passwd root ...' )   I know that I don't appreciate the security issues
>  fully of logging in as root (restricted to a terminal) versus using sudo in
>  a terminal window ( sudo authority has a time expiration on it and requires
>  the sudoers password to initiate ).
>  . 
A basic configuration would allow a sudo caller to change the root
password.

>  And if sudo doesn't give a user the ability to "take
> root", what does one do
>  if one forgets their root password?  
Boot the system to single user mode or boot rescue media and change it
that way.

-- 
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating

[Lennart Poettering]

On Tue, 04.05.10 14:07, Jesse Keating (jkeating(a)redhat.com) wrote:

>  On Tue, 2010-05-04 at 16:56 -0400, William Jon McCann wrote:
>  > Hey,
>  > 
>  > So what is our view of setting up sudo by default for standalone
>  > systems?  Probably has some relationship with the systems on which we
>  > prevent root logins.
>  > 
>  > It is worth noting that many of us have to set up ourselves each time
>  > we install Fedora.  Might be nice if something like it was done by
>  > default.
>  > 
>  > Is sudo the right answer or should we be thinking about pkexec?  Thoughts?
>  > 
>  > Thanks,
>  > Jon
>  
>  I like sudo, it is a more traditional tool than pkexec.  While it does
>  remove the need from having to know the root password, it doesn't
>  obviate the need for a root user who has all the fun.  Sudo would just
>  get you access to some/all of it.
>  
>  That said, I think it would be useful in our new user creation that if
>  we said that this user is the local admin (for whatever that does to
>  your policykit settings) we also grant them sudo access.  Probably the
>  best way to deal with this is not to munge the /etc/sudoers file, but
>  instead ship a config file that allows for a certain group or pk role to
>  have sudo rights, and then when we create the user(s) we either add them
>  to that group or role or not.  That way they can pick up sudo rights
>  without us having to modify the rpm shipped config file.  But now I'm
>  off in implementation land... 
the default sudoers already contains a commented line that makes sudo
work for the venerable wheel group that way. I'd suggest simply enabling
that, as it is the path of least surprise to most, I'd guess.

BTW: another reason to enable sudo by default is to unify things a
little across distributions: to my knowledge Ubuntu (and related
distros) set up sudo like that. It would be nice if folks coming from
their would have an easy path to administrating Fedora systems.

Lennart

-- 
Lennart Poettering                        Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/           GnuPG 0x1A015CC4

[Jesse Keating]

On Tue, 2010-05-04 at 23:36 +0200, Lennart Poettering wrote:
>  On Tue, 04.05.10 14:07, Jesse Keating (jkeating(a)redhat.com) wrote:
>  
>  > On Tue, 2010-05-04 at 16:56 -0400, William Jon McCann wrote:
>  > > Hey,
>  > > 
>  > > So what is our view of setting up sudo by default for standalone
>  > > systems?  Probably has some relationship with the systems on which we
>  > > prevent root logins.
>  > > 
>  > > It is worth noting that many of us have to set up ourselves each time
>  > > we install Fedora.  Might be nice if something like it was done by
>  > > default.
>  > > 
>  > > Is sudo the right answer or should we be thinking about pkexec?  Thoughts?
>  > > 
>  > > Thanks,
>  > > Jon
>  > 
>  > I like sudo, it is a more traditional tool than pkexec.  While it does
>  > remove the need from having to know the root password, it doesn't
>  > obviate the need for a root user who has all the fun.  Sudo would just
>  > get you access to some/all of it.
>  > 
>  > That said, I think it would be useful in our new user creation that if
>  > we said that this user is the local admin (for whatever that does to
>  > your policykit settings) we also grant them sudo access.  Probably the
>  > best way to deal with this is not to munge the /etc/sudoers file, but
>  > instead ship a config file that allows for a certain group or pk role to
>  > have sudo rights, and then when we create the user(s) we either add them
>  > to that group or role or not.  That way they can pick up sudo rights
>  > without us having to modify the rpm shipped config file.  But now I'm
>  > off in implementation land...
>  
>  the default sudoers already contains a commented line that makes sudo
>  work for the venerable wheel group that way. I'd suggest simply enabling
>  that, as it is the path of least surprise to most, I'd guess.
>  
>  BTW: another reason to enable sudo by default is to unify things a
>  little across distributions: to my knowledge Ubuntu (and related
>  distros) set up sudo like that. It would be nice if folks coming from
>  their would have an easy path to administrating Fedora systems.
>   
Making the wheel group uncommented is indeed one step toward the
solution.  The second step would be appropriately populating that wheel
group.  That's going to require change on the user creation wizard.

However I was curious what the thoughts were on having rights management
be done both at the policykit level, as well as the traditional unix
group level.  Is that a (technical) design issue?

-- 
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating

[Bastien Nocera]

On Tue, 2010-05-04 at 23:36 +0200, Lennart Poettering wrote:
>  On Tue, 04.05.10 14:07, Jesse Keating (jkeating(a)redhat.com) wrote:
>  
>  > On Tue, 2010-05-04 at 16:56 -0400, William Jon McCann wrote:
>  > > Hey,
>  > > 
>  > > So what is our view of setting up sudo by default for standalone
>  > > systems?  Probably has some relationship with the systems on which we
>  > > prevent root logins.
>  > > 
>  > > It is worth noting that many of us have to set up ourselves each time
>  > > we install Fedora.  Might be nice if something like it was done by
>  > > default.
>  > > 
>  > > Is sudo the right answer or should we be thinking about pkexec?  Thoughts?
>  > > 
>  > > Thanks,
>  > > Jon
>  > 
>  > I like sudo, it is a more traditional tool than pkexec.  While it does
>  > remove the need from having to know the root password, it doesn't
>  > obviate the need for a root user who has all the fun.  Sudo would just
>  > get you access to some/all of it.
>  > 
>  > That said, I think it would be useful in our new user creation that if
>  > we said that this user is the local admin (for whatever that does to
>  > your policykit settings) we also grant them sudo access.  Probably the
>  > best way to deal with this is not to munge the /etc/sudoers file, but
>  > instead ship a config file that allows for a certain group or pk role to
>  > have sudo rights, and then when we create the user(s) we either add them
>  > to that group or role or not.  That way they can pick up sudo rights
>  > without us having to modify the rpm shipped config file.  But now I'm
>  > off in implementation land...
>  
>  the default sudoers already contains a commented line that makes sudo
>  work for the venerable wheel group that way. I'd suggest simply enabling
>  that, as it is the path of least surprise to most, I'd guess. 
Could we make the wheel group equivalent to the desktop_admin_r role in
PolicyKit, so that we can use the accounts-service/accounts-dialogue to
enable sudo access as soon as you're tagging that user with the admin
role?

[Matthias Clasen]

On Tue, 2010-05-04 at 23:46 +0100, Bastien Nocera wrote:

>  > 
>  > the default sudoers already contains a commented line that makes sudo
>  > work for the venerable wheel group that way. I'd suggest simply enabling
>  > that, as it is the path of least surprise to most, I'd guess.
>  
>  Could we make the wheel group equivalent to the desktop_admin_r role in
>  PolicyKit, so that we can use the accounts-service/accounts-dialogue to
>  enable sudo access as soon as you're tagging that user with the admin
>  role? 
We can certainly do that if there's a rough consensus that that's the
right thing to do. There's different ways it can be done, of course.
Either define the 'admin' role to include wheel group membership, or add
sudo configuration to treat the desktop_admin_r group the same way as
wheel.


Matthias

[Yaakov Nemoy]

2010/5/4 Lennart Poettering <mzerqung(a)0pointer.de&gt;:
>  BTW: another reason to enable sudo by default is to unify things a
>  little across distributions: to my knowledge Ubuntu (and related
>  distros) set up sudo like that. It would be nice if folks coming from
>  their would have an easy path to administrating Fedora systems. 
I disagree with this logic. It's too much like the 'if your friends
all jumped off the brooklyn bridge, would you do it too?' logic
parents use to convince kids not to do drugs.

I don't want to compare Ubuntu's decisions about security to drug use,
but the way you phrase it here, you make it sound like Ubuntu's setup
is already the best for users out there, and i'm not 100% convinced.
If there is a well defined policy that the consensus agrees is good,
then i'm all in favour of seeing that implemented as widely as
possible, for exactly the reasons you mention above.

There's two other points to be made. Let's say we have a well defined
security policy that the consensus agrees on. I'm willing to bet more
than anything that having it widely deployed will negate some of the
value it provides. Having multiple policies on different systems make
it that much harder for malware writers to trick users into doing
stupid things, and there's a certain fundamental advantage to using
multiple good policies on different systems for diversity. This is
assuming that multiple good policies exist.

The other point is that i'm personally not convinced automatically
giving sudo is the best option out there. (You can see my bias here.)
I think there is a strong difference in contexts between:

A) The user knows what he's doing, he owns the box, and he wants to
change something relatively benign such as the date or time of the
machine, install packages from good repos, something that can be
handled by PolicyKit.

B) The user knows what he's doing, he owns the box, and he wants to be
able to change anything at will using the old tried and true
administration techniques using sudo, such as changing the root
password, installing packages from source and so on.

These aren't judgement calls on what's better for the user to be
allowed to do. There is a value though in communicating clearly that
these are two seperate contexts, and having an option in the new user
creation is definitely one way to communicate the difference between
someone with the right SELinux context and someone in the wheel group.

-Yaakov

[Lennart Poettering]

On Wed, 05.05.10 10:22, Yaakov Nemoy (loupgaroublond(a)gmail.com) wrote:

>  
>  2010/5/4 Lennart Poettering <mzerqung(a)0pointer.de&gt;:
>  > BTW: another reason to enable sudo by default is to unify things a
>  > little across distributions: to my knowledge Ubuntu (and related
>  > distros) set up sudo like that. It would be nice if folks coming from
>  > their would have an easy path to administrating Fedora systems.
>  
>  I disagree with this logic. It's too much like the 'if your friends
>  all jumped off the brooklyn bridge, would you do it too?' logic
>  parents use to convince kids not to do drugs. 
Well, it might come as a surprise to some, but actually Ubuntu is not
just a bunch of imbiciles, and it kinda annoys me that whenever
something comes from or is done in Ubuntu, people saya: "well, if Ubuntu
does it, then it is questionnable because they don't know what they do
and their distro is only used by noobs".

Well, that's simply bullshit. 

It is a good idea, and taking inspiration from their work and working
towards minimizing the differences between the distros even if that
means we make a step in their direction, is nothing like jumping from a
bridge, taking drugs, or convincing your kids about that.

Lennart

-- 
Lennart Poettering                        Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/           GnuPG 0x1A015CC4

[Paul W. Frields]

On Wed, May 05, 2010 at 02:52:15PM +0200, Lennart Poettering wrote:
>  On Wed, 05.05.10 10:22, Yaakov Nemoy (loupgaroublond(a)gmail.com)
> wrote:
>  
>  > 
>  > 2010/5/4 Lennart Poettering <mzerqung(a)0pointer.de&gt;:
>  > > BTW: another reason to enable sudo by default is to unify things a
>  > > little across distributions: to my knowledge Ubuntu (and related
>  > > distros) set up sudo like that. It would be nice if folks coming from
>  > > their would have an easy path to administrating Fedora systems.
>  > 
>  > I disagree with this logic. It's too much like the 'if your friends
>  > all jumped off the brooklyn bridge, would you do it too?' logic
>  > parents use to convince kids not to do drugs.
>  
>  Well, it might come as a surprise to some, but actually Ubuntu is not
>  just a bunch of imbiciles, and it kinda annoys me that whenever
>  something comes from or is done in Ubuntu, people saya: "well, if Ubuntu
>  does it, then it is questionnable because they don't know what they do
>  and their distro is only used by noobs".
>  
>  Well, that's simply bullshit.  
I think Yaakov said in the paragraph right after the snip above that
he was simply not 100% convinced the implementation Ubuntu chose is
correct, not that they were imbeciles.  Yes, analogies are generally
bad.

>  It is a good idea, and taking inspiration from their work and
> working
>  towards minimizing the differences between the distros even if that
>  means we make a step in their direction, is nothing like jumping from a
>  bridge, taking drugs, or convincing your kids about that. 
A lot of people want or expect some way to promote themselves easily,
whether that's sudo or something else.  If we end up taking a cue from
another distro, there's no shame in that, nor in considering other
ways to do this elegantly.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
          Where open source multiplies: http://opensource.com

[Yaakov Nemoy]

2010/5/6 Paul W. Frields <stickster(a)gmail.com&gt;:
>  On Wed, May 05, 2010 at 02:52:15PM +0200, Lennart Poettering wrote:
> > On Wed, 05.05.10 10:22, Yaakov Nemoy (loupgaroublond(a)gmail.com) wrote:
> >
> > >
> > > 2010/5/4 Lennart Poettering <mzerqung(a)0pointer.de&gt;:
> > > > BTW: another reason to enable sudo by default is to unify things a
> > > > little across distributions: to my knowledge Ubuntu (and related
> > > > distros) set up sudo like that. It would be nice if folks coming from
> > > > their would have an easy path to administrating Fedora systems.
> > >
> > > I disagree with this logic. It's too much like the 'if your friends
> > > all jumped off the brooklyn bridge, would you do it too?' logic
> > > parents use to convince kids not to do drugs.
> >
> > Well, it might come as a surprise to some, but actually Ubuntu is not
> > just a bunch of imbiciles, and it kinda annoys me that whenever
> > something comes from or is done in Ubuntu, people saya: "well, if Ubuntu
> > does it, then it is questionnable because they don't know what they do
> > and their distro is only used by noobs".
> >
> > Well, that's simply bullshit.
>
>  I think Yaakov said in the paragraph right after the snip above that
>  he was simply not 100% convinced the implementation Ubuntu chose is
>  correct, not that they were imbeciles.  Yes, analogies are generally
>  bad. 
Thanks Paul. This is correct. Just to be clear, i think Ubuntu's
policy of giving the first user automatic sudo access is not the best
way to do things. I don't mean to say that it hasn't been thought out
by experts, and i definitely don't mean to say that it's insecure in
any way. I will say that it doesn't educate users properly and gives
users a false expectation of what good security is.

One of the tricky things about these kinds of security policies where
the most likely error you can get is E_PEBCAK is that there is
theoretically no such thing as absolute security. When you define a
security process intended to be secure, you have to take into account
what the users were using before hand to understand their expectations
of the computer. If they expect things to be widely open, they will do
their worst to go around a more locked down security policy, thus
negating its effectiveness.

When i mention that i find Ubuntu's policy dubious, it's in connection
with the idea that an Ubuntu user will eventually try out another
distribution. Having a single non-root user with full access to the
system via sudo isn't bad per se, but it denies you the ability to
make fine grained control without work. It's ok for desktops. I think
the seperation of root from the rest of the users via PolicyKit and a
number of other mechanisms is far better for a wide variety of
scenarios, including desktops. Assuming the user will have a hard time
discerning the real difference between Ubuntu and Fedora in practice,
you need a way that the user's expectations from Ubuntu can be thrown
into Fedora and vica versa. You also don't want to compromise your
ability to use PolicyKit effectively.

In order to accomodate these two conflicting needs, i seperated this
into two types of reasons the user might need root access, and at
initial account creation time, a simple radio dialog can handle the
two needs. To just follow Ubuntu's direction is bad for the reason
that we create an either/or situation. I'm proposing a 'both'
situation. And yes, Paul is correct; analogies are bad.

-Yaakov

[Christoph Wickert]

Am Dienstag, den 04.05.2010, 23:36 +0200 schrieb Lennart Poettering:
>  BTW: another reason to enable sudo by default is to unify things a
>  little across distributions: to my knowledge Ubuntu (and related
>  distros) set up sudo like that.  
They only setup sudo like that fr the first user that is created.

>  It would be nice if folks coming from
>  their would have an easy path to administrating Fedora systems. 
Speaking of administration: I'd like to remind everybody that there are
still people using Fedora for servers and server admins still want to
have a proper root account because usually there are no users on
servers. If we go the Ubuntu way, we'll loose that (cause Ubuntu comes
without root password and disabled root login).

Regards,
Christoph

[Paul W. Frields]

On Thu, May 06, 2010 at 09:09:38AM +0200, Christoph Wickert wrote:
>  Am Dienstag, den 04.05.2010, 23:36 +0200 schrieb Lennart Poettering:
>  > BTW: another reason to enable sudo by default is to unify things a
>  > little across distributions: to my knowledge Ubuntu (and related
>  > distros) set up sudo like that. 
>  
>  They only setup sudo like that fr the first user that is created.
>  
>  > It would be nice if folks coming from
>  > their would have an easy path to administrating Fedora systems.
>  
>  Speaking of administration: I'd like to remind everybody that there are
>  still people using Fedora for servers and server admins still want to
>  have a proper root account because usually there are no users on
>  servers. If we go the Ubuntu way, we'll loose that (cause Ubuntu comes
>  without root password and disabled root login). 
If I'm not mistaken, we're discussing the Desktop Live image here.
I'd expect we can do better with server installation too, but that's
probably a separate conversation.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
          Where open source multiplies: http://opensource.com

[Christoph Wickert]

Am Donnerstag, den 06.05.2010, 09:58 -0400 schrieb Paul W. Frields:
>  On Thu, May 06, 2010 at 09:09:38AM +0200, Christoph Wickert wrote:
>  > I'd like to remind everybody that there are
>  > still people using Fedora for servers and server admins still want to
>  > have a proper root account because usually there are no users on
>  > servers. If we go the Ubuntu way, we'll loose that (cause Ubuntu comes
>  > without root password and disabled root login).
>  
>  If I'm not mistaken, we're discussing the Desktop Live image here.
>  I'd expect we can do better with server installation too, but that's
>  probably a separate conversation. 
I would expect changes to /etc/sudoers or /etc/pam.d/sudo to happen
globally and not only on the spin. Not sure what exactly we are talking
about but I'm sure we are not talking about changes in the livesys
initscript that will affect the live mode only.

Regards,
Christoph

[Bill Nottingham]

Christoph Wickert (christoph.wickert(a)googlemail.com) said: 
>  > If I'm not mistaken, we're discussing the Desktop Live
> image here.
>  > I'd expect we can do better with server installation too, but that's
>  > probably a separate conversation.
>  
>  I would expect changes to /etc/sudoers or /etc/pam.d/sudo to happen
>  globally and not only on the spin. Not sure what exactly we are talking
>  about but I'm sure we are not talking about changes in the livesys
>  initscript that will affect the live mode only. 
I ... wouldn't, necessarily. At least, if we're really going to allow
people to target different use cases, we can't be tied to the least
common denominator and still make progress.

Of course, that goes back to the purpose of spins, and what they can
and can't do.

Bill

[William Jon McCann]

Hey Bill,

On Thu, May 6, 2010 at 11:45 AM, Bill Nottingham <notting(a)redhat.com&gt; wrote:
>  Christoph Wickert (christoph.wickert(a)googlemail.com) said:
> > > If I'm not mistaken, we're discussing the Desktop Live image here.
> > > I'd expect we can do better with server installation too, but that's
> > > probably a separate conversation.
> >
> > I would expect changes to /etc/sudoers or /etc/pam.d/sudo to happen
> > globally and not only on the spin. Not sure what exactly we are talking
> > about but I'm sure we are not talking about changes in the livesys
> > initscript that will affect the live mode only.
>
>  I ... wouldn't, necessarily. At least, if we're really going to allow
>  people to target different use cases, we can't be tied to the least
>  common denominator and still make progress.
>
>  Of course, that goes back to the purpose of spins, and what they can
>  and can't do. 
Yeah.  Unfortunately, basically spins were a bad idea.  But given the
present condition I'd prefer that we take the attitude to share
between spins as a last resort not as an initial condition.  If Fedora
must have completely different operating systems under one banner, and
doesn't have the resources to maintain each of these separately, and
wants to share some components where possible - fine.  But for the
love of sanity don't expect each of them to agree on anything.  They
each exist because they have different goals and increasingly
divergent user experiences.

Sharing code or policy or anything between spins/OSes is a convenience
and an optimization and little else.  The current policy that we don't
do anything unless spins agree with get us nowhere.

Jon

[Adam Williamson]

On Thu, 2010-05-06 at 11:45 -0400, Bill Nottingham wrote:

>  > I would expect changes to /etc/sudoers or /etc/pam.d/sudo to
> happen
>  > globally and not only on the spin. Not sure what exactly we are talking
>  > about but I'm sure we are not talking about changes in the livesys
>  > initscript that will affect the live mode only.
>  
>  I ... wouldn't, necessarily. At least, if we're really going to allow
>  people to target different use cases, we can't be tied to the least
>  common denominator and still make progress.
>  
>  Of course, that goes back to the purpose of spins, and what they can
>  and can't do. 
I agree. This is a classic case where lack of use case focus hobbles the
planning. The discussion of a good system of gaining root privilege for
the desktop use case has been sniped by reference to the server use
case.

Ubuntu doesn't have this problem - and hence was perfectly happy to use
the sudo setup - because Ubuntu clearly and confidently refuse to target
the server use case in the Ubuntu product. They have the Ubuntu Server
product for the server use case (and, I assume, that doesn't use the
same OOTB setup Ubuntu uses). Hence no problem for them.

When we lack that focus, we get into these circular, tail-chasing
discussions. As Jon McCann said in his reply, the current spin situation
just gives us the worst of both worlds - the appearance of
differentiated products, but with problems in really differentiating
them in ways we really ought to, because we insist on lots of
'consistency' between the spins.
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net

[Jesse Keating]

On Thu, 2010-05-06 at 17:27 +0200, Christoph Wickert wrote:
>  I would expect changes to /etc/sudoers or /etc/pam.d/sudo to happen
>  globally and not only on the spin.  

We have an /etc/sudoers.d/ now, so that we can drop snippits in or out
based on the spin.

-- 
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating

[Rudolf Kastl]

Just a general question. what is the advantage of typing sudo each
time for given commands on a "single user box"  instead of just doing
su (you dont even need any - anymore... we added sbin paths to the
PATH env var...) and entering the rootpass you know anyways on a
single user system.  Logging of commands etc is not a big issue on a
single user box. Basically it is just more typing to do and
autocompletion is also not that efficient anymore with default
settings (sbin paths!) as it was before. Just trying to understand
which problem we are trying to solve here. If that is the generic
default for the first user i hope this is only done on the desktop
spin and not on the dvd install. On a multiuser system i guess it is
not that wise to give additional priviledges for the first user by
default that are only supposed to be executed by the admin of the
machine. Just want to make sure it doesent slip in by accident.

kind regards,
Rudolf Kastl

[Alexander Boström]

tor 2010-05-06 klockan 09:58 -0400 skrev Paul W. Frields:

>  If I'm not mistaken, we're discussing the Desktop Live image
> here.
>  I'd expect we can do better with server installation too, but that's
>  probably a separate conversation. 
That would mean different policies depending on if you install from the
Desktop spin (a GNOME desktop) or a default OS install from any other
media (a GNOME desktop), which would be confusing.

Sure, I can see some value in some specific spins diverging in various
ways, but the default Desktop live spin should not.

/Alexander

[Rahul Sundaram]

2010/5/8 Alexander Boström <abo(a)root.snowtree.se&gt;

>  tor 2010-05-06 klockan 09:58 -0400 skrev Paul W. Frields:
>
>  > If I'm not mistaken, we're discussing the Desktop Live image here.
>  > I'd expect we can do better with server installation too, but that's
>  > probably a separate conversation.
>
>  That would mean different policies depending on if you install from the
>  Desktop spin (a GNOME desktop) or a default OS install from any other
>  media (a GNOME desktop), which would be confusing.
>
>  Sure, I can see some value in some specific spins diverging in various
>  ways, but the default Desktop live spin should not.
>
>  
We already have several divergences.  Root password is disabled in GDM but
not other display managers for example.  I don't think we can get everyone
to agree on the right path and yes, this results in some amount of confusion
but good documentation definitely helps.

Rahul

[Adam Williamson]

On Sat, 2010-05-08 at 08:10 +0200, Alexander Boström wrote:
>  tor 2010-05-06 klockan 09:58 -0400 skrev Paul W. Frields:
>  
>  > If I'm not mistaken, we're discussing the Desktop Live image here.
>  > I'd expect we can do better with server installation too, but that's
>  > probably a separate conversation.
>  
>  That would mean different policies depending on if you install from the
>  Desktop spin (a GNOME desktop) or a default OS install from any other
>  media (a GNOME desktop), which would be confusing.
>  
>  Sure, I can see some value in some specific spins diverging in various
>  ways, but the default Desktop live spin should not. 
Probably the best way to address this would be to keep the behaviour
consistent; have the DVD install offer you the same install 'types' as
you can choose from via the spins, and have the same choices behave the
same way in each case. There was already some movement towards aligning
the package sets for the 'desktop' option in the traditional installer
and the 'desktop' spin, in the F13 cycle.
-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net

[Lennart Poettering]

On Tue, 04.05.10 16:56, William Jon McCann (william.jon.mccann(a)gmail.com) wrote:

>  Hey,
>  
>  So what is our view of setting up sudo by default for standalone
>  systems?  Probably has some relationship with the systems on which we
>  prevent root logins.
>  
>  It is worth noting that many of us have to set up ourselves each time
>  we install Fedora.  Might be nice if something like it was done by
>  default. 
I am all for it. Would be nice if we could give the wheel group a useful
meaning by default.

IIRC there was a discussion on fedora-devel a year ago or so, where some
people shot this down however.

>  Is sudo the right answer or should we be thinking about pkexec? 
> Thoughts? 
David, is PK able to forget stored permissions after a time? i.e. with
sudo you have to reenter your password only every 10min or so. If you
use sudo within 10min it will authenticate you right-away. I like that
feature a lot, and would love something similar in PK. 

sudo caches the authentication per-tty. i.e. if you have two xterms on
your screen and type your password into sudo once, it will remember the
password on that one xterm for the next 10min, but for the other xterm
you have to authenicate seperately. How does PK handle this? Is
authentication bound to the X display? Or the session?

I am still missing something like "pkexec -s", similar to "sudo
-s". Would be good to have that, before advertising pkexec use to users
more strongly.

Lennart

-- 
Lennart Poettering                        Red Hat, Inc.
lennart [at] poettering [dot] net
http://0pointer.net/lennart/           GnuPG 0x1A015CC4

[inode0]

On Tue, May 4, 2010 at 3:56 PM, William Jon McCann
<william.jon.mccann(a)gmail.com&gt; wrote:
>  Hey,
>
>  So what is our view of setting up sudo by default for standalone
>  systems?  Probably has some relationship with the systems on which we
>  prevent root logins.
>
>  It is worth noting that many of us have to set up ourselves each time
>  we install Fedora.  Might be nice if something like it was done by
>  default.
>
>  Is sudo the right answer or should we be thinking about pkexec?  Thoughts? 
I encounter large numbers of users who are comfortable with sudo but
also many who dislike it for various reasons. I don't want to debate
the merits of sudo vs. other options but would be happiest with
(possibly in addition to other pk and selinux changes) just enabling
the wheel group which would allow users of both sudo and su to have
non-disrupted workflows. The sudoers and pam.d/su files have
enablement of wheel group support already available in comments and I
imagine almost everyone already tweaks one or the other when
configuring their systems.

John

[Colin Walters]

On Tue, May 4, 2010 at 4:56 PM, William Jon McCann
<william.jon.mccann(a)gmail.com&gt; wrote:
>  Hey,
>
>  So what is our view of setting up sudo by default for standalone
>  systems?  Probably has some relationship with the systems on which we
>  prevent root logins. 
My input here is this is pretty much *only* interesting if we also
don't have a root password by default.