From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 30 Apr 2022 13:38:31 +0200 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1nklQm-003krv-R0 for lore@lore.pengutronix.de; Sat, 30 Apr 2022 13:38:31 +0200 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1nklQk-0000ef-2N; Sat, 30 Apr 2022 13:38:30 +0200 Received: from mail-ej1-x62c.google.com ([2a00:1450:4864:20::62c]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1nklPw-0000eU-Ft for ptxdist@pengutronix.de; Sat, 30 Apr 2022 13:37:41 +0200 Received: by mail-ej1-x62c.google.com with SMTP id l7so19878325ejn.2 for ; Sat, 30 Apr 2022 04:37:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=j8Ee5N0ZNi1ZXLciaeX3aQ2NCQLE20wR7ZjoOErnDhI=; b=jQUpqbEsEi65LGhWhqcvkOQgorDsk5xM206PUFtCVT8rfT6YVHqMBeCYKcRlr8UItw +SavosSUOKoNTNUcuABXCxvYTGseKJMsnQbOLn/gjIS5+tEUShTMJ7hr57gXxZLArlOk IsPwQgsZj7WWgfToFyC372/tXL1gIpd+oYWPMGuBpiyJoP9FalN3UB6jrnMQQliG31m0 a+PZQtbplzkHY8gLdhThx1lI6RS6DRqob04XENG4yUP94OkaxXFY6mzDrua/mU0gQiAy 0jE8UjvTmVEZjBOzgKAVECbsqo0DqRf3RJ3ja91CReZnNB/yMzK1rw930G/CDvIKyAjk bXrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=j8Ee5N0ZNi1ZXLciaeX3aQ2NCQLE20wR7ZjoOErnDhI=; b=xYFHSnsRZwaohfFpRgpzannZrdrzdsjCwOsD4zYR3vQ54R7UBwAha92Ip+awmcyw6F WqDXUaR54M1UpC2KzzEX5BK92wbmk0xsEpWECRqNNy/bwcMQ+TSfNCMu1oNmSIP6hiV9 oPZvOny44FB+KHgcKNkVYX8hzULrIuLXlzt+MtvHlTZwZbUiB47phqhwPC/HAsTm+3Xw beKUD4FjtV5pXFNg/gXUL2BN3LwRKB37twBrto91AGJbqglqZfai7GTomE+xBbgqsSwQ FfsaydVw85fVvDB3O8Vs4L3bSQGyLhQe/fOe2FmeXNggZKrs7I4J6TgDtcXggWiBkfxi y9kg== X-Gm-Message-State: AOAM531FQQ9b8XgG/tDMK8zZL2oxm/FhDixBo8uz+tLTBfgKMYBLITYY J+R0rpCiNLlrrctHhwuOncOXFWXze6w= X-Google-Smtp-Source: ABdhPJw752rEz+a3VsNLdfNJNwQFQScMvrIDusOt9EIJyOlgPbyDiSriZLSOYPX6+Ml/15kp7IukAg== X-Received: by 2002:a17:906:974e:b0:6bb:4f90:a6ae with SMTP id o14-20020a170906974e00b006bb4f90a6aemr3604091ejy.452.1651318659173; Sat, 30 Apr 2022 04:37:39 -0700 (PDT) Received: from localhost.localdomain (3e6b100e.rev.stofanet.dk. [62.107.16.14]) by smtp.gmail.com with ESMTPSA id cq10-20020a056402220a00b004278942f86asm693720edb.7.2022.04.30.04.37.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 Apr 2022 04:37:38 -0700 (PDT) From: Bruno Thomsen To: ptxdist@pengutronix.de Date: Sat, 30 Apr 2022 13:37:24 +0200 Message-Id: <20220430113724.6133-1-bruno.thomsen@gmail.com> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.ext.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.7 required=4.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] polkit: add pkexec install option X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Bruno Thomsen Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false Disable default install of pkexec SUID binary as it's an old way of executing a command as another user or with elevated privileges. Fedora will also avoid installing pkexec[1], and put it in an optional compat RPM package. [1] https://fedoraproject.org/wiki/Changes/polkit_recommends_pkla_pkexec Signed-off-by: Bruno Thomsen --- rules/polkit.in | 10 ++++++++++ rules/polkit.make | 2 ++ 2 files changed, 12 insertions(+) diff --git a/rules/polkit.in b/rules/polkit.in index 6085fbf783d6..8227cafbcaf8 100644 --- a/rules/polkit.in +++ b/rules/polkit.in @@ -29,4 +29,14 @@ config POLKIT_SYSTEMD help Use systemd for session tracking, else ConsoleKit is used +comment "install options ---" + +config POLKIT_PKEXEC + bool + prompt "Install pkexec" + help + pkexec - Execute a command as another user or with elevated privileges. + + Old and obsolete tool. Use 'sudo' for this kind of task. + endif diff --git a/rules/polkit.make b/rules/polkit.make index 4fa8d9c0edb1..368fbe3e4d3c 100644 --- a/rules/polkit.make +++ b/rules/polkit.make @@ -96,7 +96,9 @@ endif @$(call install_copy, polkit, 0, 0, 0755, -, /usr/libexec/polkitd) # binaries with suid +ifdef PTXCONF_POLKIT_PKEXEC @$(call install_copy, polkit, 0, 0, 4755, -, /usr/bin/pkexec) +endif @$(call install_copy, polkit, 0, 0, 4755, -, \ /usr/libexec/polkit-agent-helper-1) base-commit: 6695ca9ed25a2e4792b8ab9ac38879a4c1939d52 -- 2.35.1