[Touch-packages] [Bug 1832337] Re: Require password when starting usb-creator
IIUC, when anyone who plugs a removable USB stick in a PC it is mounted in /media// and, as long as the FS in the device does not support privileges attributes (e.g. FAT32), anyone is granted the rights to overwrite anything (but partitions ?) in the device. So I don't see why anyone would be bored with authentication for this task. Let me know if I forget something. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-desktop- privileges in Ubuntu. https://bugs.launchpad.net/bugs/1832337 Title: Require password when starting usb-creator Status in policykit-desktop-privileges package in Ubuntu: Fix Released Status in usb-creator package in Ubuntu: Fix Released Bug description: Because usb-creator performs privileged actions, it should require authentication prior to starting. policykit-desktop-privileges should be modified so that usb-creator requires password authentication prior to starting. While it was a deliberate design decision to allow usb-creator to perform mounting and writing without authentication (see https://bugs.launchpad.net/ubuntu/+source/policykit-desktop- privileges/+bug/1568149), this decision should be revisited. Allowing the use of usb-creator without authentication presents an unnecessary security risk. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1832337/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1832337] Re: Require password when starting usb-creator
This bug was fixed in the package usb-creator - 0.3.6 --- usb-creator (0.3.6) eoan; urgency=medium * Unmount device during image operation so a single policykit prompt can be displayed to the user. (LP: #1832337) -- Marc Deslauriers Tue, 18 Jun 2019 14:19:59 -0400 ** Changed in: usb-creator (Ubuntu) Status: In Progress => Fix Released ** Changed in: policykit-desktop-privileges (Ubuntu) Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-desktop- privileges in Ubuntu. https://bugs.launchpad.net/bugs/1832337 Title: Require password when starting usb-creator Status in policykit-desktop-privileges package in Ubuntu: Fix Released Status in usb-creator package in Ubuntu: Fix Released Bug description: Because usb-creator performs privileged actions, it should require authentication prior to starting. policykit-desktop-privileges should be modified so that usb-creator requires password authentication prior to starting. While it was a deliberate design decision to allow usb-creator to perform mounting and writing without authentication (see https://bugs.launchpad.net/ubuntu/+source/policykit-desktop- privileges/+bug/1568149), this decision should be revisited. Allowing the use of usb-creator without authentication presents an unnecessary security risk. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1832337/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1832337] Re: Require password when starting usb-creator
This bug was fixed in the package policykit-desktop-privileges - 0.21 --- policykit-desktop-privileges (0.21) eoan; urgency=medium * Don't allow usb-creator to overwrite devices without authentication. (LP: #1832337) -- Marc Deslauriers Tue, 18 Jun 2019 13:56:08 -0400 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-desktop- privileges in Ubuntu. https://bugs.launchpad.net/bugs/1832337 Title: Require password when starting usb-creator Status in policykit-desktop-privileges package in Ubuntu: Fix Released Status in usb-creator package in Ubuntu: Fix Released Bug description: Because usb-creator performs privileged actions, it should require authentication prior to starting. policykit-desktop-privileges should be modified so that usb-creator requires password authentication prior to starting. While it was a deliberate design decision to allow usb-creator to perform mounting and writing without authentication (see https://bugs.launchpad.net/ubuntu/+source/policykit-desktop- privileges/+bug/1568149), this decision should be revisited. Allowing the use of usb-creator without authentication presents an unnecessary security risk. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1832337/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
[Touch-packages] [Bug 1832337] Re: Require password when starting usb-creator
This will also require usb-creator to be modified to have a single policykit prompt. ** Also affects: usb-creator (Ubuntu) Importance: Undecided Status: New ** Changed in: usb-creator (Ubuntu) Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) ** Changed in: policykit-desktop-privileges (Ubuntu) Status: New => In Progress ** Changed in: usb-creator (Ubuntu) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to policykit-desktop- privileges in Ubuntu. https://bugs.launchpad.net/bugs/1832337 Title: Require password when starting usb-creator Status in policykit-desktop-privileges package in Ubuntu: In Progress Status in usb-creator package in Ubuntu: In Progress Bug description: Because usb-creator performs privileged actions, it should require authentication prior to starting. policykit-desktop-privileges should be modified so that usb-creator requires password authentication prior to starting. While it was a deliberate design decision to allow usb-creator to perform mounting and writing without authentication (see https://bugs.launchpad.net/ubuntu/+source/policykit-desktop- privileges/+bug/1568149), this decision should be revisited. Allowing the use of usb-creator without authentication presents an unnecessary security risk. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/policykit-desktop-privileges/+bug/1832337/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
