Torvalds:requiring root password for mundane things is moronic
scott at ponzo.net
Sat Mar 3 23:46:00 UTC 2012
On 03/03/2012 03:22 PM, Miloslav Trmač wrote:
> On Sun, Mar 4, 2012 at 12:03 AM, Scott Doty<scott at ponzo.net> wrote:
>> How about allowing all printer management of local printers (including
>> adding a network printer, as Linus& his daughter were dealing with) with
>> two factors:
>> 1) user password
>> 2) physical access
>> ...because PolKit already knows when the user is sitting at the console,
> "Sitting at the console" is not equivalent to "unrestricted physical
> access" allowed, e.g. in any university computer lab.
Agreed. Since we're talking two use case though -- home user and lab
user -- it would make sense to have another rpm that would be installed
to give the desired behavior to one of the cases (the other case being
I'm not sure about the demographics of Fedora installations, but I would
suspect that most lab administrators will be more cognizant of what goes
into their lab machines. Thus, I suggest there be added a new package
to alter the behavior for lab machines (and similar use cases),
something like polkit-i-am-a-lab, or whichever.
What do you think?
> > From my POV, the guiding principle is "is this changing the setup for
> other users of the machine? If so, then it needs authentication."
> (see also https://fedoraproject.org/wiki/User:Adamwill/Draft_Fedora_privilege_escalation_policy
> ). Under this rule, adding a system-wide printer definitely needs
> administrative authentication (but we may provide a way to configure
> single-user machines so that they don't require the authentication,
> see again the draft).
> Another way to look at this issue is - if printers were maintained
> per-user (per-user, unprivileged cups daemon, per-user configuration,
> per-user print queue), there would be no reason to ask for
> authentication. Given that printers are so often networked nowadays
> and no access to hardware is required, we might even be able to avoid
> running the system-wide cups daemon at all in some cases. There would
> be one less process running as root, no reason to authenticate, an
> increase both in security and ease of use. We would be actually
> _solving_ the problem instead of tinkering with administration
> requirements to hide it so that Linus doesn't notice :)
> Would something like this at all possible to do with cups and the
> current printing design and protocols?
This has a lot of merit(!) I suggest that it be handled as an
_addition_ (not a replacement) to the library as library support for
per-user networked printers that don't use the cups daemon at all.
There is nothing lost with that from a security perspective, because the
user could just print to a file, and nc it off to a jetdirect printer
port (or use the samba client, or whatever).
The reason for the addition would be to avoid having to completely
replace cupsd, as well as giving the system administrator (in the lab,
or otherwise) the option to continue to use cupsd. Because
philosophically speaking, I'd rather have choice than a
Also, I did file a bug at freedesktop.org, where (maybe?) discussing
policy changes might be appropriate:
More information about the devel