Re: Draft privilege escalation policy for comments

2010-02-01 Thread Adam Williamson
On Sun, 2010-01-31 at 08:55 +0100, Kevin Kofler wrote: > Adam Williamson wrote: > > I think it's sensible, yeah. It's not really much bureaucracy; I don't > > think it would ever be a good idea to introduce a new privilege > > escalation mechanism without FESco knowing about it... > > Right now we

Re: Draft privilege escalation policy for comments

2010-02-01 Thread Adam Williamson
On Sat, 2010-01-30 at 10:31 -0500, Colin Walters wrote: > On Sat, Jan 30, 2010 at 1:20 AM, Adam Williamson wrote: > > > > Well, reboot is a one-time operation; if there's only one user logged > > in, they can only affect themselves by rebooting. Adjusting the clock or > > installing new software i

Re: Draft privilege escalation policy for comments

2010-02-01 Thread Kevin Kofler
Miloslav Trmač wrote: > That's not the intent: "mechanism" is "the code that causes running > something as root", in this case DBus activation, not "the code running > as root" (a DBus server). Oh, if that's the intent, that's of course perfectly fine. I'd be happy to provide any needed documenta

Re: Draft privilege escalation policy for comments

2010-02-01 Thread Richard Hughes
On 30 January 2010 07:33, Kevin Kofler wrote: > The current PackageKit policy in F12 updates still allows upgrading (as > opposed to installing or removing, not sure about downgrading, does > PackageKit even support that?) No, PackageKit won't let you downgrade a package. > Is the bureaucracy in

Re: Draft privilege escalation policy for comments

2010-01-31 Thread Miloslav Trmač
Kevin Kofler píše v Ne 31. 01. 2010 v 08:55 +0100: > Adam Williamson wrote: > > I think it's sensible, yeah. It's not really much bureaucracy; I don't > > think it would ever be a good idea to introduce a new privilege > > escalation mechanism without FESco knowing about it... > > Right now we're

Re: Draft privilege escalation policy for comments

2010-01-30 Thread Kevin Kofler
Adam Williamson wrote: > I think it's sensible, yeah. It's not really much bureaucracy; I don't > think it would ever be a good idea to introduce a new privilege > escalation mechanism without FESco knowing about it... Right now we're in a phase where a lot of stuff (system-config-*, several part

Re: Draft privilege escalation policy for comments

2010-01-30 Thread Adam Williamson
On Sat, 2010-01-30 at 08:33 +0100, Kevin Kofler wrote: > Adam Williamson wrote: > > Please do provide any and all feedback on the proposed policy. if we can > > get it into a shape which most people on the list would find acceptable, > > my next step will be to take it back to FESco for them to re

Re: Draft privilege escalation policy for comments

2010-01-30 Thread Colin Walters
On Sat, Jan 30, 2010 at 1:20 AM, Adam Williamson wrote: > > Well, reboot is a one-time operation; if there's only one user logged > in, they can only affect themselves by rebooting. Adjusting the clock or > installing new software isn't the same. Ok, actually "one time" feels like there's a more

Re: Draft privilege escalation policy for comments

2010-01-30 Thread Adam Williamson
On Sat, 2010-01-30 at 10:52 +0100, Till Maas wrote: > On Fri, Jan 29, 2010 at 02:27:13PM -0800, Adam Williamson wrote: > > > Please do provide any and all feedback on the proposed policy. if we can > > get it into a shape which most people on the list would find acceptable, > > my next step will b

Re: Draft privilege escalation policy for comments

2010-01-30 Thread Till Maas
On Fri, Jan 29, 2010 at 02:27:13PM -0800, Adam Williamson wrote: > Please do provide any and all feedback on the proposed policy. if we can > get it into a shape which most people on the list would find acceptable, > my next step will be to take it back to FESco for them to review. > Thanks. I do

Re: Draft privilege escalation policy for comments

2010-01-29 Thread Kevin Kofler
Adam Williamson wrote: > Please do provide any and all feedback on the proposed policy. if we can > get it into a shape which most people on the list would find acceptable, > my next step will be to take it back to FESco for them to review. > Thanks. >From the proposal: > Add, remove, upgrade or

Re: Draft privilege escalation policy for comments

2010-01-29 Thread Adam Williamson
On Fri, 2010-01-29 at 18:40 -0500, Colin Walters wrote: > > Please do provide any and all feedback on the proposed policy. if we can > > get it into a shape which most people on the list would find acceptable, > > my next step will be to take it back to FESco for them to review. > > Thanks. > > S

Re: Draft privilege escalation policy for comments

2010-01-29 Thread Colin Walters
Hi Adam, On Fri, Jan 29, 2010 at 5:27 PM, Adam Williamson wrote: > Hi, everyone. Since the big PackageKit brouhaha surrounding Fedora 12, > there's been a discussion surrounding the need for a policy about > privilege escalation in Fedora. Representing the QA group, we would like > for there to b

Draft privilege escalation policy for comments

2010-01-29 Thread Adam Williamson
Hi, everyone. Since the big PackageKit brouhaha surrounding Fedora 12, there's been a discussion surrounding the need for a policy about privilege escalation in Fedora. Representing the QA group, we would like for there to be such a policy in order to allow a meaningful review of privilege escalati