https://bugs.kde.org/show_bug.cgi?id=523364
Bug ID: 523364
Summary: Discover caches admin credentials too long - Should
ask EVERY time an install is performed
Classification: Applications
Product: Discover
Version First 6.7.3
Reported In:
Platform: Ubuntu
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: discover
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected]
Target Milestone: ---
DESCRIPTION
Discover requires super user authentication to install packages.
Discover SHOULD NOT cache this authentication, for hours or perhaps DAYS, if
the Discover program is not closed between upgrades.
STEPS TO REPRODUCE
1. Open Discover
2. Attempt to install a package
3. Enter your user password for polkit superuser elevation
4. Wait as packages are installed
5. Don't close Discover
6. Come back a day or 2 or 3 later, and attempt another install
OBSERVED RESULT
7. You DO NOT get asked for a password again.
EXPECTED RESULT
7. You DO get asked for a password every time you install
SOFTWARE/OS VERSIONS
Operating System: Kubuntu 26.10
KDE Plasma Version: 6.7.3
KDE Frameworks Version: 6.28.0
Qt Version: 6.10.2
Kernel Version: 7.0.0-27-generic (64-bit)
Graphics Platform: Wayland
Processors: 10 × 13th Gen Intel® Core™ i7-1355U
Memory: 32 GiB of RAM (31.0 GiB usable)
Graphics Processor: Intel® Iris® Xe Graphics
ADDITIONAL INFORMATION
There should NOT be EXTENSIVE caching of authentication. EVER.
If it's cached, I would expect a cache timeout of a few minutes, perhaps an
hour. AT MOST.
This presents a situation where if you leave your system unlocked, malicious
software could be installed at a system level without ever re-authenticating
that the actual account owner is the one sitting there.
I've had Discover running for a few days now.
`mike 970189 0.0 0.4 3405536 150536 ? Ssl Jul13 0:43
/usr/bin/plasma-discover --mode update`
I've upgraded my Ubuntu 26.10 continually for a few days now.
```
Start-Date: 2026-07-13 14:34:44
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-15 13:21:08
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-16 15:16:24
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-18 18:31:42
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-20 15:10:34
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-20 15:31:03
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
--
Start-Date: 2026-07-21 19:39:59
Commandline: packagekit role='update-packages'
Requested-By: mike (1000)
```
I was asked my password ONCE.
--
You are receiving this mail because:
You are watching all bug changes.
